McAfee EPOCDE-AA-BA - ePolicy Orchestrator - PC, Product Manual

Page: 130 / 328

using this information to create and maintain parts or all of your System Tree structure by setting IP
address sorting criteria for such groups.
In this version of ePolicy Orchestrator, this functionality has changed, and now allows for the setting of
IP sorting criteria randomly throughout the tree. You no longer need to ensure that the sorting criteria
of the child group’s IP address is a subset of the parent’s, as long as the parent has no assigned
criteria. Once configured, you can sort systems at agent-server communication, or only when a sort
action is manually initiated.
IP address sorting criteria should not overlap between different groups.
Each IP range or subnet mask in a group’s sorting criteria should cover a
unique set of IP addresses. If criteria does overlap, the group where
those systems end up depends on the order of the subgroups on the
System Tree
|
Groups Details
tab. You can check for IP overlap using the
Check IP Integrity action in the Group Details tab
Tag-based sorting criteria
In addition to using IP address information to sort systems into the appropriate group, you can define
sorting criteria based on the tags assigned to systems.
Tag-based criteria can be used with IP address-based criteria for sorting.
Group order and sorting
To provide additional flexibility with System Tree management, you can configure the order of a
group’s subgroups, and therefore the order by which they are considered for a system’s placement
during sorting. When multiple subgroups have matching criteria, changing this order can change
where a system ends up in the System Tree.
Additionally, if you are using catch-all groups, they must be the last subgroup in the list.
Catch-all groups
Catch-all groups are groups whose sorting criteria is set to
All others
on the Sorting Criteria page of the
group. Only subgroups at the last position of the sort order can be catch-all groups. These groups
receive all systems that were sorted into the parent group, but were not sorted into any of the
catch-all’s peers.
How a system is added to the System Tree when sorted
When the agent communicates with the server for the first time, the server uses an algorithm to place
the system in the System Tree. When it cannot find an appropriate location for a system, it puts the
system in the Lost&Found group.
On each agent-server communication, the server attempts to locate the system in the System Tree by
agent GUID (only systems whose agents have already called into the server for the first time have an
agent GUID in the database). If a matching system is found, it is left in it’s existing location.
If a matching system is not found, the server uses an algorithm to sort the systems into the
appropriate groups. Systems can be sorted into any criteria-based group in the System Tree, no
matter how deep it is in the structure, as long as each parent group in the path does not have
non-matching criteria. Parent groups of a criteria-based subgroup must have either no criteria or
matching criteria.
12 Organizing the System Tree
How a system is added to the System Tree when sorted
130 McAfee
®
ePolicy Orchestrator
®
4.6.0 Software Product Guide