McAfee MOVE Multiplatform 3.6.1 OSS Hotfix 1162734 is now available. This release resolves an issue on the Offload Scan Server where the MOVE Offload Scan Server is reporting over capacity.

To download MOVE AV Multi-Platform 3.6.1 Offload Scan Server - Hotfix  1162734, go to the McAfee ServicePortal site using a valid grant number: https://support.mcafee.com/

Then search for "1162734" to download the hotfix.

For a full list of changes, see the Release Notes in PD26842: https://kc.mcafee.com/corporate/index?page=content&id=PD26842
​

A new Database Activity Monitoring vPatch update (82) had been released.

This update includes the following:

• New rule 7858 to monitor and protect MSSQL database.
• New rule 7860 to monitor and protect MSSQL database.
• New rule 7862 to monitor and protect MSSQL database against exploitation of CVE-2016-7253 vulnerability.
• New rule 7864 to monitor and protect MSSQL database.
• New rule 8083 to monitor and protect Sybase database against exploitation of CVE-2016-6196 vulnerability.
• Improved rule 8082 to monitor and protect Sybase database.

The content update is cumulative and available within the product, either via automatic updates, or by manual action.

The recording for the "Malware Session: Ransomware - Year End Review" and QA has been made available in the WW Support Webinar Central group in the Community. Agenda and links provided below.
Agenda:

• What is Ransomware?
• Family, Industry Sector and Regional Breakdown
• Characteristics and Symptoms
• Prevention & Recommendation
• Prevalent Ransomware Installers

QA Video Recording: https://community.mcafee.com/videos/2561
Q&A Document: https://community.mcafee.com/docs/DOC-9311

As previously announced, there are two modifications scheduled for V2 and V3 DATs:

The first change, updated digital certificates included in the DATs, has been in effect since November 8, 2016, and will be included in every subsequent DAT.

The second change (phase 2) will involve dual-signing of xdat.exe and v3_dat.exe files using two digital certificates:

• For the second change, we are providing an opt-in customer evaluation period via http://downloadcenter.mcafee.com/products/mcafee-avert/dats which has been extended until January 30, 2017.
• The planned go-live date for the second change is January, 31 2017.

Impact of these changes
These changes are not expected to impact customers or their installed products, but it is recommended that customers use the DAT Change 2 Evaluation period to test and evaluate this second DAT change before it is deployed to their live environment. This is especially true for customers that use third-party systems/services to download and/or deploy xdat.exe and v3_dat.exe files to their network/clients.

For customers who opt in to evaluate these changes, feedback can be provided to Intel Security via the DAT-Evaluation group in the McAfee Community forums: https://community.mcafee.com/groups/dat-evaluation

To learn more about these changes, why they may occur, and how you can prepare for them, please see KB87709: https://kc.mcafee.com/corporate/index?page=content&id=KB87709

McAfee Active Response (MAR) 2.0 is now available. This release includes new features, fixes, and enhancements including:

•    Behavioral Risk Monitoring
•    MAR workspace – ranked list of potential threats
•    MAR workspace – trace timeline
•    MAR workspace – remediation
•    Threat Intelligence Integration
•    Remediation Dashboard


You can download McAfee Active Response 2.0 using the ePO Software Manager, or from the Product Downloads site at: http://www.mcafee.com/us/downloads/downloads.aspx

For more information, see the Release Notes in PD26819:
https://kc.mcafee.com/corporate/index?page=content&id=PD26819

For the MAR 2.0 Product Guide, see PD26820:
https://kc.mcafee.com/corporate/index?page=content&id=PD26820
​

McAfee Endpoint Security Threat Intelligence 10.2.1 is now available. This patch includes the following new fixes for issues. For full details, see the Release Notes.

• The client now correctly stores reputation information in the local cache so it doesn’t have to perform a lookup multiple times.
• The client now records the following items in the Activity Log, instead of the Debug Log:
  • Local reputation
  • JTI content rule that was matched
  • Event type

• Reputation responses from Advanced Threat Defense now correctly report Allow or Would Block events when the client is set to Observe Mode.  
• Reputation responses from Advanced Threat Defense now correctly report Allow events when the client is set to Enforce Mode.
• The client no longer logs reputation lookup entries to the Activity Log, improving responsiveness to driver callbacks and overall application launch performance.
• The client now extends the timeout for the file system filter driver’s event before submitting a file to Advanced Threat Defense.

To download Endpoint Security Threat Intelligence 10.2.1 go to the Product Downloads site at: http://www.mcafee.com/us/downloads/downloads.aspx.   

For a full list of changes, see the Release Notes in PD26824:
https://kc.mcafee.com/corporate/index?page=content&id=PD26824
 
For a list of Known Issues, see KB82450:
https://kc.mcafee.com/corporate/index?page=content&id=KB82450

​McAfee Drive Encryption (MDE) 7.2.0 Repost is now available. This release includes new features, fixes, and enhancements including:

• All items in the original MDE 7.2.0 release
• Product Settings Policy no longer displays unreadable text under the Enable SSO section under the Logon tab (double-byte character languages affected). See KB88269:
  https://kc.mcafee.com/corporate/index?page=content&id=KB88269

To download McAfee Drive Encryption 7.2.0 Repost, go to the Product Downloads site at: http://www.mcafee.com/us/downloads/downloads.aspx.   

For detailed information on MDE 7.2.0 see the Release Notes in PD26652:
https://kc.mcafee.com/corporate/index?page=content&id=PD26652.

For a list of Known Issues, see KB84502:
https://kc.mcafee.com/corporate/index?page=content&id=KB84502.

NOTE: The build number for the EEAdmin Extension will be: 7.2.0.457 (all others remain unchanged).

Endpoint Security 10.5 is now available. This release includes new features, fixes, and enhancements including:

Adaptive Threat Protection enhancements:

• Threat Intelligence is now named Adaptive Threat Protection.
• Dynamic Application Containment — Adds the ability to contain a specific instance of an application.
• New McAfee-defined queries — Includes additional predefined queries for Real Protect.
• Real Protect scanner — Inspects suspicious files and activities on an endpoint to detect malicious
• patterns using machine-learning techniques. Using this information, the scanner can detect
• zero-day malware.

Adaptive Threat Protection is not supported on systems managed by McAfee ePO Cloud.

Threat Prevention enhancements:

• Ability to configure a Windows registry scan location for on-demand scans.
• Ability to create a custom Access Protection rule to protect Windows services.
• Management of Exploit Prevention signatures and Application Protection rules.
• Ability to display false-positive mitigation events using the Endpoint Security Threat Prevention:
• False Positive Mitigation Events query.

To download Endpoint Security 10.5, go to the Product Downloads site at: http://www.mcafee.com/us/downloads/downloads.aspx.   

For a full list of changes, see the Release Notes https://kc.mcafee.com/corporate/index?page=content&id=PD26802.

For a list of Known Issues, see https://kc.mcafee.com/corporate/index?page=content&id=KB82450.