McAfee EPOCDE-AA-BA - ePolicy Orchestrator - PC, Product Manual

Page: 224 / 328

For option definitions click
?
in the interface.
Task
1
Next to Aggregation, select whether to
Trigger this response for every event
, or to
Trigger this response if multiple
events occur within
a defined amount of time. If you select the latter, define the amount of time in
minutes, hours, or days.
2
If you selected
Trigger this response if multiple events occur within
, you can choose to trigger a response
when the specified conditions are met. These conditions are any combination of:
•
When the number of distinct values for an event property is at least a certain value
. This condition is used when a
distinct value of occurrence of event property is selected.
•
When the number of events is at least
. Type a defined number of events.
You can select one or both options. For example, you can set the rule to
trigger this response if the distinct value of occurrence of event property
selected exceeds 300, or when the number of events exceeds 3,000,
whichever threshold is crossed first.
3
Next to Grouping, select whether to group the aggregated events. If you select to group the
aggregated events, specify the property of event on which they are grouped.
4
As needed, next to Throttling, select
At most, trigger this response once every
and define an amount of time
that must be passed before this rule can send notification messages again.
The amount of time can be defined in minutes, hours, or days.
5 Click
Next
.
Configuring the action for Automatic Response rules
Use this task to configure the responses that are triggered by the rule on the Responses page of the
Response Builder wizard.
You can configure the rule to trigger multiple actions by using the
+
and
-
buttons, located next to the
drop-down list for the type of notification.
For option definition click
?
in the interface.
18 Responding to events in your network
Creating and editing Automatic Response rules
224 McAfee
®
ePolicy Orchestrator
®
4.6.0 Software Product Guide