McAfee TSA00M005PAA Processor Guide - Page 96

Viewing blocked communications

Page 96 highlights

Using Firewall Protection Managing detections Before you begin Users can approve applications only when spyware protection mode or firewall protection mode is configured as Prompt mode. Task For option definitions, click ? in the interface. 1 From the SecurityCenter, do any of the following: • C lick the Computers tab, then click a number in the User-Approved Applications column to view applications for the associated computer. • C lick the Computers tab, then click the name of a computer. In the Computer Details page, under Detections, click a number in the User-Approved Applications column to view applications. 2 To add the application to one or more policies, in the User-Approved Applications list, under Actions click Allow. 3 In the Add Approved Application page, select each policy where you want to add the application, then click Save. Viewing blocked communications Use this task to view a list of communications that firewall protection prevented from reaching client computers. For the purposes of this report, each attempt to communicate is called an event. Before you begin To view this report, the Report blocked events option must be enabled on the Firewall Protection policy tab. When this option is enabled, blocked events are logged for all computers using the policy. Task For option definitions, click ? in the interface. 1 Click the Reports tab, then click Inbound Events Blocked by Firewall. 2 In the report, view detailed information about detections and the computers where detections occurred by using one of these methods. When you want to... Do this... Display computers or detections Click the triangle icon next to a name. • Under a computer name, show which detections were found. • Under a detection name, show the computers where it was found. Click a group name to display computers in that group. View details about events Click a quantity under Events to display the Inbound Event List, which shows the name of the event, the number of occurrences, and the date on which it was detected. View details about a computer Click a computer name to display the Computer Details page, which displays information about the computer, its service components, and its detections. 96 McAfee Total Protection Service Product Guide

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134

96
McAfee Total Protection Service Product Guide
Before you begin
Users can approve applications only when spyware protection mode or firewall protection
mode is configured as Prompt mode.
Task
For option definitions, click
?
in the interface.
1
From the SecurityCenter, do any of the following:
Click the
Computers
tab, then click a number in the User-Approved Applications
column to view applications for the associated computer.
Click the
Computers
tab, then click the name of a computer. In the Computer Details
page, under Detections, click a number in the User-Approved Applications column to
view applications.
2
To add the application to one or more policies, in the User-Approved Applications list,
under Actions click
Allow
.
3
In the Add Approved Application page, select each policy where you want to add the
application, then click
Save
.
Viewing blocked communications
Use this task to view a list of communications that firewall protection prevented from reaching
client computers. For the purposes of this report, each attempt to communicate is called
an event.
Before you begin
To view this report, the
Report blocked events
option must be enabled on the Firewall
Protection policy tab. When this option is enabled, blocked events are logged for all computers
using the policy.
Task
For option definitions, click
?
in the interface.
1
Click the
Reports
tab, then click
Inbound Events Blocked by Firewall
.
2
In the report, view detailed information about detections and the computers where
detections occurred by using one of these methods.
Do this...
When you want to...
Click the triangle icon next to a name.
Display computers or detections
Under a computer name, show which detections were found.
Under a detection name, show the computers where it was found.
Click a group name to display computers in that group.
Click a quantity under
Events
to display the Inbound Event List, which shows
the name of the event, the number of occurrences, and the date on which
it was detected.
View details about events
Click a computer name to display the Computer Details page, which displays
information about the computer, its service components, and its detections.
View details about a computer
Using Firewall Protection
Managing detections