Determining Which Events Are Forwarded Immediately; Determining Which Events Are Forwarded - McAfee EPOCDE-AA-BA - ePolicy Orchestrator - PC Product Manual

If you choose to send events immediately (as set by default), the agent forwards all events as soon as
they are received.
The default interval for processing event notifications is one minute. As a
result, there might be a delay before events are processed. You can
change the default interval in the Event Notifications server settings
(Menu | Configuration | Server).
If you choose not to have all events sent immediately, the agent forwards immediately only events
that are designated by the issuing product as high priority. Other events are sent only at the
agent-server communication.
Tasks
• Determining which events are forwarded immediately on page 215
Use this task to determine whether events are forwarded immediately or only at the
agent-to-server communication interval.
• Determining which events are forwarded on page 215
Use this task to determine which events are forwarded to the server.

Determining which events are forwarded immediately

Use this task to determine whether events are forwarded immediately or only at the agent-to-server
communication interval.
If the currently applied policy is not set for immediate uploading of events, either edit the currently
applied policy or create a new McAfee Agent policy. This setting is configured on the Threat Event Log
page.
For option definitions click ? in the interface.
Task
Click Menu | Policy | Policy Catalog, then select Product as McAfee Agent and Category as General.
1
Click on an existing agent policy.
2
3 On the Events tab, select Enable priority event forwarding.
Select the event severity.
4
Events of the selected severity (and greater) are forwarded immediately to the server.
5 To regulate traffic, type an Interval between uploads (in minutes).
To regulate traffic size, type the Maximum number of events per upload.
6
Click Save.
7

Determining which events are forwarded

Use this task to determine which events are forwarded to the server.
For option definitions click ? in the interface.
Task
Click Menu | Configuration | Server Settings, select Event Filtering, then click Edit.
1
Select the desired events, then click Save.
2
These settings take effect once all agents have called in.
Responding to events in your network
Determining how events are forwarded
® ®
McAfee ePolicy Orchestrator 4.6.0 Software Product Guide
18
215