McAfee MAP-3300-SWG - Web Security Appliance 3300, Product Manual

Page: 109 / 336

McAfee Global Threat Intelligence
This technique reduces the delay between McAfee's detection of a new malware threat and when a
customer receives and installs a detection definitions (DAT) file. The delay can be 24 - 72 hours.
1 The appliance scans each file, comparing its code against the information (or signatures) in the
current detection definitions (DAT) file.
2 If the code is not recognized and is suspicious, for example, the file is packed or encrypted, the
appliance sends a small definition (or fingerprint) of that code to McAfee Global Threat Intelligence
— an automated analysis system at McAfee. Millions of other computers with McAfee software also
contribute fingerprints.
3 McAfee compares the fingerprint against a database of fingerprints collected worldwide, and
informs the appliance of the likely risk — within seconds. Based on settings in the scanning
policies, the appliance can then block, quarantine, or try to clean the threat.
If McAfee later determines that the code is malicious, a DAT file is published as usual.
About Protocol Presets
Protocol presets enable you to configure your appliance to cater for differences in parts of your
network, or for specific devices on your network.
Normally you design your connection settings to apply to all devices. However some parts of your
network might need some differences because some devices operate differently.
For example:
• Part of the network can handle larger or smaller files than normal.
• A slow connection requires a different time-out value.
• Part of the network must use an alternative authentication service.
By creating a protocol preset, you can cater for this exception to the connection settings.
Where this feature is available, you can click this icon: .
Email Scanning Policies
Use this page as a single point where you can access the pages and dialog boxes you need to set up
and configure your policies.
Email
|
Email Policies
|
Scanning Policies
Policy settings specify how the appliance handles threats to groups of users or devices. For example, a
policy can apply to all computers on the same subnet, or all users in a department.
Benefits of using the Scanning Policies page
The
Scanning Policies
page enables you to access all the forms you need to configure and manage your
policies for the SMTP and POP3 protocols.
The user interface provides an overview of your policy settings, giving you information about each
policy such as the action taken when a virus is detected. The page to configure these settings is
displayed when you click the relevant information.
Overview of Email features
Email Policies
McAfee Email and Web Security Appliances 5.6.0 Product Guide 109