McAfee ePolicy Orchestrator, Manual, Page: 67 / 126

64
ePolicy Orchestrator
®
3.6 Walkthrough Guide ePolicy Orchestrator Notifications
Determining when events are forwarded
6
Scenario two
For this scenario, 50 virus infections are detected in
Group2C
and 50 virus infections are
detected in
Group3B
within 60 minutes in a single day.
Conditions of the
VirusDetected_Directory
rule are met, sending notification messages (or
launching registered executables) per the rules’ configurations. This the only rule that
can be applied to all 100 events.
Determining when events are forwarded
The ePolicy Orchestrator server receives notifications from the Common Management
Agent (
CMA
). You must configure its policy pages to forward events either immediately
to the ePolicy Orchestrator server or only at agent-to-server communication intervals.
If you choose to have events sent immediately (as set by default in ePolicy Orchestrator
Agent 3.5.0 McAfee Default policy), the agent forwards all events as soon as they are
received. If you want all events sent to the ePolicy Orchestrator server immediately so
that they can be processed by Notifications when the events occur, configure the agent
to send them immediately.
If you choose not to have events sent immediately, the agent only forwards events
immediately that are designated by the issuing product as high priority. Other events
are only sent at the agent-to-server communication intervals.
If the currently applied named policy is not set for immediate uploading of events,
either edit the currently applied named policy or create a new named policy for the
ePO
Agent 3.5.0 | Configuration
policy pages. This setting is configured on the
Events
tab of
these policy pages.
Figure 6-2 Console tree