McAfee Application Control 6.1.0

Evlution Guie MAfee Applition Control 6.1.0 For use with epoliy Orhestrtor 4.5.0 4.6.0

COPYRIGHT Copyright 2012 MAfee, In. Do not opy without permission. TRADEMARK ATTRIBUTIONS MAfee, the MAfee logo, MAfee Ative Protetion, MAfee AppPrism, MAfee Artemis, MAfee ClenBoot, MAfee DeepSAFE, epoliy Orhestrtor, MAfee epo, MAfee EMM, MAfee Enterprise Moility Mngement, Founsore, Founstone, MAfee NetPrism, MAfee Poliy Enforer, Poliy L, MAfee QuikClen, Sfe Eyes, MAfee SECURE, SeureOS, MAfee Shreer, SiteAvisor, SmrtFilter, MAfee Stinger, MAfee Totl Protetion, TrusteSoure, VirusSn, WveSeure, WormTrq re tremrks or registere tremrks of MAfee, In. or its susiiries in the Unite Sttes n other ountries. Other nmes n rns my e lime s the property of others. LICENSE INFORMATION Liense Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 MAfee Applition Control 6.1.0 Evlution Guie

Contents Prefe 5 Aout this guie.................................. 5 Auiene.................................. 5 Conventions................................. 5 Wht's in this guie.............................. 6 Fin prout oumenttion.............................. 6 1 Allowing instlltion n utomti uptes on enpoints 7 Defining n instller to llow softwre instlltion..................... 7 Defining n upter to llow utomti uptes on enpoints................ 8 2 Ensuring tht ll softwre relese y pulisher runs 11 3 Verifying tht only uthorize oe n run 13 4 Running softwre from remote iretory 15 5 Allowing n ministrtor or user to instll or upte softwre 17 6 Mking emergeny hnges 19 Pling the enpoints in Upte moe......................... 20 Pling the enpoints in Enle moe......................... 21 7 Testing n pplition for enterprise-wie eployment 23 Pling the enpoints in Oserve moe......................... 24 Reviewing n nlyzing the oservtions........................ 25 Pling the enpoints in Enle moe......................... 26 8 Allowing self pprovl n instlltion of pplitions 29 Enle self pprovl on enpoints........................... 29 9 Fething n mnging the softwre inventory 31 Mnging the inventory............................... 31 Cheking for unknown threts, suh s APTs....................... 32 Cheking if virus is ientlly whiteliste....................... 33 10 Compring the inventory of n enpoint with tht of gol host 35 Compring the inventory.............................. 35 Reviewing the omprison results........................... 36 11 Whitelisting Jv or interprete sript files 37 Running the SC: Run Commns lient tsk....................... 38 12 Allowing AtiveX ontrols to run 41 MAfee Applition Control 6.1.0 Evlution Guie 3

Contents 13 Using Applition Control queries 43 Running query.................................. 43 Reeiving query results on emil........................... 43 Applition Control queries.............................. 44 14 Performing ommon or routine tsks 47 Creting poliy.................................. 47 Assigning the poliy................................. 49 Fething the inventory................................ 49 Uploing events.................................. 50 Viewing events.................................. 50 Inex 51 4 MAfee Applition Control 6.1.0 Evlution Guie

Prefe This guie provies the informtion you nee to omplete ommon use ses for the MAfee Applition Control prout. Contents Aout this guie Fin prout oumenttion Aout this guie This informtion esries the guie's trget uiene, the typogrphil onventions n ions use in this guie, n how the guie is orgnize. Auiene MAfee oumenttion is refully reserhe n written for the trget uiene. The informtion in this guie is intene primrily for: Aministrtors People who implement n enfore the ompny's seurity progrm. Users People who use the omputer where the softwre is running n n ess some or ll of its fetures. Conventions This guie uses these typogrphil onventions n ions. Book title, term, emphsis Bol User input, oe, messge Interfe text Hypertext lue Title of ook, hpter, or topi; new term; emphsis. Text tht is strongly emphsize. Commns n other text tht the user types; oe smple; isplye messge. Wors from the prout interfe like options, menus, uttons, n ilog oxes. A link to topi or to n externl wesite. Note: Aitionl informtion, like n lternte metho of essing n option. Tip: Suggestions n reommentions. Importnt/Cution: Vlule vie to protet your omputer system, softwre instlltion, network, usiness, or t. Wrning: Critil vie to prevent oily hrm when using hrwre prout. MAfee Applition Control 6.1.0 Evlution Guie 5

Prefe Fin prout oumenttion Wht's in this guie This guie is orgnize to help you fin the informtion you nee. This guie esries ommon use ses for the Applition Control prout. To use this guie effetively, you must e fmilir with si onepts of Applition Control n MAfee epoliy Orhestrtor versions 4.5 or 4.6. For more informtion on Applition Control, see the MAfee Chnge Control n Applition Control Prout Guie. For more informtion on MAfee epo, see the MAfee epoliy Orhestrtor Softwre Prout Guie for your version. Fin prout oumenttion MAfee provies the informtion you nee uring eh phse of prout implementtion, from instlltion to ily use n trouleshooting. After prout is relese, informtion out the prout is entere into the MAfee online KnowlegeBse. Tsk 1 Go to the MAfee Tehnil Support ServiePortl t http://mysupport.mfee.om. 2 Uner Self Servie, ess the type of informtion you nee: To ess... User oumenttion Do this... 1 Clik Prout Doumenttion. 2 Selet prout, then selet version. 3 Selet prout oument. KnowlegeBse Clik Serh the KnowlegeBse for nswers to your prout questions. Clik Browse the KnowlegeBse for rtiles liste y prout n version. 6 MAfee Applition Control 6.1.0 Evlution Guie

1 Allowing 1 instlltion n utomti uptes on enpoints Consier senrio in whih you woul like to llow instlltion of the Aoe Reer pplition on ll enpoints. After instlltion, you lso wnt to llow utomti uptes to the Aoe Reer pplition. To omplete this use se, you will nee to efine n instller n upter. Wht is the ifferene etween n instller n upter? There re essentilly two ttriutes tht n e ssoite with eh inry exeutle file, nmely uthorize n upter. Instllers When progrm (or n instller) is onfigure s n uthorize instller, it gets oth the ttriutes uthorize n upter. Regrless of whether the instller ws originlly present on the system or not, it is llowe to exeute n instll or upte softwre on the system. An uthorize instller is llowe on the sis of the heksum (SHA1) of the originl instller (speifie while onfiguring the poliy). This ensures tht irrespetive of the soure of instller (n how one gets this instller to the system), if the heksum vlue mthes, the instller will e uthorize n work s n upter. Upters Contents As the nme suggests, upters re pplitions tht upte the system (progrm oe, exe, ll, n so on). If progrm is onfigure s n upter, it is llowe to instll new softwre n upte existing progrm oe (inluing itself). However, n upter is not uthorize utomtilly. To e uthorize, n upter must e present in the inventory either through initil sn (soliifition) or given expliit uthoriztion (efine s n llowe inry vi poliy or e s upter se on heksum). Defining n instller to llow softwre instlltion Defining n upter to llow utomti uptes on enpoints Defining n instller to llow softwre instlltion In this use se, you will new instller s truste instller, suh s the instller for the Aoe Reer pplition. Downlo the instller for the Winows pltform n sve it on your esktop. In this exmple, we ssume tht you know the SHA1 heksum of the instller or n lulte it using utility. Here re the high level steps to omplete for this use se. For etile instrutions, refer to the Performing ommon or routine tsks setion. Tsk 1 Downlo the pplition from http://www.oe.om/ownlos/ n sve it. 2 Try to instll the pplition on n enpoint. The instlltion fils. MAfee Applition Control 6.1.0 Evlution Guie 7

1 Allowing instlltion n utomti uptes on enpoints Defining n upter to llow utomti uptes on enpoints 3 Complete these steps to new instller. Selet Menu Configurtion Soliore Rules Instllers. e f g h Selet Ations A Instller. The A Instller pge ppers. Speify the instller nme. For exmple, Aoe Reer pplition. Enter the pth of the instller file. Optionlly, speify the instller version. Speify the nme of the venor uthorizing the instller. For exmple, Aoe. Enter the SHA1 heksum. Clik A. 4 Crete poliy to efine the instller. Consier the following while efining the poliy. To the instller, selet the Instllers t n lik A. In the A Instller ilog ox, serh for n the instller. In our exmple, we the instller for the Aoe Reer pplition. 5 Assign this poliy to the enpoints. 6 Verify tht the instller is permitte to run n instll softwre on the enpoint. Log on to the enpoint. Nvigte to the http://www.oe.om/ownlos/ wepge. Downlo the instller for the Aoe Reer pplition to the esktop. Doule lik on the instller file. The instlltion suees. Defining n upter to llow utomti uptes on enpoints In this senrio, you will ensure tht only n uthorize upter is llowe to upte softwre on the enpoints. We will efine the Aoe upter s n uthorize upte gent so tht it n perioilly pth the Aoe inry files without user intervention on n enpoint. Authorize upters work t glol level n re not pplition speifi. After progrm is efine s n upter, it n mke hnges to the whitelist n moify ny write protete or re protete file. Here re the high level steps to omplete for this use se. For etile instrutions, refer to the Performing ommon or routine tsks setion. Tsk 1 Crete poliy to efine the upter. Consier the following while efining the poliy. To truste progrm, selet the Upters t n lik A. In the A Upter ilog ox, selet the Upter By Nme option, enter the nme n pth of the file, n speify n ientifition lel for the upter. In our exmple, enter C:\Progrm Files\Common Files\Aoe \Upter5\AoeUpter.exe in the Binry fiel. 2 Assign this poliy to the enpoints. 8 MAfee Applition Control 6.1.0 Evlution Guie

Allowing instlltion n utomti uptes on enpoints Defining n upter to llow utomti uptes on enpoints 1 3 Complete these steps to verify tht the uthorize progrm n perform softwre uptes on the protete enpoint. Log on to the enpoint. Open the Aoe Reer n lik Help Chek for Uptes. Uptes, if ville, re pplie. 4 Uplo events from the enpoint to the MAfee epo onsole. 5 View the events generte y the AoeUpter.exe proess on the Menu Reporting Soliore Events pge. MAfee Applition Control 6.1.0 Evlution Guie 9

1 Allowing instlltion n utomti uptes on enpoints Defining n upter to llow utomti uptes on enpoints 10 MAfee Applition Control 6.1.0 Evlution Guie

2 Ensuring 2 tht ll softwre relese y pulisher runs In this use se, you will n uthorize pulisher to llow users to ownlo n instll softwre enorse y the pulisher. You will ownlo the Aoe Reer pplition from http://www.oe.om/ownlos/ n extrt the seurity ertifite from the instller. Then, n register the seurity ertifite to the MAfee epo onsole to efine Aoe s truste pulisher. You n lso efine n internl ertifite s truste pulisher. After you efine the internl ertifite s pulisher, ll pplitions signe y the ertifite re llowe. Also, ll pplitions n inry files either e to or moifie on n enpoint tht re signe y the ertifite re utomtilly e to the whitelist. Here re the high level steps to omplete for this use se. For etile instrutions, refer to the Performing ommon or routine tsks setion. 1 Downlo the instller for the Aoe Reer pplition (for the Winows pltform) n sve it to lotion essile from MAfee epo server. 2 Complete these steps to extrt the ertifite n new pulisher. Selet Menu Configurtion Soliore Rules Pulishers. e Selet Ations Extrt Certifites. The Extrt Certifite from Binry pge ppers. Nvigte n speify the pth to the Aoe Reer instller. Speify reentils, if neee, to ess the network pth. Clik Extrt. 3 Crete poliy to efine the pulisher. To the pulisher, selet the Pulishers t n lik A. In the A Pulisher ilog ox, serh for n the ertifite. In our exmple, we the Aoe ertifite. 4 Assign this poliy to the enpoints. 5 Verify tht softwre enorse y the pulisher n e instlle on the enpoint. Log on to n enpoint. Nvigte to the Aoe wesite (http://www.oe.om/ownlos/). Downlo the Aoe Reer pplition for the Winows pltform n sve it on the esktop. Doule lik the instller. You will e le to instll the pplition. MAfee Applition Control 6.1.0 Evlution Guie 11

2 Ensuring tht ll softwre relese y pulisher runs 12 MAfee Applition Control 6.1.0 Evlution Guie

3 Verifying 3 tht only uthorize oe n run After you instll n enle Applition Control, you n verify tht only uthorize progrms n run on n enpoint. For the ske of illustrtion, ownlo the Aoe Reer pplition from http://www.oe.om/ ownlos/ n sve it on the esktop. Here re the high level steps to omplete for this use se. For etile instrutions, refer to the Performing ommon or routine tsks setion. 1 Ensure tht Applition Control is enle on the enpoint. 2 Complete these steps to verify tht n uthorize progrm n run. Log on to the enpoint. Run n pplition tht ws present on the enpoint prior to enling the softwre, suh s the we rowser. The exeute pplition runs. 3 Complete these steps to verify tht unuthorize progrms nnot run. Log on to the enpoint. Downlo the Aoe Reer pplition from http://www.oe.om/ownlos/ n sve it on the esktop. Doule lik the instller for the Aoe Reer pplition. The instlltion is enie. Delete the instller from the esktop. 4 Uplo events from the enpoint to the MAfee epo onsole. 5 Review the Exeution Denie event for the AroR32.exe file. 6 Run the Soliore: Attempte Violtions Detete in the Lst 24 Hours query. Selet Menu Reporting. Perform one of these tions: From the MAfee epo 4.6 onsole, selet Queries & Reports Applition Control. From the MAfee epo 4.5 onsole, selet Queries Applition Control. Clik Run for the Soliore: Attempte Violtions Detete in the Lst 24 Hours query. Review query results. MAfee Applition Control 6.1.0 Evlution Guie 13

3 Verifying tht only uthorize oe n run 14 MAfee Applition Control 6.1.0 Evlution Guie

4 4 Running softwre from remote iretory By efult, when enle, Applition Control prevents you from exeuting softwre store on network shre. However, mny orgniztions mintin shre folers on the internl network to store instllers for uthorize n liense pplitions. Suh network shres re within the seurity perimeter n re known n truste y the ustomer. You n set up network shre s truste iretory to llow users to run softwre present on the network shre. In this use se, you will efine iretory using its UNC pthnme n verify tht you n run softwre from this iretory. Ensure tht you hve oth re n write ess to the network shre. Also, provie the UNC pth using the \\servernme\shrenme syntx. Here re the high level steps to omplete for this use se. For etile instrutions, refer to the Performing ommon or routine tsks setion. 1 Downlo the Aoe Reer pplition from http://www.oe.om/ownlos/ n sve it on the network shre. 2 Log on to the enpoint n verify tht you nnot run the instller for the Aoe Reer pplition from the network shre. 3 Crete poliy to efine the truste iretory. Consier the following while efining the poliy. To efine the truste iretory, selet the Truste Diretories t n lik A. In the A Pth ilog ox, enter the lotion of the iretory, selet Inlue n Mke progrms exeute from this iretory upters. 4 Assign this poliy to the enpoints. 5 Complete these steps to verify tht you re le to run the instller from the network shre. Log on to the enpoint. Instll the Aoe Reer pplition from the iretory. Run the instlle progrm the progrm runs. Uninstll the Aoe Reer pplition from the enpoint. MAfee Applition Control 6.1.0 Evlution Guie 15

4 Running softwre from remote iretory 16 MAfee Applition Control 6.1.0 Evlution Guie

5 5 Allowing n ministrtor or user to instll or upte softwre In this use se, you will efine truste user, with or without system ministrtor privileges, to instll new pplition. In this senrio, we will ownlo (from http://pis.google.om) n instll photo pplition on n enpoint. Also, yourself s truste user n verify tht you re le to instll n run the pplition. Here re the high level steps to omplete for this use se. For etile instrutions, refer to the Performing ommon or routine tsks setion. 1 Crete poliy to efine the truste user. Consier the following while efining the poliy. To truste user, selet the Truste Users t n lik A. In the A User ilog ox, enter the user etils in omin\user syntx n speify n ientifition lel for the truste user. 2 Assign this poliy to the enpoints. 3 Complete these steps to verify tht the truste user n ownlo n upte softwre on the enpoint. Log on to the enpoint s truste user. Downlo the instller for the photo pplition to your esktop. Run the instller. The pplition instlls suessfully. Open the pplition. The pplition runs suessfully. MAfee Applition Control 6.1.0 Evlution Guie 17

5 Allowing n ministrtor or user to instll or upte softwre 18 MAfee Applition Control 6.1.0 Evlution Guie

6 Mking 6 emergeny hnges To implement n emergeny hnge (when you nnot use truste users, iretories, pulishers or instllers), you n rete hnge winow tht overries ll protetion n tmper proofing tht is in effet. You shoul use hnge winow only when the other ville mehnisms nnot e use. Here re the high level steps to omplete for this use se. 1 Ple the enpoints in Upte moe. 2 Complete these steps to verify tht you n mke emergeny hnges. Log on to the enpoint. e f Downlo the Google Erth pplition from http://erth.google.om/ to your esktop. Instll the Google Erth pplition. The pplition instlls suessfully. Open the Google Erth pplition. The pplition runs suessfully. Uninstll the pplition to restore the enpoint to its originl stte. Delete the instller from the esktop. When n enpoint is in Upte moe, ll hnges to existing files in the inventory generte orresponing upte moe events, suh s FILE_MODIFIED_UPDATE n FILE_RENAMED_UPDATE. In ition, the pplition genertes the FILE_SOLIDIFIED event for new files n FILE_UNSOLIDIFIED event for elete files. 3 Ple the enpoints in Enle moe. 4 Complete these steps to verify tht hnges nnot e me fter the hnge winow loses. Log on to the enpoint. Downlo the Google Erth pplition from http://erth.google.om/ to your esktop. Try to instll the Google Erth pplition. The instller oes not run. Delete the instller from the esktop. Contents Pling the enpoints in Upte moe Pling the enpoints in Enle moe MAfee Applition Control 6.1.0 Evlution Guie 19

6 Mking emergeny hnges Pling the enpoints in Upte moe Pling the enpoints in Upte moe Use this tsk to ple the enpoints in Upte moe to mke emergeny hnges. Tsk 1 Selet Menu Systems System Tree. 2 Complete these steps for the MAfee epo 4.6 onsole: Perform one of these tions: To pply the lient tsk to group, selet group in the System Tree n swith to the Assigne Client Tsks t. To pply the lient tsk to n enpoint, selet the enpoint on the Systems pge n lik Ations Agent Moify Tsks on Single System. Clik Ations New Client Tsk Assignment. The Client Tsk Assignment Builer pge isplys. Selet the Soliore 6.1.0 prout, SC: Begin Upte Moe tsk type, n lik Crete New Tsk. The Client Tsk Ctlog pge isplys. Speify the tsk nme n ny esriptive informtion. 3 Complete these steps for the MAfee epo 4.5 onsole: Perform one of these tions: To pply the lient tsk to group, selet group in the System Tree n swith to the Client Tsks t. To pply the lient tsk to n enpoint, selet the enpoint on the Systems pge n lik Ations Agent Moify Tsks on Single System. Clik Ations New Tsk. The Client Tsk Builer pge isplys. Speify the tsk nme n ny esriptive informtion. Selet SC: Begin Upte Moe (Soliore 6.1.0) n lik Next. The Configurtion pge isplys. 4 Enter the Workflow ID n ny omments. The workflow ID is meningful esription for the upte winow. 5 Clik Sve (MAfee epo 4.6 only). 6 Clik Next. The Sheule pge isplys. 7 Speify sheuling etils n lik Next. 8 Review n verify the tsk etils n lik Sve. 9 Optionlly, wke up the gent to sen your lient tsk to the enpoint immeitely. 20 MAfee Applition Control 6.1.0 Evlution Guie

Mking emergeny hnges Pling the enpoints in Enle moe 6 Pling the enpoints in Enle moe Use this tsk to ple the enpoints k in Enle moe fter you omplete the require hnges in the Upte moe. Tsk 1 Selet Menu Systems System Tree. 2 Complete these steps for the MAfee epo 4.6 onsole: Perform one of these tions: To pply the lient tsk to group, selet group in the System Tree n swith to the Assigne Client Tsks t. To pply the lient tsk to n enpoint, selet the enpoint on the Systems pge n lik Ations Agent Moify Tsks on Single System. Clik Ations New Client Tsk Assignment. The Client Tsk Assignment Builer pge isplys. Selet the Soliore 6.1.0 prout, SC: En Upte Moe tsk type, n lik Crete New Tsk. The Client Tsk Ctlog pge isplys. Speify the tsk nme n ny esriptive informtion. 3 Complete these steps for the MAfee epo 4.5 onsole: Perform one of these tions: To pply the lient tsk to group, selet group in the System Tree n swith to the Client Tsks t. To pply the lient tsk to n enpoint, selet the enpoint on the Systems pge n lik Ations Agent Moify Tsks on Single System. Clik Ations New Tsk. The Client Tsk Builer pge isplys. Speify the tsk nme n ny esriptive informtion. Selet SC: En Upte Moe (Soliore 6.1.0) n lik Next. The Configurtion pge sttes tht no other onfigurtion settings re require for the tsk. 4 Clik Sve (MAfee epo 4.6 only). 5 Clik Next. The Sheule pge isplys. 6 Speify sheuling etils n lik Next. 7 Review n verify the tsk etils n lik Sve. 8 Optionlly, wke up the gent to sen your lient tsk to the enpoint immeitely. MAfee Applition Control 6.1.0 Evlution Guie 21

6 Mking emergeny hnges Pling the enpoints in Enle moe 22 MAfee Applition Control 6.1.0 Evlution Guie

7 Testing 7 n pplition for enterprisewie eployment Prior to eploying new pplition ross the enterprise, you n perform ry run n eploy the pplition on few test enpoints running in Oserve moe. When running in Oserve moe, Applition Control emultes the Enle moe ut logs oservtions inste of preventing ny pplitions or oe from running. An oservtion is logge orresponing to eh tion Applition Control will tke when in Enle moe. In this use se, you will ownlo n instll Google Tlk on n enpoint to sertin n mnge ny issues tht you might enounter when running in Enle moe. This will ensure tht the enterprise wie eployment of the pplition will e semless. Here re the high level steps to omplete for this use se. For etile instrutions, refer to the Performing ommon or routine tsks setion. 1 Ple the enpoint in Oserve moe. If the enpoint is urrently in Enle moe, run the SC: Oserve Moe lient tsk to ple the enpoint in Oserve moe. (etile in this use se) If you re using new enpoint (fresh eployment of Applition Control), run the SC: Enle lient tsk to ple the enpoint in Oserve moe. 2 Instll the pplition on the enpoint. Log on to the enpoint. Instll n run the Google Tlk pplition. 3 Review n tke tions for the generte oservtions. Oservtions re generte every minute. 4 Crete new rule group, nme GTlk, for the provie suggestions. 5 Ple the enpoint in Enle moe. 6 To ensure semless eployment of the Google Tlk pplition on enpoints running in Enle moe, the GTlk rule group to poliy pplie to the enpoints. Contents Pling the enpoints in Oserve moe Reviewing n nlyzing the oservtions Pling the enpoints in Enle moe MAfee Applition Control 6.1.0 Evlution Guie 23

7 Testing n pplition for enterprise-wie eployment Pling the enpoints in Oserve moe Pling the enpoints in Oserve moe Use this tsk to ple the enpoints in Oserve moe. Tsk 1 Selet Menu Systems System Tree. 2 Complete these steps for the MAfee epo 4.6 onsole: Perform one of these tions: To pply the lient tsk to group, selet group in the System Tree n swith to the Assigne Client Tsks t. To pply the lient tsk to n enpoint, selet the enpoint on the Systems pge n lik Ations Agent Moify Tsks on Single System. Clik Ations New Client Tsk Assignment. The Client Tsk Assignment Builer pge isplys. Selet the Soliore 6.1.0 prout, SC: Oserve Moe tsk type, n lik Crete New Tsk. The Client Tsk Ctlog pge isplys. Speify the tsk nme n ny esriptive informtion. 3 Complete these steps for the MAfee epo 4.5 onsole: Perform one of these tions: To pply the lient tsk to group, selet group in the System Tree n swith to the Client Tsks t. To pply the lient tsk to n enpoint, selet the enpoint on the Systems pge n lik Ations Agent Moify Tsks on Single System. Clik Ations New Tsk. The Client Tsk Builer pge isplys. Speify the tsk nme n ny esriptive informtion. Selet SC: Oserve Moe (Soliore 6.1.0) n lik Next. The Configurtion pge isplys. 4 Enter the Workflow ID n ny omments. The workflow ID provies meningful esription for swithing to Oserve moe. 5 Clik Sve (MAfee epo 4.6 only). 6 Clik Next. The Sheule pge isplys. 7 Speify sheuling etils n lik Next. 8 Review n verify the tsk etils n lik Sve. 9 Optionlly, wke up the gent to sen your lient tsk to the enpoint immeitely. 24 MAfee Applition Control 6.1.0 Evlution Guie

Testing n pplition for enterprise-wie eployment Reviewing n nlyzing the oservtions 7 Reviewing n nlyzing the oservtions Use this tsk to review n nlyze the logge oservtions. Tsk 1 Selet Menu Applition Control Oservtions Oservtions. The Oservtions pge isplys. On this pge, you n review the following informtion for eh oservtion: Time t whih the oservtion ws logge Nme of the host on whih the oservtion ourre Nme of user who use the oservtion Nme n lotion of the inry for whih the oservtion ws generte Enterprise trust level of the inry file Type of oservtion Sttus of the oservtion (Approve, Dismisse, or Pening) Nme of the prent proess tht te upon the inry file 2 Filter oservtions to review the oservtions generte for the Google Tlk pplition y using one of these methos. Enter serh string in the Quik fin fiel n lik Apply to view oservtions tht mth the speifie serh riteri. Sort the list se on the time, inry nme, or proess nme y liking the olumn heing. 3 Clik Show Suggestions for the oservtion. Detile informtion for the oservtion isplys. By efult, the file ssoite with the oservtion is selete in the Proess Tree pne. 4 Review the suggestions n etils ville for the oservtion. For ll files, the Binry Info pne is ville on the Suggestions t. The Pulisher Info pne is isplye only if ertifite is ssoite with the file. MAfee Applition Control 6.1.0 Evlution Guie 25

7 Testing n pplition for enterprise-wie eployment Pling the enpoints in Enle moe Binry Info Displys etile informtion for the inry file. You n review the inry nme, pth, n heksum. Clou Trust Sore n Enterprise Trust Level re isplye for the inry file if ville with the MAfee GTI file reputtion servie. Depening on the file's properties n ttriutes, one or more of the following tions re ville for the file. A s Instller A s Upter A to Whitelist A Prent s Upter A s Exeption Allow y Cheksum A s Truste Diretory Pulisher Info Displys informtion for the ertifite ssoite with the file. For the ertifite you n review the following etils: Compny nme the ertifite is issue to Certifite issuing uthority Expirtion te for the ertifite For ertifite, you n lik A Pulisher to the ertifite s pulisher. e f Tke the require tions for the file. The Rule Group n Files to e Whiteliste pnes re upte se on the selete tions. Review the informtion in the Rule Group n Files to e Whiteliste pnes. The files you to the whitelist re inlue in the inventory of the speifi enpoint while ny rules you to rule group re ville t glol level n n use on multiple enpoints (s long s they re e to the poliies pplie to the enpoints). Selet Crete new Rule Group n enter the rule group nme (for exmple, GTlk). Clik Approve. The Approve Oservtions winow isplys. Enter remrks to optionlly provie esription for the pprovl. Clik OK. Pling the enpoints in Enle moe Use this tsk to ple the enpoints in Enle moe fter you omplete the require hnges in the Oserve moe. Tsk 1 Selet Menu Systems System Tree. 2 Complete these steps for the MAfee epo 4.6 onsole: Perform one of these tions: To pply the lient tsk to group, selet group in the System Tree n swith to the Assigne Client Tsks t. To pply the lient tsk to n enpoint, selet the enpoint on the Systems pge n lik Ations Agent Moify Tsks on Single System. 26 MAfee Applition Control 6.1.0 Evlution Guie

Testing n pplition for enterprise-wie eployment Pling the enpoints in Enle moe 7 Clik Ations New Client Tsk Assignment. The Client Tsk Assignment Builer pge isplys. Selet the Soliore 6.1.0 prout, SC: Oserve Moe tsk type, n lik Crete New Tsk. The Client Tsk Ctlog pge isplys. Speify the tsk nme n ny esriptive informtion. 3 Complete these steps for the MAfee epo 4.5 onsole: Perform one of these tions: To pply the lient tsk to group, selet group in the System Tree n swith to the Client Tsks t. To pply the lient tsk to n enpoint, selet the enpoint on the Systems pge n lik Ations Agent Moify Tsks on Single System. Clik Ations New Tsk. The Client Tsk Builer pge isplys. Speify the tsk nme n ny esriptive informtion. Selet SC: Oserve Moe (Soliore 6.1.0) n lik Next. The Configurtion pge isplys. 4 Selet En Oserve Moe. 5 Selet Enle Soliore lient to ple the enpoint in Enle moe. 6 Selet Upte hnges me in Oserve Moe to Whitelist to upte the inventory with the reent hnges. 7 Clik Sve (MAfee epo 4.6 only). 8 Clik Next. The Sheule pge isplys. 9 Speify sheuling etils n lik Next. 10 Review n verify the tsk etils n lik Sve. 11 Optionlly, wke up the gent to sen your lient tsk to the enpoint immeitely. MAfee Applition Control 6.1.0 Evlution Guie 27

7 Testing n pplition for enterprise-wie eployment Pling the enpoints in Enle moe 28 MAfee Applition Control 6.1.0 Evlution Guie

8 Allowing 8 self pprovl n instlltion of pplitions By efult, Applition Control prevents ny new or unknown pplitions from running on protete enpoints. In this use se, you will enle the self pprovl feture to llow users to self pprove n instll softwre. When this feture is enle n users try to run n unknown or new pplition on protete enpoint, they re prompte to pprove or eny the tion. You will ownlo Aoe Reer n ttempt to instll it on protete enpoint. Here re the high level steps to omplete for this use se. For etile instrutions, refer to the Performing ommon or routine tsks setion. 1 Ensure tht Applition Control is enle on the enpoint. 2 Downlo the Aoe Reer instller from http://www.oe.om/ownlos/ n sve it. 3 Try to instll the pplition on n enpoint. The instlltion fils. 4 Enle the self pprovl feture on the enpoints. 5 Try to instll the pplition on n enpoint. Applition Control etets the instlltion ttempt n isplys the MAfee Applition Control Self Approvl ilog ox tht prompts the user to tke n tion. 6 Review the event informtion, provie justifition, n lik Allow to llow instlltion of the pplition. This will suessfully instll the pplition on the enpoint. Note tht when you self pprove the tion, n pprovl request is sent to the MAfee epo ministrtor who reviews the provie justifition to etermine whether to llow or n the tion for one or more enpoints in the enterprise. The MAfee epo ministrtor will llow the tion only if it is in orne with the orporte poliies n the instller is truste n known. Enle self pprovl on enpoints By efult, the self pprovl feture is isle on enpoints. You n onfigure poliy to enle this feture on selete enpoints. Use this tsk to enle the self pprovl feture on enpoints. After the feture is enle, en users n self pprove n run n unknown or new pplition on protete enpoint. Tsk 1 Selet Menu Poliy Poliy Ctlog. 2 Selet the Soliore 6.1.0: Applition Control prout. 3 Selet the Applition Control Options (Winows) tegory. MAfee Applition Control 6.1.0 Evlution Guie 29

8 Allowing self pprovl n instlltion of pplitions Enle self pprovl on enpoints 4 Eit the My Defult poliy. If you re using MAfee epo 4.6, lik the poliy. If you re using MAfee epo 4.5, lik Eit Settings for the poliy. 5 Selet the Enle Self Approvl option. 6 Optionlly, speify the messge to isply to the users on the enpoints when they try to run new or unknown pplition. This speifie text is isplye on the enpoint in the MAfee Applition Control Self Approvl ilog ox. 7 Speify timeout vlue for the MAfee Applition Control Self Approvl ilog ox. The speifie vlue etermines the time urtion for whih the MAfee Applition Control Self Approvl ilog ox isplys on the enpoint fter n tion is performe y the user. If the user oes not tke n tion in the speifie time urtion, the tion is utomtilly enie n the MAfee Applition Control Self Approvl ilog ox loses. 8 Sve the poliy n pply to the relevnt enpoints. After the poliy is pplie, the self pprovl feture is enle on the enpoints. 30 MAfee Applition Control 6.1.0 Evlution Guie

9 Fething 9 n mnging the softwre inventory In this senrio, you will feth list of ll softwre running on n enpoint n review n mnge the enpoint inventory. Here re the high level steps to omplete for this use se. For etile instrutions, refer to the Performing ommon or routine tsks setion. 1 Feth the softwre inventory for n enpoint. 2 Wke up the gent to sen events from the enpoint. 3 Review n mnge the inventory for the enpoint. 4 Wke up the gent to sen the poliies to the enpoint. 5 Chek for unknown threts, suh s vne persistent thret (APTs). 6 Chek if virus is ientlly whiteliste. Contents Mnging the inventory Cheking for unknown threts, suh s APTs Cheking if virus is ientlly whiteliste Mnging the inventory Applition Control is integrte with the MAfee GTI file reputtion servie. Bse on informtion fethe from GTI, the pplition n inry files in the inventory re sorte into Goo, B, n Unlssifie tegories. For eh pplition n inry file, GTI provies the trust level n trust sore. The trust level inites if the file is goo,, or unknown file. The trust sore vlue rnges etween 1 to 5. A vlue of 1 or 2 represents known files, suh s trojn, virus, n Potentilly unwnte progrms (PUP) files. A vlue of 3 inites n Unlssifie file. A vlue of 4 or 5 represents known n truste goo files. Use this tsk to mnge n tke tions on the softwre inventory for n enpoint. Tsk 1 Selet Menu Applition Control Inventory By Systems. 2 Clik View for the enpoint. The inventory for the selete enpoint is liste. MAfee Applition Control 6.1.0 Evlution Guie 31

9 Fething n mnging the softwre inventory Cheking for unknown threts, suh s APTs 3 Review the pplitions running on the enpoint. By efult, se on informtion reeive from GTI, the pplition n inry files re sorte into Goo, B, n Unlssifie tegories. Here re some lterntive views you n use. Review ll inry files on the enpoint Review ll unlssifie inry files on the enpoint Sort the pplition n inry files se on venor Serh for file se on its heksum vlue Selet Binry Nme filter, o not speify file nme, n lik Serh. All inry files on the enpoint re liste. Nvigte to the Applitions pne n selet the Unlssifie Binries noe. All unlssifie inry files on the enpoint re liste. Selet the Venor filter, o not speify venor nme, n lik Serh. The pplitions n inry files re sorte y the venor. For eh venor, you n view the Goo, B, n Unlssifie tegories. Selet the Binry SHA1 or Binry MD5 filter, enter heksum vlue, n lik Serh. The inry file with the speifie heksum vlue is isplye. 4 Review n mnge the unlssifie files. If n unlssifie pplition is from repute venor, is internlly evelope, or reognize, mrk it s goo pplition. To mrk n unlssifie pplition or inry file s goo pplition, eit the enterprise trust level of the file. By efult, the enterprise trust level for file is the sme s the lou trust level. When eite, the enterprise trust level for file overries the lou trust level for the file. To eit the enterprise trust level for file, hoose the file n selet Ations Chnge Enterprise Trust Level. To prevent pplitions or inry files from running, hoose the files n selet Ations Bn Binries. Speify the rule group in whih to the rules. To llow known pplitions or inry files to run, hoose the files n selet Ations Allow Binries. Speify the rule group in whih to the rules. 5 A the upte rule group to the poliies pplie to the enpoint. Cheking for unknown threts, suh s APTs Applition Control is integrte with the MAfee GTI file reputtion servie. Bse on the informtion fethe from GTI, pplition n inry files in the inventory re sorte into Goo, B, n Unlssifie tegories. In effet, this segregtes your inventory into three tegories: Blklist (known mlwre or pplitions) Whitelist (known goo or truste pplition) Grylist (unknown pplitions) Any pre existing APTs will resie in the Grylist or Unlssifie tegory. In this use se, you will lern how to hek n tke tions for unknown threts, suh s APTs. Use this tsk to hek for unknown threts, suh s APTs. Here re the high level steps to omplete for this use se. Plese note tht severl steps in the work flow lie outsie the sope of the prout. Tsk 1 Feth the softwre inventory for n enpoint. 2 Review the inventory. 32 MAfee Applition Control 6.1.0 Evlution Guie

Fething n mnging the softwre inventory Cheking if virus is ientlly whiteliste 9 3 Bn the B pplitions n inry files. Alterntively, if you hve instlle MAfee VirusSn Enterprise, use it to len the pplition n inry files. 4 Anlyze the unlssifie files. If they exist, the APTs will usully e one of the unlssifie files. Use these guielines to mnge the unlssifie files. Mrk n unlssifie pplition s goo pplition if it meets one or more of the following riteri. Chek if the pplition is n internlly evelope or reognize pplition. Retegorize ll in house or truste files s Goo files y eiting the enterprise trust level of the file. To eit the enterprise trust level for file, selet the file n selet Ations Chnge Enterprise Trust Level. Verify if the pplition or inry file is signe y repute ertifite uthority (CA). You n new filter to ientify unlssifie pplitions tht re signe. 1 Selet A Sve Filter from the Sve Filters list. 2 Selet the Hs Cert filter, set omprison to Equls, n selet the True vlue. 3 Selet the Trust Level (Enterprise) filter, set omprison to Equls, n selet the Unlssifie vlue. 4 Clik Upte Filter. Compre the inventory of the enpoint with truste gol imge. This will help you ientify itionl pplitions tht GTI is not wre of ut re truste or known to your orgniztion. Use GTI tools, suh s GetClen or GetSusp to sen n unknown file k to GTI for further nlysis. For more informtion out these tools, see KB69385. If you hve MAfee Host Intrusion Prevention instlle, rete firewll rule to lok the gry inry's network ess. While efining the rule, ensure tht you ientify the file y its nme or heksum. Cheking if virus is ientlly whiteliste If you o not hve n nti virus softwre instlle n hve enle Applition Control, you oul hve ientlly whiteliste virus file. In this use se, you will verify if virus file is present in your inventory n will tke tion for the file. If ville with the MAfee GTI file reputtion servie, for eh pplition n inry file, GTI provies the trust level n trust sore. For known B files, the lou trust sore vlue is 1 or 2 n Applition Control genertes the THREAT_DETECTED event. Use this tsk to hek if virus is ientlly whiteliste. Here re the high level steps to omplete for this use se. For etile instrutions, refer to the Performing ommon or routine tsks setion. Tsk 1 Define n lert to reeive notifition when the THREAT_DETECTED event is generte. Selet Menu Automtion Automti Responses. Clik New Response. The Response Builer wizr opens to the Desription pge. MAfee Applition Control 6.1.0 Evlution Guie 33

9 Fething n mnging the softwre inventory Cheking if virus is ientlly whiteliste e f g h i j k l m Enter the lert nme. Selet the epo Notifition Events group n Thret event type. Selet Enle. Clik Next. The Filter pge ppers. Speify the enpoint or group in the Define t fiel. Selet the Thret Nme filter, set omprison to Equls, n selet the THREAT_DETECTED vlue. Clik Next. The Aggregtion pge ppers. Selet Trigger this response for every event. Clik Next. The Ations pge ppers. Selet Sen Emil, speify the emil etils, n lik Next. Review the etils n lik Sve. 2 Feth the inventory for the enpoint. 3 Review if ny lerts re generte for the THREAT_DETECTED event. 4 Bn the infete files. 34 MAfee Applition Control 6.1.0 Evlution Guie

10 Compring the inventory of n enpoint with tht of gol host Imge evition is use to ompre the inventory of n enpoint with the golen inventory tht is fethe from esignte gol system. This helps you to trk the inventory present on n enpoint n ientify ny ifferenes tht our. In this senrio, you will feth the seline inventory of n enpoint n ompre it with the inventory of your Gol Host. Here re the high level steps to omplete for this use se. For etile instrutions, refer to the Performing ommon or routine tsks setion. 1 Feth the inventory for your Gol Host. 2 Feth the inventory for n enpoint, suh s Host A. 3 Review the Menu Automtion Soliore Client Tsk Log pge to ensure tht oth lient tsks omplete suessfully. 4 Compre the inventory of Gol Host with the inventory of Host A. 5 Review the omprison results. Contents Compring the inventory Reviewing the omprison results Compring the inventory Use this tsk to ompre the inventory of the Gol Host with the inventory of Host A. Tsk 1 Selet Menu Automtion Server Tsks. 2 Clik Ations New Tsk. The Server Tsk Builer wizr opens. 3 Type the tsk nme n lik Next. 4 Selet Soliore: Run Imge Devition from the Ations rop own list. 5 Speify the gol system (Gol Host). 6 Selet the enpoint to ompre with the gol system (Host A) n lik Next. The Sheule pge ppers. MAfee Applition Control 6.1.0 Evlution Guie 35

10 Compring the inventory of n enpoint with tht of gol host Reviewing the omprison results 7 Speify the sheule for the tsk. To instntly review the omprison results, run the server tsk immeitely. 8 Clik Next. The Summry pge ppers. 9 Review the tsk summry n lik Sve. Reviewing the omprison results Use this tsk to review the results of the inventory omprison. Tsk 1 Selet Menu Applition Control Imge Devition. 2 Lote the Gol Host n Host A omprison. 3 Clik Show Devitions. 4 Review the omprison etils. Selet the view type. You n orgnize the results se on pplitions or inry files. Use the ville filters to sort the results. Using the filters, you n view new (e), moifie, n remove (missing) files. Use the Exeution Sttus Mismth filter to view files with hnges to the exeution sttus. 36 MAfee Applition Control 6.1.0 Evlution Guie

11 Whitelisting Jv or interprete sript files Applition Control tmper proofs ll Portle Exeutle (PE) files n ertin sript files. When the softwre inventory is rete for n enpoint, ll PE files n the following sript files re e to the inventory..ps1.ve.t 16Bit.m.vs.pif.exe.sys.om Using the softwre, you n tmper proof other non PE files, suh s Jv lss files y ing them to the softwre inventory. To non PE file, speify the sript interpreter n the file extension. In this senrio, you will whitelist Jv lss files lote on the C:\ rive (C:\jvlsses). Here re the high level steps to omplete for this use se. For etile instrutions, refer to the Performing ommon or routine tsks setion. 1 Run the SC: Run Commns lient tsk to omplete these tsks: A the progrm ssoite with the files s n interpreter. In our exmple, we will jv.exe s n interpreter. A the require files to the softwre inventory. In our exmple, we will Jv lss files to the inventory. 2 Uplo events from the enpoint to the MAfee epo onsole. 3 Complete these steps to verify tht the SC: Run Commns lient tsk exeute suessfully. Selet Menu Automtion Soliore Client Tsk Log. Chek if the lient tsk omplete suessfully. MAfee Applition Control 6.1.0 Evlution Guie 37

11 Whitelisting Jv or interprete sript files Running the SC: Run Commns lient tsk 4 Complete these steps to verify tht you n exeute whiteliste jr file ut nnot exeute jr file tht is not in the whitelist. Log on to the enpoint. Exeute the whiteliste jr file y using the following ommn: jv jr <jv lss file pth> The jv lss file exeutes. Copy the sme jr file to ifferent lotion n exeute the file y using the following ommn: jv jr <jv lss file pth> The jv lss file oes not exeute. 5 Uplo events from the enpoint to the MAfee epo onsole. 6 Review the EXECUTION_DENIED event generte for the exeution of the unuthorize jv lss file. Running the SC: Run Commns lient tsk Use this tsk to jv.exe s n uthorize progrm n.jr files to the inventory. Tsk 1 Selet Menu Systems System Tree. 2 Complete these steps for the MAfee epo 4.6 onsole: Perform one of these tions: To pply the lient tsk to group, selet group in the System Tree n swith to the Assigne Client Tsks t. To pply the lient tsk to n enpoint, selet the enpoint on the Systems pge n lik Ations Agent Moify Tsks on Single System. Clik Ations New Client Tsk Assignment. The Client Tsk Assignment Builer pge isplys. Selet the Soliore 6.1.0 prout, SC: Run Commns tsk type, n lik Crete New Tsk. The Client Tsk Ctlog pge isplys. Speify the tsk nme n ny esriptive informtion. 3 Complete these steps for the MAfee epo 4.5 onsole: Perform one of these tions: To pply the lient tsk to group, selet the group in the System Tree n swith to the Client Tsks t. To pply the lient tsk to n enpoint, selet the enpoint on the Systems pge n lik Ations Agent Moify Tsks on Single System. Clik Ations New Tsk. The Client Tsk Builer pge isplys. 38 MAfee Applition Control 6.1.0 Evlution Guie

Whitelisting Jv or interprete sript files Running the SC: Run Commns lient tsk 11 Speify the tsk nme n ny esriptive informtion. Selet SC: Run Commns (Soliore 6.1.0) n lik Next. The Configurtion pge isplys. 4 Enter the following ommn: sripts.jr "jv.exe" 5 Clik + n enter the following ommn: so <lotion of jr files> 6 Selet Requires Response. 7 Clik Sve (MAfee epo 4.6 only). 8 Clik Next. The Sheule pge isplys. 9 Speify sheule etils n lik Next. 10 Review n verify the tsk etils n lik Sve. 11 Optionlly, wke up the gent to sen your lient tsk to the enpoint immeitely. MAfee Applition Control 6.1.0 Evlution Guie 39

11 Whitelisting Jv or interprete sript files Running the SC: Run Commns lient tsk 40 MAfee Applition Control 6.1.0 Evlution Guie

12 Allowing AtiveX ontrols to run By efult, Applition Control prevents the instlltion of AtiveX ontrols on enpoints. You n use the AtiveX feture to instll n run AtiveX ontrols on enpoints. This feture is enle y efult n ville only on the Winows pltform. Only the Internet Explorer rowser is supporte for AtiveX ontrol instlltions. If you re using 64 it operting system, instlltion of AtiveX ontrols is supporte only for the 32 it Internet Explorer pplition. Simultneous instlltion of AtiveX ontrols using multiple ts of Internet Explorer is not supporte. Here re high level steps to help you use the AtiveX feture. 1 Instll the require AtiveX ontrol on the enpoint. Log on to the enpoint. Nvigte to the http://www.weex.om/lp/jointest/ pge. Enter the user nme n emil ID. Clik Join. The rowser prompts you to instll the AtiveX ontrol. Applition Control prevents the instlltion of AtiveX ontrol on the enpoint. 2 Review the notifition for the AtiveX Instlltion Prevente event on the enpoint. Right lik the MAfee Agent ion in the system try. Selet Quik Settings Applition n Chnge Control Events. The Applition n Chnge Control Events onsole ppers. Lote the AtiveX Instlltion Prevente event. 3 Wit for few minutes. Oservtions re generte every minute. 4 Uplo events from the enpoint to the MAfee epo onsole. 5 Review n tke tions for the AtiveX Instlltion Prevente event from the MAfee epo onsole. Selet Menu Reporting Soliore Events. e Lote the AtiveX Instlltion Prevente event for the enpoint. Clik Show Suggestions. Detile informtion for the event ppers. Clik A Pulisher to the ertifite ssoite with the AtiveX ontrol s pulisher. Speify the rule group for the suggestions. MAfee Applition Control 6.1.0 Evlution Guie 41

12 Allowing AtiveX ontrols to run f g Clik Approve. The Approve winow isplys. Clik OK. 6 Ensure the upte rule group is inlue in poliy pplie to the enpoint. 7 Complete these steps to verify tht you n instll the AtiveX ontrol on the enpoint. Log on to the enpoint. Nvigte to the http://www.weex.om/lp/jointest/ pge. Enter the user nme n emil ID. Clik Join. You n instll the AtiveX ontrol on the enpoint. 42 MAfee Applition Control 6.1.0 Evlution Guie

13 Using Applition Control queries From the MAfee epo onsole, you n run queries on the t store in the MAfee epo tse to view the sttus of the enpoints. Contents Running query Reeiving query results on emil Applition Control queries Running query Use this tsk to run query. Tsk 1 Selet Menu Reporting. 2 Perform one of these tions: From the MAfee epo 4.6 onsole, selet Queries & Reports. From the MAfee epo 4.5 onsole, selet Queries. 3 Selet the Applition Control group uner Shre Groups. 4 Review the queries in the list. 5 Nvigte to the require query n lik Run. Results for the selete query re isplye. 6 Clik Close to return to the previous pge. Reeiving query results on emil Use this tsk to reeive results for query vi emil. Tsk 1 Selet Menu Automtion Server Tsks. 2 Clik Ations New Tsk. The Server Tsk Builer wizr opens. 3 Type the tsk nme n lik Next. 4 Selet Run Query from the Ations rop own list. MAfee Applition Control 6.1.0 Evlution Guie 43

13 Using Applition Control queries Applition Control queries 5 Speify the query to run. Clik the utton next to the Query fiel. The Selet query from the list ilog ox ppers. Swith to the Shre Groups t. Nvigte to the Applition Control group n selet query. Clik OK. 6 Speify emil etils. From the MAfee epo 4.6 onsole, lik the utton next to the Su Ations fiel, selet Emil File in the ilog ox, n lik OK. From the MAfee epo 4.5 onsole, view the Su Ations rop own list n selet Emil File. 7 Speify the reipient's emil ress n lik Next. The Sheule pge ppers. 8 Speify the sheule for this tsk n lik Next. The Summry pge ppers. 9 Review the tsk summry n lik Sve. Applition Control queries The following Applition Control queries re ville from the MAfee epo onsole. Tle 13-1 Applition Control Queries Query Self Approvl Auit Report Soliore: Alerts Soliore: Applition Control Agent Sttus Soliore: Attempte Violtions Detete in the Lst 24 Hours Soliore: Attempte Violtions Detete in the Lst 7 Dys Soliore: Non Complint Soliore Agents Soliore: Soliore Agent Sttus Report Desription Displys list of ll pprovl requests reeive from the enpoints in the lst month. Displys ll lerts generte in the lst 3 months. Displys the sttus of ll enpoints with the Applition Control liense whih re mnge y the MAfee epo onsole. The pie hrt tegorizes the informtion se on the lient sttus. Clik segment to review enpoint informtion. Displys the ttempte violtion events etete uring the lst 24 hours. The line hrt plots t on per hour sis. Clik vlue on the hrt to review event etils. Displys the ttempte violtion events etete uring the lst seven ys. The line hrt plots t on per y sis. Clik vlue on the hrt to review event etils. Lists the enpoints tht re urrently non omplint. The list is sorte se on the reson for non ompline. An enpoint n e non omplint: If it is in Disle, Oserve, or Upte moe If it is operting in limite feture tivtion moe If the lol ommn line interfe (CLI) ess is reovere Displys the sttus of ll enpoints mnge y the MAfee epo onsole. This report omines informtion for oth the Applition Control n Chnge Control lienses. The pie hrt tegorizes informtion se on the lient sttus. Clik segment to review etile informtion. 44 MAfee Applition Control 6.1.0 Evlution Guie