Setting Filters For The Rule; Setting Thresholds Of The Rule - McAfee EPOLICY ORCHESTRATOR 4.5 Product Manual

Setting Up Automatic Responses
Creating and editing Automatic Response rules
1 Click Menu | Automation | Automatic Responses, then click Actions | New
Response, or Edit next to an existing rule. The Response Builder wizard opens.
Figure 14: Notifications Rules page
2 On the Description page, type a unique name and any notes for the rule.
NOTE: Rule names on each server must be unique. For example, if one user creates a rule
named Emergency Alert, no other user (including global administrators) can create a rule
with that name.
3 From the Language menu, select the language the rule uses.
4 Select the Event group and Event type that trigger this response.
5 Select whether the rule is Enabled or Disabled next to Status.
6 Click Next.

Setting filters for the rule

Use this task to set the filters for the response rule on the Filters page of the Response Builder
wizard.
Task
For option definitions click ? in the interface.
1 From the Available Properties list, select the desired property and specify the value to filter
the response result.
NOTE: Available Properties depend on the event type and event group selected on the
Description page of the wizard.
2 Click Next.

Setting thresholds of the rule

Use this task to define when the event triggers the rule on the Aggregation page of the Response
Builder wizard.
A rule's thresholds are a combination of aggregation, throttling, and grouping.
McAfee ePolicy Orchestrator 4.5 Product Guide 259