F-SECURE ANTI-VIRUS FOR MICROSOFT EXCHANGE 9.00, Administrator'S Manual

Page: 94 / 174

Configuring rule alerts
Internet Shield rule alerts can be used to get notifications if certain types of malware try to access the
computers.
It is possible to issue an alert every time a rule is hit or when illegal datagrams are received, which makes it
easy to see what kind of traffic is going on in your system.
Proper alerting can only be done by having proper granularity in the security level: have one rule for each
type of alert you want. Designing alerting based on broad rules will generate a lot of alerts, and any important
information might be lost in large volumes of useless noise.
Adding a new rule with alerting
In this example, a Deny rule with alerting is created for inbound ICMP traffic for a certain subdomain, so that
an alert is issued when somebody tries to ping the computer.
At the end of this example the rule is tested by pinging one of the computers in the subdomain. This example
also describes the different selections you can make when creating new rules with the
Firewall rules wizard.
Select the rule type and denied service
The first step is to select the rule type and define the denied service.
To do this:
1. Select the subdomain for which you want to create the rule on the Policy domains tab.
2. Go to the Settings tab and select the Firewall rules page.
3. Select the Internet Shield security level for which you want to add the new rule from the Internet Shield
security level being edited drop-down menu.
Now all the rules that have been defined for this Internet Shield security level are displayed on the table.
4. Click Add before to add the new rule as the first one on the list.
This opens the Firewall rule wizard.
5. Select Deny to deny the inbound ICMP connections.
6. Specify affected hosts.
Choose whether to apply this rule to all connections or to selected connections only. You can either:
• Check the Any remote host option to apply the rule to all Internet connections,
• Check the All hosts on locally connected networks option to apply the rule to all connections form
the local network,
• Check the Specified remote hosts option to apply the rule to an IP address, a range of IP addresses
or DNS addresses. When this option is selected, you can specify the addresses in the text field below.
If you want to enter several addresses or address ranges in the field, separate them by spaces.
For this rule, select Any remote host .
7. Choose the denied service and direction for the rule.
Select the service for which this rule will apply, from the list of available services. If you want the rule to
apply to all services, select
All from the top of the list. You can select as many individual services as you
want in this window.
For the chosen services, select the direction in which the rule will apply by clicking on the arrow in the
Direction column. Repeated clicks cycle between the available choices. See the table below for examples.
Explanation Direction
The service will be allowed/denied to/from your
computer in both directions. <=>
94 | F-Secure Client Security | Configuring Internet Shield