McAfee EPOCDE-AA-BA - ePolicy Orchestrator - PC, Product Manual

Page: 214 / 328

Default notification rules
Rule Name Associated Events Configurations
Distributed repository
update or replication
failed
Distributed repository
update or replication
failed
Sends a notification message when any update or
replication fails.
Malware detected Any events from any
unknown products
Sends a notification message:
• When the number of events is at least 1,000
within an hour.
• At most, once every two hours.
• With the source system IP address, actual threat
names, and actual product information, if
available, and many other parameters.
• When the number of selected distinct value is 500.
Master repository
update or replication
failed
Master repository
update or replication
failed
Sends a notification message when any update or
replication fails.
Non-compliant
computer detected
Non-Compliant Computer
Detected
events
Sends a notification message when any events are
received from the Generate Compliance Event server
task.
RSD: Query New
Rogue Detection
New rogue system
detected
Queries the newly detected system for a McAfee
Agent.
Planning
Before creating rules that send notifications, save time by planning:
• The event type and group (product and server) that trigger notification messages in your
environment.
• Who should receive which notification messages. For example, it might not be necessary to notify
the administrator of group B about a failed replication in group A, but you might want all
administrators to know that an infected file was discovered in group A.
• Which types and levels of thresholds you want to set for each rule. For example, you might not
want to receive an email message every time an infected file is detected during an outbreak.
Instead, you can choose to have such a message sent at most once every five minutes, regardless
of how often that server is receiving the event.
• Which commands or registered executables you want to run when the conditions of a rule are met.
• Which server task you want to run when the conditions of a rule are met.
Determining how events are forwarded
Use these tasks to determine when events are forwarded and which events are forwarded immediately.
The server receives event notifications from McAfee Agents. You can configure agent policies to
forward events either immediately to the server or only at agent-to-server communication intervals.
18 Responding to events in your network
Planning
214 McAfee
®
ePolicy Orchestrator
®
4.6.0 Software Product Guide