Machine Status And Rogue Type - McAfee EPOLICY ORCHESTRATOR 3.6 - WALKTHROUGH GUIDE Manual

®
ePolicy Orchestrator 3.6 Walkthrough Guide

Machine status and rogue type

Machine status and rogue type are classifications ePolicy Orchestrator uses to
determine which systems are rogue systems. Each detected system is listed in the
Machine List
table with a status and, if classified as a rogue system, a rogue type. These
classifications are very useful for grouping systems in the
also use status and rogue type as criteria for automatic responses.
Machine status for detected systems
Each detected system has a basic status of
Status
status is displayed in the
Table 5-1 Types of machine status
Machine Status Description
Managed
A system that has an active agent installed and running. The vast
majority of systems in the
status.
Rogue
A system that does not have an agent on it.
Exception
A system you have identified as an exception. An exception is a
piece of network equipment, such as a network router, switch, or
printer, that you know does not require an agent.
Inactive
A system that is listed in the ePolicy Orchestrator database but has
not been detected by a rogue system sensor in a configurable time
period. These are mostly likely systems that are shut down or
disconnected from the network.
Types of rogue systems
Rogue
Systems with a status of
systems that are not listed in the database, but are also not necessarily true rogue
systems at a given point in time. Rogue types allow you to define what exactly is a
rogue system in your network.
For example, a new system may have just logged onto the network. This system had
an agent installed with a network login script at its initial logon. Since the initial agent
call to the server may take up to ten minutes, the rogue system sensor detects the
system before the agent communicates with the server and is added to the database
as a managed system. The system is classified as a rogue system, even though it is not
really a rogue system because it already has an agent. If you configure automatic
responses or automatic e-mail alerts for rogue detections, specifying a reasonable
Rogue (Grace Period)
grace period using the
positive detections.
Machine List
Managed Rogue
, ,
Machine List
column of the table.
Machine List
Inactive
or also are assigned a rogue type. These may be
rogue type can help you minimize false
55
Rogue System Detection
table. You can
Exception Inactive
, or . This
table should have this
5