The McAfee MOVE AV Common Options policy must be configured to send all events to the HBSS ePO server.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-78511	MV45-COP-000002	SV-93217r1_rule		Medium

Description
Forensic identification is the practice of identifying infected hosts by looking for evidence of recent infections. The evidence may be very recent (only a few minutes old) or not so recent (hours or days old); the older the information is, the less accurate it is likely to be. The most obvious sources of evidence are those that are designed to identify malware activity, such as anti-virus software, content filtering (e.g., anti-spam measures), IPS, and SIEM technologies. The logs of security applications might contain detailed records of suspicious activity and might also indicate whether a security compromise occurred or was prevented.

Description

Forensic identification is the practice of identifying infected hosts by looking for evidence of recent infections. The evidence may be very recent (only a few minutes old) or not so recent (hours or days old); the older the information is, the less accurate it is likely to be. The most obvious sources of evidence are those that are designed to identify malware activity, such as anti-virus software, content filtering (e.g., anti-spam measures), IPS, and SIEM technologies. The logs of security applications might contain detailed records of suspicious activity and might also indicate whether a security compromise occurred or was prevented.

STIG	Date
McAfee MOVE AV Multi-Platform 4.5 Security Technical Implementation Guide	2018-07-09

Details

Check Text ( C-78073r1_chk )
Access the McAfee ePO console. Select Menu >> Policy >> Policy Catalog and then select "MOVE AntiVirus Common 4.5.0" from the Product list. From the Category list, select "Options". Select each configured Options policy. Click "Show Advanced". Under "Events", verify the "Send events to McAfee ePO" check box is selected. If the "Send events to McAfee ePO" check box is not selected, this is a finding.

Check Text ( C-78073r1_chk )

Access the McAfee ePO console.

Select Menu >> Policy >> Policy Catalog and then select "MOVE AntiVirus Common 4.5.0" from the Product list.

From the Category list, select "Options".

Select each configured Options policy.

Click "Show Advanced".

Under "Events", verify the "Send events to McAfee ePO" check box is selected.

If the "Send events to McAfee ePO" check box is not selected, this is a finding.

Fix Text (F-85245r1_fix)
Access the McAfee ePO console. Select Menu >> Policy >> Policy Catalog and then select "MOVE AntiVirus Common 4.5.0" from the Product list. From the Category list, select "Options". Select each configured Options policy. Click "Show Advanced". Under "Events", select the "Send events to McAfee ePO" check box. Click "Save".