McAfee EPOCDE-AA-BA - ePolicy Orchestrator - PC, Product Manual

Page: 211 / 328

18
Responding to events in your network
Using the ePolicy Orchestrator Automatic response feature, you can configure your server to
automatically trigger an action in response to various types of events; including threat, client, and
server events.
Are you creating an Automatic Response rule for the first time?
When creating a new automatic response rule for the first time:
1
Understand Automatic Responses and how it works with the System Tree and your network.
2
Plan your implementation. Which users need to know about which events?
3
Prepare the components and permissions used with Automatic Responses, including:
• Automatic Responses permissions — Create or edit permission sets and ensure that they are
assigned to the appropriate McAfee ePO users.
• Email server — Configure the email (SMTP) server at
Server Settings
.
• Email contacts list — Specify the list from which you select recipients of notification messages at
Contacts
.
• Registered executables — Specify a list of registered executables to run when the conditions of
a rule are met.
• Rogue System Detection permission — Create or edit permission sets and ensure that they are
assigned to the appropriate McAfee ePO users.
• Server tasks — Create server tasks for use as actions to be carried out as a result of a response
rule.
• SNMP servers — Specify a list of SNMP servers to use while creating rules. You can configure
rules to send SNMP traps to SNMP servers when the conditions are met to initiate a notification
message.
Contents
About using Automatic Responses
Automatic Responses and how it works
Planning
Determining how events are forwarded
Configuring Automatic Responses
Creating and editing Automatic Response rules
Frequently asked questions
18
McAfee
®
ePolicy Orchestrator
®
4.6.0 Software Product Guide 211