McAfee EPOLICY ORCHESTRATOR 4.5 Product Manual page 85

Distributing Agents to Manage Systems
Configuring Agent Policies
Priority event forwarding
During normal operation, the agent and security software on the managed system generate
software events regularly. These events can range from information about regular operation,
such as when the agent enforces policies locally, to critical events, such as when a virus is
detected and not cleaned. These events are uploaded to the server at each agent-server
communication and are stored in the database. A typical deployment of agents in a large network
can generate thousands of these events an hour.
You can configure the agent to forward events on a priority basis if they are equal to or greater
than a specified severity. Specific event severities are determined by the product generating
the events. If you plan to use Automatic Responses, McAfee recommends that you enable
priority uploading of higher severity events for those features to function as intended.
You can enable priority uploading of events on the Events tab of the McAfee Agent policy pages.
Selecting a repository
Use this task to set the policy for repository selection. The agent can update from any repository
in its repository list based on the policy setting. This repository management tool allows you to
specify the most efficient means for designating a source repository for updates.
Task
For option definitions, click ? in the interface.
1 Click Menu | Policy Catalog.
2 Select McAfee Agent from the Product drop-down menu and ensure that General is
selected in the Category drop-down menu.
3 Click Actions, then select New Policy to create a new policy or My Default policy to
edit your policy.
4 Type a name for the policy, then click OK.
5 On the Repositories tab, select whether to Use this repository list (the ePO-managed
repository list, SiteList.xml), or Use other repository list (a locally controlled repository
list that is not managed by ePolicy Orchestrator).
6 Choose a basis for selecting a repository:
Selection Method
Ping time
Subnet distance
Use order in repository list
NOTE: The agent selects a repository each time a change occurs in the repository list, IP
address, or policy option.
McAfee ePolicy Orchestrator 4.5 Product Guide
Definition
The shortest round-trip elapsed time between sending an echo request to
a remote ICMP-enabled system and receiving a response from that system.
Ping timeout can be used to control the maximum time taken. Minimum =
5 seconds; maximum = 60 seconds. The default is 30 seconds.
The fewest hops an ICMP packet makes while traversing the network from
a local system to a remote system. The maximum number of hops can be
used to control the packet traversal.
A user-defined list of repositories based on locally determined preferences.
You can sequence and enable or disable specific distributed repositories on
the Repositories tab of the McAfee Agent policy pages. Allowing agents to
update from any distributed repository ensures that they get the update
from some location.
85