The Throttling settings must be enabled and configured to settings according to organizations requirements.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-213346	MCAC-TE-000121	SV-213346r506897_rule		Medium

Description
The throttling settings regulate the data flow between the clients and McAfee ePO. The value for each category defines the number of entries that will be sent to the McAfee ePO daily. Clients start caching for the defined category when the specified threshold value is reached. After the cache is full, new data for that category is dropped and not sent to the McAfee ePO. As such, settings must be high enough to allow for all data to reach the McAfee ePO.

Description

The throttling settings regulate the data flow between the clients and McAfee ePO. The value for each category defines the number of entries that will be sent to the McAfee ePO daily. Clients start caching for the defined category when the specified threshold value is reached. After the cache is full, new data for that category is dropped and not sent to the McAfee ePO. As such, settings must be high enough to allow for all data to reach the McAfee ePO.

STIG	Date
McAfee Application Control 8.x Security Technical Implementation Guide	2020-10-02

Details

Check Text ( C-14574r505073_chk )
From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset to be validated. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: General. From the "Policy" column, select the policy associated with the Category "Configuration (Client)" that is specific to the organization and select the "Throttling" tab. Verify the "Enable Throttling" check box is selected. Verify the throttling settings are configured according to organization's written policy. If the "Enable Throttling" check box is not selected, this is a finding. If the throttling settings do not match the organization's written policy or the settings are not documented in the written policy, this is a finding.

Check Text ( C-14574r505073_chk )

From the ePO server console System Tree, select the "Systems" tab.

Select "This Group and All Subgroups".

Select the asset to be validated.

Select "Actions".

Select "Agent".

Select "Modify Policies on a Single System".

From the product pull-down list, select Solidcore 8.x: General.

From the "Policy" column, select the policy associated with the Category "Configuration (Client)" that is specific to the organization and select the "Throttling" tab.

Verify the "Enable Throttling" check box is selected.

Verify the throttling settings are configured according to organization's written policy.

If the "Enable Throttling" check box is not selected, this is a finding.

If the throttling settings do not match the organization's written policy or the settings are not documented in the written policy, this is a finding.

Fix Text (F-14572r505074_fix)
From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: General. From the "Policy" column, select the policy associated with the Category "Configuration (Client)" that is specific to the organization and select the "Throttling" tab. Place a check in the "Enable Throttling" check box. Configure the throttling settings based upon organization's written policy. Click "Save".

Fix Text (F-14572r505074_fix)

From the ePO server console System Tree, select the "Systems" tab.

Select "This Group and All Subgroups".
Select the asset.
Select "Actions".
Select "Agent".
Select "Modify Policies on a Single System".

From the product pull-down list, select Solidcore 8.x: General.

From the "Policy" column, select the policy associated with the Category "Configuration (Client)" that is specific to the organization and select the "Throttling" tab.

Place a check in the "Enable Throttling" check box.

Configure the throttling settings based upon organization's written policy.

Click "Save".