Planning; Determining How Events Are Forwarded - McAfee EPOCDE-AA-BA - ePolicy Orchestrator - PC Product Manual

18 Responding to events in your network

Planning

Default notification rules
Rule Name
Distributed repository
update or replication
failed
Malware detected
Master repository
update or replication
failed
Non-compliant
computer detected
RSD: Query New
Rogue Detection
Planning
Before creating rules that send notifications, save time by planning:
• The event type and group (product and server) that trigger notification messages in your
environment.
• Who should receive which notification messages. For example, it might not be necessary to notify
the administrator of group B about a failed replication in group A, but you might want all
administrators to know that an infected file was discovered in group A.
• Which types and levels of thresholds you want to set for each rule. For example, you might not
want to receive an email message every time an infected file is detected during an outbreak.
Instead, you can choose to have such a message sent at most once every five minutes, regardless
of how often that server is receiving the event.
• Which commands or registered executables you want to run when the conditions of a rule are met.
• Which server task you want to run when the conditions of a rule are met.

Determining how events are forwarded

Use these tasks to determine when events are forwarded and which events are forwarded immediately.
The server receives event notifications from McAfee Agents. You can configure agent policies to
forward events either immediately to the server or only at agent-to-server communication intervals.
®
214 McAfee ePolicy Orchestrator
Associated Events Configurations
Distributed repository Sends a notification message when any update or
update or replication replication fails.
failed
Any events from any Sends a notification message:
unknown products
• When the number of events is at least 1,000
• At most, once every two hours.
• With the source system IP address, actual threat
• When the number of selected distinct value is 500.
Master repository Sends a notification message when any update or
update or replication replication fails.
failed
Non-Compliant Computer Sends a notification message when any events are
Detected events received from the Generate Compliance Event server
task.
New rogue system Queries the newly detected system for a McAfee
detected Agent.
®
4.6.0 Software Product Guide
within an hour.
names, and actual product information, if
available, and many other parameters.