Subnet Status - McAfee EPOLICY ORCHESTRATOR 3.6 - WALKTHROUGH GUIDE Manual

®
ePolicy Orchestrator 3.6 Walkthrough Guide

Subnet status

The following table lists and describes each rogue type and its description:
Table 5-2 Types of rogue systems
Rogue Type Description
No Agent
The detected system has no agent installed. This is the most
common rogue type.
Grace Period
The detected system has no agent installed, but was detected
within a user-configured time period, or grace period. This is useful
if you have many systems that join and leave the network. It is also
useful if you use login scripts to install the agent when new
systems log onto the network. Using the grace period allows you to
create a time buffer to avoid false positive rogue detections for
systems that are not really rogue systems.
The grace period is disabled by default, so all systems without
agents are classified as
enabling the grace period if you are configuring automatic
responses for the rogue detection event.
Inactive Agent
The detected system has an agent installed, but it has not called
into the server for some configurable period of days.
Alien Agent
The detected system has an agent installed, but the agent does not
report into your server. This can occur if your organization is large
and you use multiple ePolicy Orchestrator servers to manage
different parts of your network. Laptop users who may travel and
log onto your network could have an alien agent. This rogue type is
distinct as you probably would not want to take action on these
systems as they are already managed. But since they are not
managed by your server, you don't want them to be classified as
managed either.
To reduce false positive rogue detections, you can fine-tune
automated responses to avoid deploying agents or sending e-mail
alerts when alien agents are detected.
Managed
For systems with a status of
detected by a sensor within a configured length of time, but when
last detected it did have an agent.
Subnet List
Each subnet listed in the
if there is an active rogue system sensor is installed on a system in that subnet. A
Uncovered
subnet has an status if there are no sensors present. You can click each
subnet to view a list of all systems in the subnet that have an active agent installed.
Rogue (No Agent)
. You might consider
Inactive
only. The system has not been
Subnets
table on the tab receives a status of
56
5
Rogue System Detection
Covered