McAfee EPOCDE-AA-BA - ePolicy Orchestrator - PC Product Manual page 9

Importing a query . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247
Exporting query results to other formats . . . . . . . . . . . . . . . . . . . . . 248
Multi-server rollup querying . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Creating a Rollup Data server task . . . . . . . . . . . . . . . . . . . . . . . 249
Creating a query to define compliance . . . . . . . . . . . . . . . . . . . . . . 250
Generating compliance events . . . . . . . . . . . . . . . . . . . . . . . . . 250
About reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
Structure of a report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
Working with reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252
Creating a new report . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
Editing an existing report . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
Viewing report output . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258
Grouping reports together . . . . . . . . . . . . . . . . . . . . . . . . . . 258
Running reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259
Configuring Internet Explorer 8 to automatically accept McAfee ePO downloads . . . . . 259
Running a report with a server task . . . . . . . . . . . . . . . . . . . . . . . 260
Exporting reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260
Importing reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261
Deleting reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261
Using database servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261
Working with database servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
Modifying a database registration . . . . . . . . . . . . . . . . . . . . . . . . 262
Removing a registered database . . . . . . . . . . . . . . . . . . . . . . . . 262
21 Detecting Rogue Systems
What are rogue systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265
Rogue System Detection states . . . . . . . . . . . . . . . . . . . . . . . . 266
Rogue Sensor Blacklist . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269
Rogue System Detection policy settings . . . . . . . . . . . . . . . . . . . . . 269
Rogue System Detection permission sets . . . . . . . . . . . . . . . . . . . . . 271
How the Rogue System Sensor works . . . . . . . . . . . . . . . . . . . . . . . . . 272
Passive listening to layer-2 traffic . . . . . . . . . . . . . . . . . . . . . . . . 272
Intelligent filtering of network traffic . . . . . . . . . . . . . . . . . . . . . . 272
Data gathering and communications to the server . . . . . . . . . . . . . . . . . 273
Systems that host sensors . . . . . . . . . . . . . . . . . . . . . . . . . . 273
How detected systems are matched and merged . . . . . . . . . . . . . . . . . . . . 274
Working with detected systems . . . . . . . . . . . . . . . . . . . . . . . . . . . 274
Configuring Rogue System Detection policy settings . . . . . . . . . . . . . . . . 275
Adding systems to the Exceptions list . . . . . . . . . . . . . . . . . . . . . . 276
Adding systems to the Rogue Sensor Blacklist . . . . . . . . . . . . . . . . . . 277
Adding detected systems to the System Tree . . . . . . . . . . . . . . . . . . . 277
Editing system comments . . . . . . . . . . . . . . . . . . . . . . . . . . . 277
Exporting the Exceptions list . . . . . . . . . . . . . . . . . . . . . . . . . . 278
Importing systems to the Exceptions list . . . . . . . . . . . . . . . . . . . . . 278
Merging detected systems . . . . . . . . . . . . . . . . . . . . . . . . . . 278
Pinging a detected system . . . . . . . . . . . . . . . . . . . . . . . . . . 279
Querying detected system Agents . . . . . . . . . . . . . . . . . . . . . . . 279
Removing systems from the Detected Systems list . . . . . . . . . . . . . . . . . 279
Removing systems from the Exceptions list . . . . . . . . . . . . . . . . . . . . 280
Removing systems from the Rogue Sensor Blacklist . . . . . . . . . . . . . . . . 280
Viewing detected systems and their details . . . . . . . . . . . . . . . . . . . . 280
Working with sensors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280
Installing sensors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281
Editing sensor descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . 283
Removing sensors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283
Working with subnets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284
® ®
McAfee ePolicy Orchestrator
Contents
4.6.0 Software Product Guide
265
9