31/03/2017关于ENS更新5900engine的消息

iTomatos

Knowledge CenterPrint
Important information about the 5900 Anti-Malware Scan Engine update for Endpoint Security
Technical Articles ID:   KB88809
Last Modified:  3/31/2017
Rated:


Environment
McAfee Endpoint Security (ENS) Threat Prevention 10.x
McAfee Anti-Malware Scan Engine 5900 update for ENS 10.x
Summary
This article contains information about the 5900 Anti-Malware Scan Engine release schedule for ENS 10.x endpoints. Use the instructions provided in this article to evaluate the engine for ePolicy Orchestrator (ePO) managed and standalone ENS endpoints.

5900 Anti-Malware Scan Engine Improvements
The 5900 Anti-Malware Scan Engine includes the following improvements:
Enhanced support of JavaScript to detect more threats
Improved support for the Microsoft Office (OLE) file format
Improved unpacking of Dotfuscator and MPRESS packed files
Enhancements to DAT content to improve predictability of content processing
New supported platforms: Windows 10 Anniversary Update and Windows Server 2016
Release Schedule
The 5900 Engine will be deployed worldwide to ENS endpoints from May 4 – May 24, 2017, in a staggered rollout. This engine update is mandatory. ENS endpoints that are currently running the 5800 Engine will be updated to the 5900 Engine starting May 4, 2017. Customers who are interested in evaluating the new engine are asked to start the evaluation process beginning the first week in March.

How to Evaluate the 5900 Engine
Follow the applicable instructions below:
ePO managed ENS endpoints:
It is recommended to use a test ePO server that does not manage production nodes.
Log on to the ePO console.
Click Menu, Server Settings.
Click Source Sites in the left pane, and click Edit.
Add a new Source Site, choosing the method of transfer as indicated below:
FTP: ftp://ftp.nai.com/commonupdater3/
HTTP: http://update.nai.com/products/commonupdater3
After saving the new Source Site, navigate to the Master Repository.
From the Master Repository, either Pull Now or Schedule Pull from the new Source Site. It is recommended that you pull to the Evaluation branch.
Create a McAfee Agent General Policy that uses the Evaluation branch for the AMCore Content Package.
Apply the new policy to systems that will be evaluating the new engine and create a McAfee Agent task to update the engine on those endpoints.

NOTE: Any subsequent changes to the repository between March and May will result in a downgrade of the engine to 5800.

Standalone (unmanaged) ENS endpoints:
Launch the Endpoint Security interface.
Open Threat Prevention and go to Common Settings.
Select Advanced, and then locate Source Sites for Updates.
Click Add and then enter the URL path http://update.nai.com/products/commonupdater3.
Click OK. ENS is now configured to update to the 5900 Engine from the evaluation location.

Standalone engine executable updater:
Customers interested in a standalone executable that includes the 5900 Engine may download the executable from: http://downloadcenter.mcafee.com/products/mcafee-avert/dats.

You are still required to update the Source Site to CommonUpdater3 to receive daily content updates for 5900 Engine validation.

You may also download the daily DAT executable from the above referenced location. Any subsequent changes to the CommonUpdater3 location between March and May will result in a downgrade of the engine to 5800.

Impact of these Changes
The engine update to 5900 is mandatory and is an automatic update for ENS 10.x. Intel Security is providing an opportunity for customers to evaluate and test the new engine before it is deployed to a production environment.

欧阳宣

然而现在mes默认在w10里是装不上的……不知道为什么

iTomatos

欧阳宣 发表于 2017-4-3 15:13
然而现在mes默认在w10里是装不上的……不知道为什么

10.5.1也装不上咩？

gzmaybe

VSE的5900引擎什么时候能上？Mcafee说这个月就能上了

•        5900 Engine AutoUpdate for corporate products (except Endpoint Security) - Late April 2017 (Exact dates will be provided in a later announcement).

iTomatos

gzmaybe 发表于 2017-4-6 14:14
VSE的5900引擎什么时候能上？Mcafee说这个月就能上了

•        5900 Engine AutoUpdate for corporate pr ...

下载下来自己替换文件就行了哦，不过还是ENS超级方便，加条地址就好了

gzmaybe

iTomatos 发表于 2017-4-6 14:21
下载下来自己替换文件就行了哦，不过还是ENS超级方便，加条地址就好了

因为现在是用epo管理的，所以只能等Mcafee推送了