Setting up automatic responses to Rogue System
Detection events
Use this task to set up automatic responses to Rogue System Detection events using the
Response Builder wizard. You can configure Rogue System Detection to generate an automatic
response when:
• A system is added to the Exceptions list.
• A system is detected.
• A subnet falls into the uncovered state.
Task
For option definitions, click ? on the page displaying the options.
1
Go to Automation | Responses and click New Response. The Response Builder
wizard opens.
2
In the Description page:
a Type a name for the new response, and any notes.
b From the Event group drop-down list, select Rogue System Events.
c From the Event type drop-down list, select an event type.
Table 2: Event type option definitions
Definition
Option
Triggers a response any time a system is added to the Exceptions
list.
Add to Exceptions
Triggers a response any time a subnet does not have any active
sensors monitoring it.
Subnet Falls Into Uncovered State
Triggers a response any time a rogue system is detected.
Rogue System Detected
d Select Enabled to activate the response, then click Next.
3
On the Filter page from the Available Properties list, click the properties you want to
use to filter events, then click Next.
4
In the Aggregation page, specify how you want events to be aggregated, the click Next.
5
In the Actions page, select the action to perform when this response is triggered, then
click Next.
Table 3: Action results
Result
Action
Adds the detected system to the Exceptions list.
Add to Exceptions
Adds the detected system to the System Tree.
Add to System Tree
Removes the detected system associated with this event.
Delete Detected System
Deploys a McAfee Agent to the detected system.
Deploy Agent
Opens the Query McAfee Agent Results page, which provides the name of IP
address of the detected system and details about the agent installed on it.
Query Agent
Removes the detected system from the Exceptions list.
Remove from Exceptions
Detecting Rogue Systems
Setting up automatic responses to Rogue System Detection events
201
McAfee ePolicy Orchestrator 4.0.2 Product Guide
