McAfee DAT Reputation Implementation Guide. Version 1.0 for Enterprise

Transcription

1 McAfee DAT Reputation Implementation Guide Version 1.0 for Enterprise

2 McAfee DAT Reputation... 2 What is McAfee DAT Reputation?... 2 Rollout phases: Elective Download, AutoUpdate & AutoEnable... 3 DAT Reputation Installation Files... 4 Configuration before AutoUpdate/AutoEnable... 5 epo Configuration... 5 Installing the McAfee epo Management Extension... 5 Managing McAfee DAT Reputation policies on multiple client systems... 5 Modifying McAfee DAT Reputation policies... 6 Run DAT Reputation Reports in epo... 6 Standalone Configuration Files... 7 Manually verifying DAT Reputation policies... 7 Testing DAT Reputation... 8 Issues or Questions

3 McAfee DAT Reputation What is McAfee DAT Reputation? McAfee DAT Reputation technology can prevent endpoints from updating to a DAT that has been seen to cause unpredicted results in the field. While these types of events are very rare, they can occasionally cause significant impact to our customers. McAfee takes content quality and safety very seriously, and performs stringent quality assurance tests before every content release. This technology is an extra safety mechanism that identifies and contains an issue if one occurs after the content has been released. McAfee DAT Reputation includes two components: DAT Reputation Before updating, DAT Reputation performs a McAfee Global Threat Intelligence (McAfee GTI) lookup to request the reputation of the DAT file. If the DAT is classified as block, the endpoint does not complete the update. The data transferred during the DAT Reputation check is minimal the DAT version number and the type of DAT (V2/V3) are securely hashed and sent via SSL as the outbound request. The returned response will with be a hashed value which will be interpreted by DAT Reputation as good, unknown or block. Endpoint Safety Pulse Endpoint Safety Pulse runs a series of health checks to alert McAfee to potentially significant field issues caused by a content update. Prompt identification of such issues is critical to providing timely containment and remediation. Endpoint Safety Pulse collects the following types of data: operating system version and locale; McAfee product version; DAT and engine version; and McAfee and Microsoft running process information. McAfee uses this data to look for potential content-related issues after DATs have been released. The health check results are encrypted and sent to McAfee using SSL. The data is then aggregated and analyzed by McAfee to check for anomalies. McAfee incident response processes are invoked if a significant issue is discovered. Customers with endpoints that do not have Internet access can disable McAfee DAT Reputation using McAfee epolicy Orchestrator (McAfee epo). They can also download the standalone configuration file for use on unmanaged systems. Privacy Protection: The data collected by McAfee DAT Reputation is used only to look for content-related issues across our entire global customer base. No personally identifiable information is collected or transmitted. For more information about McAfee DAT Reputation, please review our frequently asked questions. 2

4 Rollout phases: Elective Download, AutoUpdate & AutoEnable Elective Download McAfee Customers who wish to enable DAT Reputation across their environment can use CommonUpdater3 from Tuesday November 18th 2014, when posting will occur seven days per week. Previous to this date, DATs and DAT reputation binaries were posted to this site Monday Friday only. The URLs for CommonUpdater3 are: ftp://ftp.mcafee.com/commonupdater3 The default configuration for CommonUpdater3 is: DAT Reputation On, Endpoint safety pulse Off. AutoUpdate DAT Reputation AutoUpdate is scheduled for the mid-q On this day all endpoints updating from CommonUpdater will have DAT Reputation binaries downloaded and installed on supported Operating System / Point Product combinations. This also includes endpoints belonging to customers who pull or mirror from these download sites. DAT Reputation and endpoint safety pulse will both be disabled by default at this time. This is to allow epo managed machines time to collect any pre-configured policies during the two week period before AutoEnable. AutoUpdate for CommonUpdater2 is scheduled for the end of Q Customers using CommonUpdater who are unable to complete change control processes by mid-q need to reconfigure their pull tasks and fallback repositories to CommonUpdater2. AutoEnable AutoEnable for DAT Reputation only (not endpoint safety pulse) will occur two weeks after each AutoUpdate milestone. On this day, customers who have not preconfigured a policy will have DAT Reputation enabled automatically. Customers will not be automatically enabled via an update task into using Endpoint safety pulse on existing McAfee product versions currently in the field. McAfee recommend that customers please enable this function, where possible, on their endpoints. McAfee may release a product patch to enable safety pulse at a later date, which will be communicated accordingly. Customers who have pre-configured policies via epo or the standalone configuration files will not have their policies changed by McAfee. All dates are subject to change. 3

5 DAT Reputation Installation Files McAfee DAT Reputation installs to %programfiles(x86)%\ Common Files\McAfee\DATReputation The following files are installed: File name mcdatrep.exe datrepmp.dll extradrep.rul mcnrdhck.lua mcnrdutl.lua ts.dll DATRep Client Legal.rtf Description McAfee DAT Reputation executable DLL responsible for reporting the DAT Reputation policies as well as enforcing the epo policies in the clients (epo plugin) Rul File for access protecting the DATReputation binaries Lua files defining the endpoint safety pulse healthchecks to be run Utility lua file for communicating the rules to mcdatrep.exe DLL responsible for performing the DAT Reputation lookup Legal Approval document for use of Third Party libraries in use 4

6 Configuration before AutoUpdate/AutoEnable epo Configuration Customers can use epo to preconfigure policies. These policies will be enforced by the agent only once DAT Reputation is installed (which will happen as part of AutoUpdate). This is because the epo plugin for DAT Reputation will be installed as part of the DAT Reputation installation. Attempts to enforce policies without the plugin present on the endpoint will fail. Reports can be generated in epo to view the policy settings once the plugin has been installed and the first ASCI has completed. Policy enforcement can be triggered by sending an agent wake up call to the endpoints. There are two epo extensions available. One supports epo and above. This extension can be downloaded from Software Download Manager (SDM) or from a direct download here: McAfee have also provided an extension for older epo versions ( ) which is available here: Policy options are: 1. DAT Reputation enabled, endpoint safety pulse enabled 2. DAT Reputation enabled, endpoint safety pulse disabled 3. DAT Reputation disabled, endpoint safety pulse disabled (greyed out) Installing the McAfee epo Management Extension Before you begin, you must have administrator rights to install McAfee DAT Reputation Extension. 1. Log on to the McAfee epo server as an administrator. 2. Click Menu Software Extensions, click Install Extension. 3. On Install Extension dialog, click Choose File, browse for the path where McAfee DAT Reputation extension is downloaded from Software Manager, click Open. 4. Click OK in the Install Extension dialog. 5. Extensions page displays the McAfee DAT Reputation extension details. Click OK. 6. Extension gets installed and McAfee DAT Reputation is listed in the installed extensions list. 7. Enforce policies on client systems Managing McAfee DAT Reputation policies on multiple client systems 1. Click Menu Systems System Tree, then select a group in the System Tree. All systems within this group (but not its subgroups) appear in the details pane. 2. Select the required systems, then click Actions Agent Set Policy & Inheritance. 5

7 3. Select McAfee DAT Reputation as the Product, General as the Category, then select the required policy. See the epolicy Orchestrator product documentation for more information about creating and editing policies. 4. Select Reset inheritance or Break inheritance, then click Save. Modifying McAfee DAT Reputation policies 1. Click Menu Policy Policy Catalog. 2. Select McAfee DAT Reputation as the Product, General as the Category, then click the required policy. 3. Select/de-select the policy options as required and click Save. Run DAT Reputation Reports in epo Once DAT Reputation is installed, you can run reports in epo. 1. Click Menu Reporting Queries & Reports. 2. Click New. 3. Select Managed Systems and click Next. 4. Select the required chart type from Display Result As list on left side. 5. From Labels dropdown, select required option under McAfee DAT Reputation Service. 6. Click Next. 7. Select required columns and click Next. 8. Select required criteria and click Save. 9. Give an appropriate query name, description, and query group and click Save. 10. Click the group created on the Queries and reports page and select Run on the created query to display the result of the query. From now on, the same query can be run to view the data. 6

8 Standalone Configuration Files Customers with unmanaged endpoints can use standalone configuration files to pre-set policies. These configuration files write registry keys and values which determine the policy for DAT Reputation and endpoint safety pulse. Policy options are: 1. DAT Reputation enabled, endpoint safety pulse enabled 2. DAT Reputation enabled, endpoint safety pulse disabled 3. DAT Reputation disabled, endpoint safety pulse disabled Customers with epo can also use these configuration files if they want to ensure the endpoints have received the policy locally in advance of AutoUpdate. Customers will not be able to report via epo on the policies set using these files via until the plugin has been installed. The standalone configuration files can be downloaded from KB82935 (SupportPortal login required) Manually verifying DAT Reputation policies To verify that DAT reputation policies have been applied you can check the registry on the endpoint. Go to the following registry hive: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\McAfee\DATReputation in case of a 64 bit system HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\DATReputation on a 32 bit system Check the following values: dword Feature Enabled Feature Disabled dwdisabledatreputation 0 1 dwdisableendpointsafetypulse 0 1 Platinum customers can also use System Information Reporter to check registry value settings 7

9 Testing DAT Reputation McAfee have created some test DAT packages which can be used to check that endpoints are able to successfully receive the reputation of a DAT file. epo is required to be able to test this functionality. McAfee do not recommend distributing the DATs across all of your endpoints, they are to be used in a test environment that is representative of your network. The zip containing the packages is available here These test DATs were created on September 12 th 14th 2014 (inclusive) and contain all drivers contained in the V2 DATs which were posted on these dates. McAfee do not recommend distributing these DATs across all of your endpoints, they are to be used in a test environment that is representative of your network. Within the zip file there are three files which have different reputations in the McAfee cloud: 1. avvepo2000dat.zip - this test DAT file has no reputation 2. avvepo2001dat.zip this test DAT file has a reputation of block 3. avvepo2002dat.zip this test DAT file have a reputation of good Minimum testing requirements: epo server (4.5 or above) A Windows endpoint (Microsoft Vista or above) running: VirusScan Enterprise (8.7i p4 or above), and MA (4.6 or above). The endpoint needs an internet connection, with SSL access over port 443. Steps to test that the endpoint can receive DAT Reputations. 1. Check AVVDAT2000ePO.zip into your test epo repository. 2. Configure and schedule an update task for the test endpoint to update from your test epo server. Select Enable DAT file downgrade when the version in the repository is older than the local version. Send an agent wake up call. 3. Confirm that the endpoint has updated to DAT 2000 successfully 4. Check AVVDAT2001ePO.zip into your test epo repository. 5. Reschedule the client update task and wake up the agent on the test endpoint. 8

10 6. The endpoint should not update to the 2001 DAT. The agent monitor should show product running latest DATs, which will also be visible in the agent_machinename.log 7. Check AVVDAT2002ePO.zip into your test epo repository 8. Reschedule the client update task and wake up the agent on the test endpoint. 9. Confirm that the endpoint has updated to DAT 2002 successfully 10. In the DATreputation.txt log file you should see two entries: Successfully received DAT Reputation of 1 for DAT number: Successfully received DAT Reputation of 0 for DAT number: Issues or Questions If you have any problems or questions during the set-up, installation, configuration or usage of McAfee DAT Reputation, please contact your local McAfee Support Representative. 9