M01 PDF

Module 1:
Welcome
McAfee Network Security Platform 10.1

Administration
McAfee Confidential
© 2020 McAfee M01 - 1 McAfee Confidential

Welcome
Introduction
 Name
 Responsibility
 Product experience
 Expectations
McAfee Confidential Education Services 2
Welcome to the McAfee Network Security Platform 10.1 Administration course. The first module provides an overview of
course design, logistics, and helpful resources, as well as provides the opportunity for the instructor to learn about you and
your training expectations.

About the Course
Configure and use NSP to Protect your Network and Systems Against Unauthorized Access, Damage, and Disruption
Through lecture, hands-on labs, and class discussions, you will learn use case methodology and
create use cases to gain better visibility to your environment, protecting and limiting exposure to
threats and vulnerabilities.
 Prerequisites:
 Networking and system administration concepts.
 Basic understanding of computer security concepts.
 General understanding of viruses and antivirus technologies.
 Resources:
 Student and Lab Guide.
 Virtual lab environment.
 Course evaluation.
Duplication of course materials is strictly prohibited by copyright.
Who should take this course

This course is intended for system and network administrators, security personnel, auditors, and/or consultants concerned
with network and system security. A working knowledge of network, system, and security administration is recommended.
Prior experience with McAfee ePO is recommended.
Resources
The resources include a Student Guide, Lab Guide, virtual lab environment, and course evaluation. The Student Guide is
made up of all the information provided as part of the Instructor Led Training with additional expanded information in the
notes section of the pages. There are areas for you to take notes as well, which is always recommended. The Lab Guide is
designed to work in conjunction with the provided lab environment. Each lab is introduced with the scenario at the
beginning to identify the desired outcome for the lab, followed by the detailed steps for completing the lab. You should
complete all labs in a virtual environment, which is designed specifically for this course. Your instructor will provide a URL
at the end of the course for you to complete a course evaluation.
Alert: You are not permitted to audiotape or videotape the course presentation. Duplication of course materials or labs is
strictly prohibited by copyright.

Course Objectives
After completing this course, you should be able to:
 Describe solution purpose, key features, and benefits.

 Plan the deployment.
 Configure solution features and components.
 Create and modify user accounts and administrative
domains.
 Install and manage Sensors.
 Configure virtual interfaces and sub-interfaces.
 Identify, configure, customize, and tune policies.
 Navigate Threat Explorer and Attack Log.
 Describe purpose, features, and components of
Network Behavior Threat Administration solution.
The course modules include a combination of lectures and hands-on labs to support their learning objectives. The course
goals are described on this slide and the following slide.

Course Objectives (Continued)
After completing this course, you will be able to:
 Describe attack types and configuring protection

against attacks.
 Generate reports and activity logs.
 Describe best practices for database
maintenance.
 Integrate NSP with selected McAfee solutions
and explain how to operationalize the solutions
to deliver specific outcomes.
The course modules include a combination of lectures and hands-on labs to support their learning objectives. The course
goals are described on this slide.

Course Agenda: Day 1
Day 1 Approximate Duration (including labs)
Welcome 60 minutes
Introduction to NSP 60 minutes
Planning NSP Deployment 60 minutes
Getting Started 60 minutes
Configuration Manager 60 minutes
User Management 90 minutes
The slide provides an estimate of the course agenda. Module timing and pace is subject to change to meet needs of each
class.

Administrative Domains 90 minutes
Sensor Overview 90 minutes
Basic Sensor Management 60 minutes
Virtualization (Sub-interfaces) 90 minutes
Policy Configuration 60 minutes
Policy Customization 90 minutes
class.

Threat Explorer 60 minutes
Attack Log 90 minutes
Advanced Malware Detection 90 minutes
Advanced Callback Detection 90 minutes
DoS Attacks 90 minutes
Inspection Options Policies 180 minutes
class.

Web Server Protection 90 minutes
Firewall Policy Configuration 90 minutes
Policy Tuning 90 minutes
Report Generation 90 minutes
Operational Status 120 minutes
Database Maintenance 90 minutes
class.

About us
Education Services
McAfee is one of the world’s leading independent cybersecurity companies. We provide:
Security Products and Solutions Training: Learn the skills to successfully deploy
and manage your McAfee products and solutions.
Security Training: Gain skills to defend against hacker attacks and better respond
to incidents.
https://www.mcafee.com/us/services/education-services/index.aspx
The McAfee education services portfolio of product training and security training helps you stay ahead of
threats, save time, and maximize the value of your McAfee investment.
Education Services provides a wide range of training options, all taught by our expert training consultants who
have years of experience working as security experts, installers, and consultants on security solutions. For
more information, go to McAfee.com and then select the menu and Education Services under Services.
Product Training
Learn the skills to successfully deploy and manage your McAfee security solutions, including endpoint
protection, network security, security information and event management (SIEM), and data protection
products. Our range of courses, highlighted by interactive demonstrations and lab exercises, can help
maximize your security investment by providing valuable information on the installation, configuration, and
deployment of the full suite of McAfee security products. Courses are available in a classroom setting and
online.
Security Training
Our Security Training team offers a wide range of courses to help you build secure software and applications,
assess vulnerabilities to defend against hacker attacks, and gain critical computer forensics skills to better
respond to incidents. All courses are taught by McAfee security experts. The course provides you feature
interactive demonstrations and hands-on lab exercises.

McAfee ACTS
Advanced Cyber Threat Services
 Advisory and Strategic Consulting (Formerly Foundstone).
 Incident response (IR), threat hunting, assessments, penetration testing, Web application testing,
SOC program development, gap assessments, policy and governance, PCI-DSS, IR program or
plan development, and more.
 Training on malware analysis, incident response, penetration testing, memory forensics,

threat hunting, network forensics, and more.
 IR retainer options for emergency incident response globally.
McAfee ACTS was formerly known as Foundstone, founded in the late 1990s, and acquired by McAfee in 2004.
McAfee ACTS is a vendor-agnostic consultancy, offering a variety of advisory and strategic consulting options.
In addition, the team offers two or four day courses in a variety of advanced security topics, such as malware
analysis or incident response, taught by seasoned instructors with decades of experience in the field.
The McAfee ACTS team offers innovative programs, such as an IR retainer option with rapid response for
incidents.

McAfee Support YouTube Channel
Informational Videos and Webinar Series
 Subscribe to the McAfee YouTube channel.
https://www.youtube.com/user/mcafeesupport
Subscribe to the only official YouTube channel for McAfee technical support. Provides help to ensure your McAfee products
successfully protect your organization, and that your experience meets your expectations. This channel will contain
instructional video content for McAfee home users (consumer support) and McAfee business users (enterprise support).
For more information, visit the consumer portal here: https://service.mcafee.com/ or the enterprise support portal here:
https://support.mcafee.com/.

Key Terms and Concepts
 Admin: Administrator  NIPS: Network Intrusion Prevention System

 Admin domain: Administrative domain  NSP: McAfee Network Security Platform
 GTI: McAfee Global Threat Intelligence  NTBA: McAfee Network Threat Behavioral
Analysis
 HIPS: McAfee Host Intrusion Prevention
System  Policy: Settings and configurations are
applied to point-products on endpoint
 Manager, NSM: McAfee Network Security machines
Manager
 Sensor: McAfee Network Security Sensor
 MDR: Manager Disaster Recovery
The above and additional terms are discussed in more detail in subsequent modules.
For non-product specific terms such as protocols and standards, refer to the McAfee
Technical Glossary at https://kc.mcafee.com/corporate/index?page=glossary.
Some commonly-used terms for NSP are listed below. For more terms and acronyms, refer to the online glossary at
https://kc.mcafee.com/content/glossary/index.htm
 Admin: Administrator. When Network Security Manager (NSM) is initially deployed, there is a default
Administrator account that is used to log in to the Manager.
 Admin domain: Administrative domain. NSM optionally allows you organize your resources into logical
groupings known as admin domains. This allows you delegate management to other users. By default there is
one admin domain.
 GTI: McAfee® Global Threat Intelligence. McAfee GTI is a comprehensive, real-time, cloud-based file reputation
service that enables McAfee products to protect customers against both known and emerging malware-based
threats. It is included with NSM at no charge. However, it must be enabled.
 Host IPS: Host Intrusion Prevention System. A Host IPS protects an individual host, such as a desktop computer,
laptop, or server. It does not provide network-wide protection. An example of a Host IPS is McAfee® Host
Intrusion Protection.
 Manager, NSM: McAfee® Network Security Manager. The Manager or NSM is a web-based interface that is used
for configuration and ongoing management of the NSM environment.
 MDR: Manager Disaster Recovery. NSM optionally allows you deploy two Managers, one designated as Primary
and the other as Secondary. This helps ensure operation should one of the Managers fails or is unavailable.
Continued on the next page.

Hidden
Additional terms include:

 Network IPS: Network Intrusion Prevention System. IPS, such as McAfee® Network Security Sensors, provide
network-wide protection and block network attacks.
 NSP: McAfee® Network Security Platform. Within this course, the acronym NSP is used to refer to the Network
Security Platform solution.
 NTBA: McAfee® Network Threat Behavioral Analysis. NTBA collects and analyzes traffic from the entire network
and reports any unusual behavior to help you maintain a comprehensive and efficient network security
infrastructure. NSM optionally integrates with NTBA. However, NTBA is purchased and installed separately.
 Policy: A security policy is a set of rules that govern what traffic is permitted across the network and the
responses to misuse of the network. A policy basically identifies the malicious activity you want to detect and
how you want the Sensor to respond when this activity is detected.
 Sensor: McAfee® Network Security Sensor. Sensors provide real-time traffic monitoring to detect malicious
activity, and responds to the malicious activity, as configured by the administrator. They are installed in the
network at key points. Physical and virtual Sensors are supported.

Resources (Appendix A)
List of Content Found in Appendix A
 Acronyms and terms in this course

 Threat Center
 ServicePortal
 Product documentation and articles
 Expert Center
 Resources: Idea exchange on the community forums
 Support Notification Service (SNS)
 Content packs
 Security Content Release Notes

Getting Started
Virtual Machines Used in this Class
 Perform all labs using the virtual machines.

 Do not change any passwords.
 Refer to the Lab Guide for details.
PDC NSPMGR
10.10.10.200 10.10.10.207
User: McAfee\JSmith User: McAfee\JSmith
Host Password: mcafee123! Password: mcafee123!
Virtual Machines
This course uses a virtual environment technology to provide the required resources for your lab.
The table highlights IP addresses, users, and passwords for your virtual machines (VMs). You should
perform all labs on the virtual machines and not the physical host systems.
The user names and password for the classroom systems are listed below. Do not change the
passwords.
 PDC:
 User: McAfee\JSmith
 Password: mcafee123! (case-sensitive)
 NSPMGR:
 User: McAfee\JSmith
 Password: mcafee123! (case-sensitive)

Using the Lab Guide
Refer to the Lab Guide after completing a lesson

The Lab Guide provides:
 Classroom lab setup
 Lab exercises for each module
The lab exercises provide:
 Goals and duration
 Required systems and files
 Scenario at the beginning of each lab
 Contains the information needed to complete the lab
 Steps
 Provides detailed steps to complete the lab

Acronyms and Terms in This Course
Network Security Platform
 APAC: Asia and Pacific  LAN: Local Area Network

 CLI: Command Line Interface  LDAP: Lightweight Directory Access Protocol
 DaR: Data-at-Rest  MEG: McAfee® Email Gateway
 DHCP: Dynamic Host Configuration Protocol  MLOS: McAfee Linux Operating System
 DiM: Data-in-Motion  MTA: Mail Transfer Agent
 DiU: Data-in-Use  MTU: Maximum Transmission Unit
 DLPe: Data Loss Prevention Endpoint  MWG: McAfee® Web Gateway
 DNS: Domain Name Server  NTLM: New Technology LAN Manager
 EMEA: Europe, Middle East and Africa  NTP: Network Time Protocol
 McAfee ePO: McAfee ePolicy Orchestrator  Regex: Regular Expression
 FTP: File Transfer Protocol  SMTP: Simple Mail Transfer Protocol
 HA: High Availability  SNMP: Small Network Management Protocol
 HTML: Hypertext Markup Language  SSH: Secure Socket Shell
 HTTP: Hypertext Transfer Protocol  SSL: Secure Socket Layer
 HTTPS: Hypertext Transfer Protocol – Secure  TCP: Transmission Control Protocol
 ICAP: Internet Content Adaptation Protocol  URL: Uniform Resource Locator
 IP: Internet Protocol
The side shows some commonly used terms in this course.

Threat Center
Current and Emerging Threats
 Threat analysis and research  Security updates

 Threat predictions and trends  Feedback, threat detection resources, and
 Searchable threat library free tools
 Podcast offerings  Blogs, tips, and techniques
https://www.mcafee.com/us/threat-center.aspx
The Threat Center menu contains helpful information and resources about current and emerging threats. This includes
threat research and reports, a searchable threat library, feedback, notifications and tools, and McAfee Labs blog. For more
information, go to McAfee.com and then select For Enterprise, and Threat Center.

ServicePortal
Single Point of Access to Valuable Resources and Tools
 Knowledge Center: Search for  Support Tools: Run Virtual Technician or

documentation, technical articles, and other other diagnostic tools to help solve
resources for your products. problems.
 Patches and Download: Obtain patches,  Customer Community: Collaborate and
hotfixes, and product downloads as well as engage in ongoing conversations with other
manage product license. product users.
https://support.mcafee.com
The ServicePortal provides documentation, technical articles, tools, and other resources for all phases of your product use,
from planning and deployment through ongoing management and use. For more information, go to McAfee.com, select Support,
Product Support, and Technical Support. You can also go to https://support.mcafee.com.

Documentation and Articles
https://docs.mcafee.com
Product documentation
 Product Guide
 Release Notes
 Installation Guide
 Appliance Guides
 Online product help
 Best Practices
 CLI Guide
 API Reference
 Troubleshooting Guide
 Quick Tour
Knowledge Center articles

 Known Issues
McAfee provides products product documentation for all phases of the NSP deployment, from installation,
ongoing administration, and troubleshooting. You can find these at the McAfee support web site.
Helpful documentation titles are available online.
Readme file: Product information, system requirements, resolved issues, any known issues, and last-minute
additions or changes to the product or its documentation.
Release Notes: Information on the latest version of NSP.
Installation Guide: System requirements and detailed instructions for installing and running the software.
Product Guide: Product introduction and features, detailed instructions for configuring the software,
information on deployment, recurring tasks, and operating procedures.
Best Practices Guide: Some common best practices for installing and using the NSP Product.
Browse the Knowledge Center for Technical Articles (also known as Knowledge Base Articles) for the products
that you utilize and support.

Documentation and Articles
Knowledge Center Articles

 IP addresses are reversed for Bot/Malware attacks (KB85202)
 How to enable scanning for HTTP Response-based attacks (KB54134)
 No packetlog is available at this time (KB55367)
 NSP Attacks for which packet logs cannot be collected (KB56050)
 How to delete specific attacks from the NSP database (KB55205)
 Network Security Platform attacks for which packet logs cannot be collected (KB56050)
 Network Security Platform system fault messages (KB55037)
 Network Security Platform 10.1.x Known Issues (KB92105)
NOTES:
 Localized product documentation and help are available.
 Check the Knowledge Center regularly for the most current information.
For troubleshooting resources online, begin at the Knowledge Center, https://support.mcafee.com. In addition to product
documentation, valuable resources include Release Notes, Security Bulletins, and Technical Articles. Technical Articles are
organized by functional categories, such as frequently asked questions (FAQs), installation and upgrades, known issues,
and so on.
To access the KB article, follow the below steps:

1. Go to https://support.mcafee.com.
2. Enter the KB article number in the “Search the Business Support Knowledge Base” box and click Search.
3. The relevant KB article displays below.

Product Documentation and Articles (Continued)

 Network Security Platform attacks that require the HTTP Response option to be enabled
(KB50726)
 List of EMS events that result in traps being sent (KB54125)
 How to interpret the Alert Result Status display in the Network Security Platform Manager
( KB56436)
 Differences between the Watchdog and Layer 2 mode features on the Network Security
Sensor (KB65475)
 Criteria for UDS attack deletion after subsequent sigset release (KB87335)
 NSP correlated attacks (KB60305)
NOTES:
 Localized product documentation and help are available.
 Check the Knowledge Center regularly for the most current information.
and so on.


 Network Security Platform DoS profile – learning and detection modes (KB71628)
 Ports and traﬃc destinations used by Network Security Platform (KB59342)
 SENSOR: Re-assembly Buffer Memory Exhausted (alert in the Network Sensor Platform Alert
Viewer) (KB50406)
 Best practices when planning a Network Security Manager upgrade (KB76973)
 How to delete existing Signature Sets from the Network Security Manager (KB57814)
 Enhanced Memory Allocation Enhancements in Network Security Platform to handle
increasing Signature Set size (KB87554)
 How to back up and restore the configuration tables on the Network Security Manager
(KB68723)
 How to reset the Active Fail-Open (AFO) kit to factory default, and how to reset the password on
the AFO kit (KB87848)
and so on.


 McAfee NSP Recommended for Blocking (RFB) description and selection criteria (KB50760)
 How to interpret the Alert Results Status display in the NSP Manager (KB56436)
 McAfee Statement of Standards Compliance for the NSP (KB66693)
 SENSOR: Re-assembly Buﬀer Memory Exhausted (alert in the NSP Alert Viewer) (KB50406)
 How to use Network Security Platform to combat Advanced Evasion Techniques (KB87308)
 Why you should provide Full packet capture in PCAP format (KB77570)
 How to determine and interpret the rate of alerts received by a Network Security Manage
(KB76010)
and so on.

Expert Center
Videos, Resources, Links
 Getting started
 Product functionality
 Integrations
 Helpful links
https://community.mcafee.com/community/business/expertcenter
The Expert Center provides additional resources to help learn about your security products. These include:
 Videos and resource documents:
 Getting started
 Product functionality
 Integrations
 Links:
 Product page
 Data sheet
 Product manuals
 Sign up for training
 Community
Find answers and solutions across hundreds of support communities, hundreds of groups, from thousands of McAfee
customers and experts who have contributed thousands of resources. For more information, go to
https://community.mcafee.com/community/business/expertcenter.

Resources: Idea Exchange on the Community Forums
Submit your Request or Idea – Refer to the KB60021
If you require a change to the features or functions of McAfee products or have other suggestions that could make our
products better, McAfee encourages you to submit your request or idea to the new Ideas forum located at
https://community.mcafee.com/t5/Ideas/idb-p/business-ideas.
To participate and view the Ideas Community, you must register to the portal. It’s free to join. Create a username and
password, provide your email address, read and agree to the Terms of Service, provide your first and last name, and select
your time zone.
Once logged into the Ideas forum, you can submit suggestions to improve McAfee products, you can also browse, search,
and vote for ideas submitted by others.
For more information, refer to the Technical Article KB60021.
https://kc.mcafee.com/corporate/index?page=content&id=KB60021.

Support Notification Service (SNS)
Communicates Critical Information in a Timely Manner
https://sns.secure.mcafee.com/signup_login
The Support Notification Service (SNS) is a proactive notification service that allows McAfee to communicate critical
information in a timely manner. Subscribing to SNS ensures that you have the most up-to-date information on product
upgrades, releases, and End-of-Life notices. Additionally, SNS is a vital information link during critical incidents, providing
you with the updates you need to ensure that your systems and organization are protected.
The SNS Subscription Center provides SSL security for data input and transmission and secure access for returning
subscribers. Go to the Subscription Center to submit your personal preferences. To receive SNS, you must subscribe and
select your products from the SNS Subscription Center at https://sns.secure.mcafee.com/signup_login.

Security Content Release Notes
 Product Content Releases  .DAT files

 McAfee Database Activity Monitoring  Readme
 McAfee Exploit Prevention  Downloads
 McAfee Advanced Cyber Threat Services (ACTS)
 McAfee Policy Auditor
 McAfee Threat Intelligence Exchange
 McAfee Vulnerability Manager for Databases
https://www.mcafee.com/us/content-release-notes/index.aspx
The Security Content Release Notes page provides information about the security content of McAfee solutions. From this
page, you can also download relevant security content. To access this page, go to McAfee.com > For Business > Threat
Center. Scroll down to the bottom of the page to the Feedback, Notifications & Tools section and click Security Content
Release Notes. Click http://www.mcafee.com/us/content-release-notes/index.aspx.

Lab Exercises
Lab 1: Access Lab Systems
Goals:
 Log in to the online lab virtual machines.
Estimated Duration:
 15 minutes
Refer to the lab guide for the instructions.

M01 PDF

Uploaded by

Copyright:

Available Formats

You might also like

M01 PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

M01 PDF

Uploaded by

Copyright:

Available Formats

Module 1:

McAfee Network Security Platform 10.1

© 2020 McAfee M01 - 1 McAfee Confidential

McAfee Confidential Education Services 2

© 2020 McAfee M01 - 2 McAfee Confidential

Duplication of course materials is strictly prohibited by copyright.

McAfee Confidential Education Services 3

Who should take this course

© 2020 McAfee M01 - 3 McAfee Confidential

 Describe solution purpose, key features, and benefits.

McAfee Confidential Education Services 4

© 2020 McAfee M01 - 4 McAfee Confidential

After completing this course, you will be able to:

 Describe attack types and configuring protection

McAfee Confidential Education Services 5

© 2020 McAfee M01 - 5 McAfee Confidential

Day 1 Approximate Duration (including labs)

Introduction to NSP 60 minutes

Planning NSP Deployment 60 minutes

Getting Started 60 minutes

Configuration Manager 60 minutes

User Management 90 minutes

McAfee Confidential Education Services 6

© 2020 McAfee M01 - 6 McAfee Confidential

Day 2 Approximate Duration (including labs)

Administrative Domains 90 minutes

Sensor Overview 90 minutes

Basic Sensor Management 60 minutes

Virtualization (Sub-interfaces) 90 minutes

Policy Configuration 60 minutes

Policy Customization 90 minutes

McAfee Confidential Education Services 7

© 2020 McAfee M01 - 7 McAfee Confidential

Day 3 Approximate Duration (including labs)

Threat Explorer 60 minutes

Attack Log 90 minutes

Advanced Malware Detection 90 minutes

Advanced Callback Detection 90 minutes

DoS Attacks 90 minutes

Inspection Options Policies 180 minutes

McAfee Confidential Education Services 8

© 2020 McAfee M01 - 8 McAfee Confidential

Day 4 Approximate Duration (including labs)

Web Server Protection 90 minutes

Firewall Policy Configuration 90 minutes

Policy Tuning 90 minutes

Report Generation 90 minutes

Operational Status 120 minutes

Database Maintenance 90 minutes

McAfee Confidential Education Services 9

© 2020 McAfee M01 - 9 McAfee Confidential

McAfee is one of the world’s leading independent cybersecurity companies. We provide:

McAfee Confidential Education Services 10

© 2020 McAfee M01 - 10 McAfee Confidential

 Advisory and Strategic Consulting (Formerly Foundstone).

 Training on malware analysis, incident response, penetration testing, memory forensics,

 IR retainer options for emergency incident response globally.

McAfee Confidential Education Services 11