The McAfee MOVE AV Options policy must specify the location of the quarantine network share.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-78491	MV45-OPT-200001	SV-93197r1_rule		Medium

Description
The quarantine on each system represents a potential danger should the files contained within the quarantine be executed inadvertently. To centrally manage the quarantine on all systems, the quarantine should always be configured the same across all systems, which will allow management to better control access to those locations.

STIG	Date
McAfee MOVE AV Agentless 4.5 Security Technical Implementation Guide	2017-12-01

Details

Check Text ( C-78053r1_chk )
Access the McAfee ePO console. Select Menu >> Policy >> Policy Catalog and then select "MOVE AntiVirus 4.5.0" from the Product list. From the Category list, select "Options". Select each configured Options policy. Under "Quarantine Manager" (Agentless only), verify the "Quarantine network share" is populated. If the "Quarantine network share" is not populated, this is a finding.

Fix Text (F-85225r1_fix)
Access the McAfee ePO console. Select Menu >> Policy >> Policy Catalog and then select "MOVE AntiVirus 4.5.0" from the Product list. From the Category list, select "Options". Select each configured Options policy. Under "Quarantine Manager" (Agentless only), populate the "Quarantine network share" field with a valid location for storing the quarantine. Click "Save".