Excluding folders with McAfee Security for Mac with regular expressions

[Cem]

I have found it very useful... so I've thought I post it here.

https://kc.mcafee.com/corporate/index?page=content&id=KB68562&cat=CORP_SECURITY_FOR_MAC&actp=LIST

Corporate KnowledgeBase
Excluding folders with VirusScan for Mac with regular expressions

Corporate KnowledgeBase ID: KB68562
Version: 1.0
Status: Published
Created: March 19, 2010
Last Modified: April 28, 2010

Environment
Mac OS 10.6 (Snow Leopard) Mac OS 10.5 (Leopard) Mac OS 10.4.6 (Tiger)
Summary
This article describes how regular expressions (regex) can be utilized in order exclude folders from being scanned with VirusScan for Mac 9.x.

Solution
To exclude specific folders under the Users profile using regular expressions in McAfee VirusScan 9.x (also known as McAfee Security for Mac 1.0) from ePO (ePolicy Orchestrator):

/Users/.*/<your folder path>/.*

To exclude VMDK (Virtual Machine Disk) files residing anywhere on the Mac:

..vmdk - locally
/..vmdk - from ePO

To exclude any file based on extension:

..ext - locally
/..ext - from ePO

To exclude .log files from scanning:

..log - locally
/..log - from ePO

To excluding multiple files based on extensions

..(EXT)(EXT) - Locally
/..(EXT)(EXT) - From ePO

NOTE: the forward slash character (/) preceding the ePO commands is required when these policies are pushed from ePO due to a sanity check carried out by ePO.

[nkalister]

How are the local commands passed to Mcafee on the client?

[Cem]

If you have a path on the local boot drive:
/Users/.*/<your folder path>/.*

if you have fibre raid attached then it goes as:
/Volumes/Raid HD/.*

Is that what are you asking?

[nkalister]

no, i'm asking how to pass configuration changes like these to mcafee clients from a script. I just recently got my grant number, so I may just not have found the right docs in their KB, but I'm not seeing anything from McAfee about how to interact with the client from the commandline.

[Cem · Accepted solution]

@ nkalister: Sorry for the late response... no alert!

We are using ePO Server. This lets us manage the clients from the console.
http://www.mcafee.com/uk/products/epolicy-orchestrator.aspx

I think there are some command lines to do certain things. But I didn't need to use it for managing ePO Clients.