Determining When Events Are Forwarded - McAfee EPOLICY ORCHESTRATOR 3.6 - WALKTHROUGH GUIDE Manual

6
®
ePolicy Orchestrator 3.6 Walkthrough Guide ePolicy Orchestrator Notifications

Determining when events are forwarded

Scenario two
Group2C
For this scenario, 50 virus infections are detected in and 50 virus infections are
Group3B
detected in within 60 minutes in a single day.
VirusDetected_Directory
Conditions of the rule are met, sending notification messages (or
launching registered executables) per the rules' configurations. This the only rule that
can be applied to all 100 events.
Figure 6-2 Console tree
Determining when events are forwarded
The ePolicy Orchestrator server receives notifications from the Common Management
Agent ( ). You must configure its policy pages to forward events either immediately
CMA
to the ePolicy Orchestrator server or only at agent-to-server communication intervals.
If you choose to have events sent immediately (as set by default in ePolicy Orchestrator
Agent 3.5.0 McAfee Default policy), the agent forwards all events as soon as they are
received. If you want all events sent to the ePolicy Orchestrator server immediately so
that they can be processed by Notifications when the events occur, configure the agent
to send them immediately.
If you choose not to have events sent immediately, the agent only forwards events
immediately that are designated by the issuing product as high priority. Other events
are only sent at the agent-to-server communication intervals.
If the currently applied named policy is not set for immediate uploading of events,
ePO
either edit the currently applied named policy or create a new named policy for the
Agent 3.5.0 | Configuration Events
policy pages. This setting is configured on the tab of
these policy pages.
64