McAfee EPOLICY ORCHESTRATOR 4.0.2 - Скачать руководство пользователя страница 213 | Manualshive

Страница: 213 / 228

McAfee EPOLICY ORCHESTRATOR 4.0.2 - Скачать руководство пользователя страница 213

Default Rogue System Detection queries

Rogue System Detection provides default queries that you can use to retrieve specific information
from your network. These queries can be modified or duplicated in the same manner as other
queries in ePolicy Orchestrator. You can also create custom queries, display query results in
dashboard monitors, and add those dashboard monitors to the Dashboards section in ePolicy
Orchestrator. For more information on using dashboards, see

Assessing Your Environment With

Dashboards.

Rogue System Detection query definitions

Definition

Query

Returns the details of active sensors installed on your
network in the last 24 hours, in pie chart format.

RSD: Active Sensor Response (Last 24 Hours)

Returns the details of passive sensors installed on your
network in the last 24 hours, in pie chart format.

RSD: Passive Sensor Response (Last 24 Hours)

Returns the details of systems detected on your network
as rogue systems in the last seven days, grouped by
domain, in table format.

RSD: Rogue Systems, By Domain (Last 7 Days)

Returns the details of systems detected on your network
as rogue systems in the last seven days, grouped by
operating system, in pie chart format.

RSD: Rogue Systems, By OS (Last 7 Days)

Returns the details systems detected on your network as
rogue systems in the last seven days, grouped by grouped
by organizationally unique identifier, in pie chart format.

RSD: Rogue Systems, By OUI (Last 7 Days)

Returns the details of detected subnets on your network,
in pie chart format.

RSD: Subnet Coverage

Detecting Rogue Systems
Default Rogue System Detection queries

213

McAfee ePolicy Orchestrator 4.0.2 Product Guide

«
...
211
212
213
214
215
...
»

Содержание EPOLICY ORCHESTRATOR 4.0.2 -

Страница 1: ...McAfee ePolicy Orchestrator 4 0 2 Product Guide...

Страница 2: ...curity is distinctive of McAfee brand products All other registered and unregistered trademarks herein are the sole property of their respective owners LICENSE INFORMATION License Agreement NOTICE TO...

Страница 3: ...rol 18 Available server tasks and what they do 19 The Audit Log 20 The Event Log 20 Data exports from any table or chart 21 MyAVERT Security Threats 22 Logging on and off from ePO servers 22 Logging o...

Страница 4: ...iewing the Event Log 33 Purging events 33 Purging the Event Log on a schedule 34 Working with MyAvert Security Threats 34 Configuring MyAvert update frequency and proxy settings 35 Viewing threat noti...

Страница 5: ...orting systems from a text file 54 Sorting systems into criteria based groups 55 Importing Active Directory containers 57 Importing NT domains to an existing group 59 Synchronizing the System Tree on...

Страница 6: ...query results 82 Maintaining the agent 82 Sending manual wake up calls to systems 83 Sending manual wake up calls to a group 83 Sending wake up calls on a schedule 84 Viewing the agent activity log 8...

Страница 7: ...other servers 111 Importing distributed repositories from the SITEMGR XML file 111 Importing source sites from the SITEMGR XML file 112 Changing credentials on multiple distributed repositories 112 M...

Страница 8: ...es 131 Deployment packages for products and updates 131 Product and update deployment 133 Deployment tasks 134 Update tasks 134 Global updating 135 Pull tasks 136 Replication tasks 137 Repository sele...

Страница 9: ...h events are forwarded 157 Setting up ePO Notifications 157 Giving users appropriate permissions to Notifications 157 Working with SNMP servers 158 Working with registered executables and external com...

Страница 10: ...Failed User Actions in ePO Console query 182 ePO Failed Logon Attempts query 182 ePO Multi Server Compliance History query 182 ePO Systems per Top Level Group query 183 ePO Systems Tagged as Server qu...

Страница 11: ...r settings for Rogue System Detection 199 Editing compliance settings 199 Editing matching settings 199 Editing sensor settings 200 Setting up automatic responses to Rogue System Detection events 201...

Страница 12: ...forming daily or weekly database maintenance 214 Performing weekly maintenance of MSDE databases 214 Performing regular maintenance of SQL Server databases 215 Backing up ePolicy Orchestrator database...

Страница 13: ...ates and signatures from McAfee or user defined source sites Distributed repositories Placed strategically throughout your environment to provide access for managed systems to receive signatures produ...

Страница 14: ...licy Orchestrator environment for the first time and as a reference tool for more experienced users Depending on your environment you may perform some of these tasks in a slightly different order McAf...

Страница 15: ...the product Before during and after installation How can my company benefit from this product Online Help Product Guide and Online Help Release Notes Evaluation Tutorial Maintaining the software Known...

Страница 16: ...uring the ePO server for the first time 1 Review the conceptual information on user accounts permission sets server settings and server tasks 2 Decide on how to implement the flexibility of permission...

Страница 17: ...dd delete and assign permission sets Import events into ePolicy Orchestrator databases and limit events that are stored there How permission sets work A permission set is a group of permissions that c...

Страница 18: ...Provides view permissions across ePolicy Orchestrator features Users that are assigned this permission set each need at least one more permission set that grants access needed products and groups of...

Страница 19: ...Synchronizes select Windows NT domains and Active Directory containers that are mapped to System Tree groups This task can also be performed manually Purge Audit Log Deletes entries from the Audit Lo...

Страница 20: ...which columns are displayed in the sortable table You can choose from a variety of event data to use as columns Depending on which products you are managing you can also take certain actions on the e...

Страница 21: ...e threat originated Threat Source IPv6 Address IPv6 address of the system from which the threat originated Threat Source MAC Address MAC address of the system from which the threat originated Threat S...

Страница 22: ...upplemental virus definition EXTRA DAT file which you can manually download if you need protection before the next full DAT file is available such as in an outbreak scenario Protection Pending on High...

Страница 23: ...sired ePolicy Orchestrator server This information appears in the title bar To view license information go to the logon page To view extension version information go to Configuration Extension Working...

Страница 24: ...ccounts Task For option definitions click on the page displaying the options 1 Go to Configuration Users 2 Select the user you want to edit in the Users list then click Edit 3 Edit the account as need...

Страница 25: ...ons then click Save 7 Repeat for all desired sections of the permission set Duplicating permission sets Use this task to duplicate a permission set Only global administrators can duplicate permission...

Страница 26: ...nistrators can delete permission sets Task For option definitions click on the page displaying the options 1 Go to Configuration Permission Sets then select the permission set you want to delete in th...

Страница 27: ...ick on the page displaying the options 1 Go to Configuration Contacts then select a contact 2 Click Delete then click OK in the Action pane The contact no longer appears in the list Working with serve...

Страница 28: ...configure Headers and footers including a custom logo name page numbering etc Page size and orientation for printing Directory where exported tables and dashboards are stored Task For option definiti...

Страница 29: ...ion After installation you can only change the two ports used for agent communication If you need to change other ports you must reinstall the server and reconfigure the ports in the installation wiza...

Страница 30: ...re it finished Task For option definitions click on the page displaying the options 1 Go to Reporting Server Task Log 2 Click any entry in the log to view its details Figure 4 Server Task Log Details...

Страница 31: ...w and purge the Audit Log The Audit Log records actions taken by ePO users Tasks Viewing the Audit Log Purging the Audit Log Purging the Audit Log on a schedule Viewing the Audit Log Use this task to...

Страница 32: ...on definitions click on the page displaying the options 1 Go to Reporting Audit Log 2 Click Purge 3 In the Action panel next to Purge records older than type a number and select a time unit 4 Click OK...

Страница 33: ...1 Go to Reporting Event Log 2 Click any of the column titles to sort the events You can also select Choose Columns from the Options drop down list to select different table columns that meet your need...

Страница 34: ...le of events 5 Click Next The Schedule page appears 6 Schedule the task as needed then click Next The Summary page appears 7 Review the task s details then click Save Working with MyAvert Security Thr...

Страница 35: ...the options 1 Go to Reporting MyAvert Figure 8 MyAvert Security Threats page 2 If you want to narrow the viewable notifications select an option from the Filter drop down list 3 If you want to mark n...

Страница 36: ...location on the server to which a link is provided You can open or save the file to another location by right clicking it NOTE When typing multiple email addresses for recipients you must separate en...

Страница 37: ...5 in the minutes field means the task runs at minutes 5 20 35 and 50 The letter L means last in the Day of Week or Day of Month fields For example 0 15 10 6L means the last Friday of every month at 10...

Страница 38: ...stems managed by ePolicy Orchestrator it is the the primary interface for managing policies and tasks on these systems You can organize systems into logical groups for example functional department or...

Страница 39: ...properties or requirements into these units allows you to manage policies for systems in one place rather than setting policies for each system individually As part of the planning process consider th...

Страница 40: ...ronment can affect how your System Tree is structured Plan the organization of the System Tree before you build and populate it Especially for a large network you want to build the System Tree only on...

Страница 41: ...es several advantages for configuring policies You can configure update policies for the group so that all systems update from one or more distributed software repositories located nearby You can sche...

Страница 42: ...oy and manage security products on these systems separately Additionally by giving these systems a corresponding tag you can automatically sort them into a group Tags and how they work Tags are a new...

Страница 43: ...and maintain part or all of the System Tree with Active Directory synchronization settings Once defined the System Tree is updated with any new systems and subcontainers in your Active Directory Activ...

Страница 44: ...exist elsewhere in the System Tree this ensures no duplicate systems if you manually move or sort the system to another location Exclude certain Active Directory containers from the synchronization Th...

Страница 45: ...ne criterion of a group s sorting criteria to be placed in the group After creating groups and setting your sorting criteria take a Test Sort action to confirm the criteria and sorting order achieve t...

Страница 46: ...e sorting is disabled on a system that system will not be sorted regardless of how the sorting action is taken If System Tree sorting is enabled on a system that system is sorted always for the manual...

Страница 47: ...the server attempts to locate the system in the System Tree by agent GUID only systems whose agents have already called into the server for the first time have an agent GUID in the database If a matc...

Страница 48: ...nd with matching criteria 7 If such a top level group is not found then the subgroups of top level groups without sorting criteria are considered according to their sorting 8 If such a second level cr...

Страница 49: ...ot configured When systems are evaluated against a tag s criteria the tag is applied to systems that match the criteria and have not been excluded from the tag 5 Verify the information on this page th...

Страница 50: ...d manually The Systems with Tag Applied Manually page appears c Verify the desired systems are in the list Applying criteria based tags automatically to all matching Use these tasks to apply criteria...

Страница 51: ...the tag on systems that don t match the criteria and applies the tag to systems that match criteria but were excluded from receiving the tag 5 Click Next The Schedule page appears 6 Schedule the task...

Страница 52: ...riteria to ensure the systems stay in the group If your organization s IP address information coincides with your security management needs consider assigning IP address sorting criteria to these grou...

Страница 53: ...omatically placed in the appropriate group Adding systems manually to an existing group Use this task to import systems from your Network Neighborhood to groups You can also import a network domain or...

Страница 54: ...a text file Then import that information into ePolicy Orchestrator You must have network utilities such as the NETDOM EXE utility available with the Microsoft Windows Resource Kit to generate complete...

Страница 55: ...stems manually Adding sorting criteria to groups Use this task to configure sorting criteria for a group Sorting criteria can be based on IP address information or tags Task For option definitions cli...

Страница 56: ...g and disabling System Tree Sorting on Systems Use this task to enable or disable System Tree sorting on systems The sorting status of a system determines whether it can be sorted into a criteria base...

Страница 57: ...e System Tree is added or removed also Delete systems from the System Tree when they are deleted from Active Directory Prevent duplicate entries of systems in the System Tree when they already exist i...

Страница 58: ...oved from the System Tree Systems only Select this option if you only want the systems from the Active Directory container and non excluded subcontainers to populate this group and this group only No...

Страница 59: ...on server task for the first synchronization This is useful if you are deploying agents to new systems on the first synchronization when bandwidth is a larger concern 13 When the synchronization compl...

Страница 60: ...Next to Domain click Browse and select the NT domain to map to this group then click OK Alternatively you can type the name of the domain directly in the text box NOTE When typing the domain name do n...

Страница 61: ...ze Now or Update Group Once the systems are added to the System Tree distribute agents to them if you did not select to deploy agents as part of the synchronization Also consider setting up a recurrin...

Страница 62: ...s mapped to the NT domain 2 Next to Synchronization type click Edit The Synchronization Settings page appears 3 Near the bottom of the page click Compare and Update The Manually Compare and Update pag...

Страница 63: ...is action 3 Select whether to enable or disable System Tree sorting on the selected systems when they are moved 4 Select the group in which to place the systems then click OK Organizing Systems for Ma...

Страница 64: ...to understand the agent its policies and tasks and the methods to distribute it 2 Configure agent policy settings for the System Tree groups to which you are distributing agents 3 Distribute agents wi...

Страница 65: ...LES NETWORK ASSOCIATES COMMON FRAMEWORK CAUTION Once the agent has been installed you cannot change its installation directory without first removing it Agent language packages Agent installation pack...

Страница 66: ...stem Agent server communication can be initiated in three ways Agent to server communication interval ASCI Agent initiated communication after agent startup Agent wake up calls Communication initiated...

Страница 67: ...ul when you have made policy changes or checked in updates that you want to apply to the managed systems sooner than the next ASCI Wake up calls can also configured on query results which are schedule...

Страница 68: ...ices To deploy sufficient numbers of SuperAgents to the appropriate locations first determine the broadcast segments in your environment and select a system preferably a server in each to host a Super...

Страница 69: ...server Where the agent goes for product and update packages Before distributing a large number of agents throughout your network consider carefully how you want the agent to behave in the segments of...

Страница 70: ...the ePO server differ by more than two The properties listed depend on whether you selected to send full or minimal properties on the General tab of the McAfee Agent policy pages Full properties If y...

Страница 71: ...xy server settings for the managed systems The Proxy tab of the McAfee Agent policy pages includes settings to Use Internet Explorer proxy settings Configure custom proxy settings Disable any proxy us...

Страница 72: ...are several methods you can use to distribute the agent to the systems you want to manage Before using any of these methods you should consider each The following table details the advantages and dis...

Страница 73: ...credentials if users do not have local administrator permissions The user account credentials you embed are used to install the agent NOTE For Microsoft Windows XP Service Pack 2 and later operating...

Страница 74: ...ify that the server can communicate with a few systems in each segment of your network If the targeted systems respond to the ping then ePolicy Orchestrator can reach the segments NOTE The ability to...

Страница 75: ...ent page 3 Select the desired Agent version from the drop down list 4 If you are deploying agents to a group select whether to include systems from its subgroups 5 Select whether to Install only on sy...

Страница 76: ...pected systems to the desired groups If you don t all systems are added to the Lost Found group and you must move them later manually The details of the login script depends on your needs Consult your...

Страница 77: ...cally on a system This is a desirable method to install agents for the following circumstances Your organization requires that software is installed on systems manually You intend to use ePolicy Orche...

Страница 78: ...ory list SITELIST XML from the Master Repository page to a temporary folder on the system such as C TEMP 2 Run this command on the desired system FRMINST EXE INSTALL AGENT SITEINFO C TEMP SITELIST XML...

Страница 79: ...to force the new agent to call into the ePO server immediately You can do this from any system on which an agent has just been installed This is useful after installing the agent manually Task For opt...

Страница 80: ...such as VirusScan Enterprise to systems that are already running agents Best practices information You can use the deployment task to upgrade agents McAfee releases newer versions of the agent periodi...

Страница 81: ...oving agents from systems in query results Running FRMINST EXE from a command line Use this task to remove the agent from a command line Task Run the agent installation FRMINST EXE program with the RE...

Страница 82: ...emoving agents from systems in query results Use this task to remove agents from systems listed in the results of queries for example the Agent Versions Summary query Task For option definitions click...

Страница 83: ...r next to Target systems 4 Select whether to send an Agent Wake Up Call or SuperAgent Wake Up call next to Wake up call type 5 Accept the default or type a different Randomization 0 60 minutes Conside...

Страница 84: ...his wake up call ensure this is option selected 8 Click OK to send the agent or SuperAgent wake up call Sending wake up calls on a schedule Use this task to create a scheduled agent wake up call NOTE...

Страница 85: ...ting the option and applying the change 2 Select Status Monitor from the menu The status monitor appears the agent activity log is displayed 3 Close the status monitor when finished Viewing the agent...

Страница 86: ...manually Sending full properties to the ePO server Sending events to the ePO server immediately Updating policies Enforcing policies Viewing agent settings Viewing agent and product version numbers Ru...

Страница 87: ...ay icon on the desired system then select McAfee Agent Status Monitor The Agent Status Monitor appears 2 Click Check New Policies Enforcing policies Use this task to prompt an agent to enforce all con...

Страница 88: ...either of these tasks to ensure that all agents can communicate with any required server in the environment Previous versions of ePolicy Orchestrator allowed agents to easily roam among multiple ePO...

Страница 89: ...n ASSC keys Do this if you discover a key has been compromised McAfee recommends creating and using new ASSC keys routinely for example every three months Task For option definitions click on the page...

Страница 90: ...l of the systems whose agents are using the selected keys Click any system in the list to view its details or select the checkboxes next to desired systems and take any of the actions available below...

Страница 91: ...repositories in your organization or McAfee source sites The master repository key pair is unique for each installation If you use multiple servers each uses a different key If your agents may downloa...

Страница 92: ...r option definitions click on the page displaying the options 1 Go to Configuration Server Settings on each server in your environment select Security Keys in the Setting Categories list then click Ed...

Страница 93: ...dialog box appears 3 Click Save The Save As dialog box appears 4 Browse to a secure network location to store the ZIP file then click Save Restoring security keys from a backup file Use this task to...

Страница 94: ...ons These options are not case sensitive but their values are FRAMEPKG EXE and FRMINST EXE command line options Description Command Specifies the folder on the system to store agent data files The def...

Страница 95: ...s the agent and removes it if not in use Sample FRMINST REMOVE AGENT REMOVE AGENT Installs the agent in silent mode hiding the installation interface from the end user Sample FRAMEPKG INSTALL AGENT SI...

Страница 96: ...s to use and their locations 3 Create and populate your repositories Contents Repository types and what they do How repositories work together Ensuring access to the source site Working with source an...

Страница 97: ...lected updates and packages are checked into the master repository You do not need to spend additional time creating and configuring repositories or the update tasks Source site The source site provid...

Страница 98: ...e recommends combining SuperAgent repositories and global updating to ensure your managed environment is up to date FTP repositories If you are unable to use SuperAgent repositories use an existing FT...

Страница 99: ...ployment packages can be added only to the Current branch unless support for the other branches has been enabled Evaluation branch You may want to test new DAT and engine updates with a small number o...

Страница 100: ...tories work together The repositories work together in your environment to deliver updates and software to managed systems You may or may not need distributed repositories Figure 18 Sites and Reposito...

Страница 101: ...the Internet Explorer browser that is installed on your ePO server NOTE A user must be logged on to the ePO server sytem for the scheduled tasks to run when using Internet Explorer proxy settings If y...

Страница 102: ...are Master Repository then click Configure Proxy Settings The Configure Proxy Settings page appears Figure 19 Configure Proxy Settings page 2 Ensure Use Internet Explorer settings is selected next to...

Страница 103: ...separated by semi colons 6 Click OK to save these settings Working with source and fallback sites Use these tasks to change the default source and fallback sites You must be a global administrator to...

Страница 104: ...text box If you selected UNC type the network directory where the site resides in Replication UNC path Use this format computer FOLDER You can use variables to define this location 4 On the Credential...

Страница 105: ...source or fallback sites Use this task to delete source or fallback sites Before you begin You must have appropriate permissions to perform this task Task For option definitions click on the page disp...

Страница 106: ...n You can use standard Windows variables such as PROGRAM_FILES_DIR NOTE Managed systems updating from this SuperAgent repository are able to access this folder You do not need to manually enable file...

Страница 107: ...General tab deselect Use systems running SuperAgents as distributed repositories then click Save NOTE To delete a limited number of your existing SuperAgent distributed repositories duplicate the McA...

Страница 108: ...HTTP type the web address in URL and the HTTP port number in Port which is 80 by default and type the network directory where the repository resided in Replication UNC path You can also enter the serv...

Страница 109: ...all packages if a needed package type is not present in the repository the task fails This feature ensures packages that are only used by a few systems are not replicated throughout your entire enviro...

Страница 110: ...o the desired repository 2 On the Delete Repository dialog box click OK NOTE Deleting the repository does not delete the packages on the system hosting the repository Working with the repository list...

Страница 111: ...ther the Distributed Repositories or Source Sites pages However when you import this file to either page it imports only the items from the file that are listed on that page For example when this file...

Страница 112: ...on definitions click on the page displaying the options 1 Go to Software Source Sites then click Import Source Sites The Import Source Sites dialog box appears 2 Browse to and select the exported SITE...

Страница 113: ...3 Select the desired distributed repositories then click Next The Credentials page appears 4 Edit the credentials as needed then click Next The Summary page appears 5 Review the information then clic...

Страница 114: ...reate and assign policies to groups and systems 4 Create and assign client tasks to groups and systems Contents Extensions and what they do Policy management Policy application Client tasks and what t...

Страница 115: ...mponent The ePolicy Orchestrator console allows you to configure policy settings for all products and systems from a central location Policy categories Policy settings for most products are grouped by...

Страница 116: ...y settings have changed NOTE There is a delay of up to three minutes after the interval before policies for Norton AntiVirus products are enforced The agent first updates the GRC DAT file with policy...

Страница 117: ...eated it Ownership provides that no one can modify or delete a policy except its creator or a global administrator Any user with appropriate permissions can assign any policy in the Policy Catalog pag...

Страница 118: ...to view detailed information about the policies their assignments inheritance and their owners Tasks Viewing groups and systems where a policy is assigned Viewing the settings of a policy Viewing pol...

Страница 119: ...lick Edit next to the desired policy The policy pages and their settings appear NOTE You can also view this information when accessing the assigned policies of a specific group accessed from the Syste...

Страница 120: ...ee Systems then select the desired group in the System Tree All systems belonging to the group appear in the details pane 2 Select the system then click Modify Policies on a Single System 3 Select the...

Страница 121: ...en click Reset Inheritance Working with the Policy Catalog Use these tasks to create and maintain policies from the Policy Catalog page Tasks Creating a policy on the Policy Catalog page Duplicating a...

Страница 122: ...rs 3 Type the name of the new policy in the field then click OK for example Sales Europe The new policy appears on the Policy Catalog page 4 Click Edit next to the new policy s name in the list The po...

Страница 123: ...itions click on the page displaying the options 1 Go to Systems Policy Catalog then select the Product and Category from the drop down lists All created policies for that category appear in the detail...

Страница 124: ...down lists All created policies for that category appear in the details pane 2 Locate the desired policy then click Export next to the policy The Download File page appears 3 Right click the link and...

Страница 125: ...ak inheritance and assign the policy and settings below next to Inherited from 4 Select the desired policy from the Assigned policy drop down list NOTE From this location you can also edit the selecte...

Страница 126: ...n lists then click Save Enforcing policies for a product on a group Use this task to enable or disable policy enforcement for a product on a System Tree group Policy enforcement is enabled by default...

Страница 127: ...s from different portions of the System Tree Tasks Copying policy assignments from a group Copying policy assignments from a system Pasting policy assignments to a group Pasting policy assignments to...

Страница 128: ...system You must have already copied policy assignments from a group or system Task For option definitions click on the page displaying the options 1 Go to Systems System Tree Systems then select the...

Страница 129: ...or the selected group and any group that inherits the task Editing client tasks Use this task to edit a client task s settings or schedule information for any exisitng task Task For option definitions...

Страница 130: ...ected when the policy is modified in the Policy Catalog All groups and systems where a policy is applied receive any modification made to the policy at the next agent server communication The policy i...

Страница 131: ...deployment Checking in packages manually Using the Product Deployment task to deploy products to managed systems Deploying update packages automatically with global updating Deploying update packages...

Страница 132: ...ate package If bandwidth is a concern McAfee recommends updating DAT and engine files separately SuperDAT SDAT EXE files File type SDAT EXE McAfee website Download and check supplemental virus definit...

Страница 133: ...e corresponding package in to the master repository Doing so copies the packages into both directory structures enabling you to support legacy products Package ordering and dependencies If one product...

Страница 134: ...recommends considering the size of the package and the available bandwidth between the master or distributed repositories and the managed systems In addition to potentially overwhelming the ePO serve...

Страница 135: ...o run daily or several times a day Global updating McAfee recommends using global updating with your updating strategy Global updating automates replication to your distributed repositories and updati...

Страница 136: ...is release you can specify which packages are copied from the source site to the master repository NOTE EXTRA DAT files must be checked in to the master repository manually They are available from the...

Страница 137: ...ling a daily incremental replication task Schedule a weekly full replication task if it is possible for files to be deleted from the distributed repository outside of ePolicy Orchestrator s own replic...

Страница 138: ...er task log The following information is available for replication tasks on the Reporting Server Task Log tab Start date and task duration Status of task at each site when expanded Any errors or warni...

Страница 139: ...rt Netshield for NetWare Select this option if you are checking in a package for NetShield for Netware Move the existing package to the Previous branch Moves the existing package of the same type but...

Страница 140: ...sitory If you do not see the product you want to deploy listed here you must first check in that product s package 7 Set the Action to Install then select the language version of the package 8 To spec...

Страница 141: ...ed are those for which you have already checked in a package file to the master repository If you do not see the product you want to deploy listed here you must first check in that product s package f...

Страница 142: ...n update Global updating initiates an update only if new packages for the components specified here are checked in to the master repository or moved to another branch Select these components carefully...

Страница 143: ...ability to select which packages are copied from the source site Before you begin You must have the appropriate permissions to perform this task Task For option definitions click on the page displayin...

Страница 144: ...cron syntax by selecting the Advanced schedule type 11 Review the summary information then click Save The scheduled Repository Pull task is added to the task list on the Server Tasks page Running a Pu...

Страница 145: ...epository to distributed repositories You can schedule a Repository Replication server task that occurs regularly or run a Replicate Now task for immediate replication Tasks Running a Repository Repli...

Страница 146: ...n all of the schedule types you can use cron syntax by selecting the Advanced schedule type 9 Review the summary information then click Save The scheduled Repository Pull task is added to the task lis...

Страница 147: ...them by response time Subnet value Compares the IP addresses of client systems and all repositories and sorts repositories based on how closely the bits match The more closely the IP addresses resembl...

Страница 148: ...e new distributed repository to the list j Select the new repository in the list The type Local indicates it is not managed by ePolicy Orchestrator When a non managed repository is selected in the Rep...

Страница 149: ...System Tree Client Tasks select the desired group in the System Tree to which you want the task to apply then click New Task The Description page of the Client Task Builder wizard appears 2 Name and...

Страница 150: ...e agent calls into the server The next time the agent updates it retrieves them from the Evaluation branch 3 Create a scheduled Update client task for the evaluation systems that updates DAT and engin...

Страница 151: ...s from the master repository As you check in new update packages regularly they replace the older versions or move them to the Previous branch if you are using the Previous branch However you may want...

Страница 152: ...stem infecting the rest of your environment Outbreak situations For example 1000 virus detected events are received within five minutes High level compliance of ePolicy Orchestrator server events For...

Страница 153: ...virus detection events occur within the entire System Tree Throttling and aggregation You can configure when notification messages are sent by setting thresholds based on aggregation and throttling A...

Страница 154: ...yOrganization are met sending notification messages or launching registered executables per the rules configurations Scenario two For this scenario 50 virus detections are detected in Subgroup2C and 5...

Страница 155: ...ents from any product Virus detected and not removed When the number of events exceeds 1000 within an hour At most once every two hours With the source system IP address actual threat names and actual...

Страница 156: ...forwards all events as soon as they are received If you want all events sent to the server immediately so that they can be processed by Notifications when the events occur configure the agent to send...

Страница 157: ...Server Settings Email contacts list Specify the list from which you select recipients of notification messages at Configuration Contacts SNMP servers Specify a list of SNMP servers to use while creat...

Страница 158: ...steps 6 through 8 until all users are assigned the appropriate permissions Working with SNMP servers Use these tasks to configure Notifications to use your SNMP server You can configure Notifications...

Страница 159: ...ormation as needed then click Save Deleting an SNMP server Use this task to delete an SNMP server from Notifications Task For option definitions click on the page displaying the options 1 Go to Automa...

Страница 160: ...Editing registered executables Deleting registered executables Adding registered executables Use this task to add registered executables to your available resources You can then configure commands an...

Страница 161: ...ou must use a browser session from the ePO server system Task 1 Go to Automation Registered Executables then select Delete next to the desired executable in the list 2 When prompted click OK 3 Click O...

Страница 162: ...s Use this task to edit an existing external command Before you begin You must have appropriate permissions to perform this task Task For option definitions click on the page displaying the options 1...

Страница 163: ...ail Enable or disable the rule Task For option definitions click on the page displaying the options 1 Go to Automation Notification Rules then click New Rule or Edit next to an existing rule The Notif...

Страница 164: ...d a message for a Symantec Anti Virus Virus detected but NOT cleaned event If only the event category is important then select Any product 4 In Threat name define the pattern matching the threat compa...

Страница 165: ...d buttons next to the drop down list for the type of notification Task For option definition click on the page displaying the options 1 If you want the notification message to be sent as an email or t...

Страница 166: ...licking Next the Summary page appears Verify the information is correct then click Save The new notification rule appears in the Notification Rules list Viewing the history of Notifications Use these...

Страница 167: ...order Viewing the details of Notification Log entries Use this task to view the details of notifications This list can be sorted by the data of any column by clicking the column title Task For option...

Страница 168: ...t Unknown product Virex GroupShield Domino GroupShield Exchange VirusScan Enterprise LinuxShield System Compliance Profiler Symantec NAV Security Shield Frequently asked questions If I set up a notifi...

Страница 169: ...Any external tool installed on the ePolicy Orchestrator server Sending Notifications Frequently asked questions 169 McAfee ePolicy Orchestrator 4 0 2 Product Guide...

Страница 170: ...needs that aren t met by the default queries Contents Queries Query Builder Multi server roll up querying Preparing for roll up querying Working with queries Default queries and what they display Quer...

Страница 171: ...rivate queries exist in the user s My Queries list and are only available to their creator Pubic queries exist in the Public Queries list and are available to everyone who has permissions to use publi...

Страница 172: ...ts from the results of a Boolean pie chart query Additionally when creating a Compliance History query be sure the time unit matches the schedule interval for the server task McAfee recommends creatin...

Страница 173: ...led Up Compliance History Query results from these types of queries are not actionable How it works To roll up data for use by roll up queries you must register each server including the local server...

Страница 174: ...ption definitions click on the page displaying the options 1 Go to Network Registered Servers then click New Server The Registered Server Builder wizard appears 2 Select the server type and type a nam...

Страница 175: ...queries with the Query Builder wizard You can query on system properties product properties many of the log files repositories and more Task For option definitions click on the page displaying the opt...

Страница 176: ...Running an existing query Use this task to run an existing query from the Queries page Task For option definitions click on the page displaying the options 1 Go to Reporting Queries then select a que...

Страница 177: ...of the Compliance Check server task of previous versions of ePolicy Orchestrator Repository Replication Replicates master repository contents to the distributed repositories in the query results This...

Страница 178: ...k to make personal queries public All users with permissions to public queries have access to any personal queries you make public Before you begin You must have appropriate permissions to perform thi...

Страница 179: ...k on the page displaying the options 1 Go to Reporting Queries then click Import Query The Import Query dialog box appears 2 Click Browse The Choose File dialog box appears 3 Select the exported file...

Страница 180: ...n of the document covers McAfee Agent and ePO queries only See the product documentation of any others for information on their default queries MA Agent Communication Summary query Use this query with...

Страница 181: ...non compliant by versions VirusScan Enterprise McAfee Agent and DAT files This query only considers systems that have communicated with the server in the last 24 hours Query results The results of thi...

Страница 182: ...art of all logon attempts in the Audit Log divided according to whether they were successful Query results The results of the query are displayed in a Boolean pie chart which you can use to drill down...

Страница 183: ...ivided according to whether they have the Server tag Query results The results of the query are displayed in a Boolean pie chart which you can use to drill down into the systems that make up each slic...

Страница 184: ...want available as tabs from the navigation bar Contents Dashboards and how they work Setting up dashboard access and behavior Working with Dashboards Dashboards and how they work Dashboards are colle...

Страница 185: ...Select a permission No permissions Use public dashboards Use public dashboards create and edit personal dashboards Edit public dashboards create and edit personal dashboards make personal dashboards p...

Страница 186: ...tions drop down list The Manage Dashboards page appears Figure 32 New Dashboard page 2 Click New Dashboard 3 Type a name and select a size for the dashboard 4 For each monitor click New Monitor then s...

Страница 187: ...Go to Dashboards then select Select Active Dashboards from the Options drop down list Figure 33 Select Active Dashboards page 2 Click the desired dashboards from the Available Dashboards list They ar...

Страница 188: ...ns drop down list 2 Select the desired dashboard from the Available Dashboards list then click Make Public 3 Click OK when prompted The dashboard appears in the Public Dashboards list on the Manage Da...

Страница 189: ...e ePO server Rogue System Detection provides information to ePolicy Orchestrator to allow you to take remediation steps including alerting network and anti virus administrators or automatically deploy...

Страница 190: ...s Resolution Protocol RARP IP traffic and DHCP responses The sensor also performs NetBIOS calls and OS fingerprinting on systems already detected to obtain additional information It does this by liste...

Страница 191: ...y settings Systems that host sensors Install sensors on systems that are likely to remain on and connected to the network at all times such as servers If you don t have a server running in a given bro...

Страница 192: ...fied in the Rogue System Matching server settings You can specify which attributes the database uses for matching based on which attributes are unique in your environment If a system on your network h...

Страница 193: ...io of systems in the Managed and Exceptions categories to those in the Rogue and Inactive categories Exceptions Exceptions are systems that don t need a McAfee Agent such as routers printers or system...

Страница 194: ...f these three rogue states are categorized as Rogue systems Rogue System Sensor status Rogue System Sensor status is the measure of how many sensors installed on your network are actively reporting to...

Страница 195: ...uncovered are not reporting information about detected systems to the ePO server Top 25 Subnets The Top 25 Subnets list provides the starting IP addresses and subnet range for the 25 subnets that con...

Страница 196: ...or functionality Considerations for policy settings Policy settings configure the features and performance of the Rogue System Sensor These settings are separated into four groups Communication settin...

Страница 197: ...em that has an agent deployed by an ePO server with a different IP address that system is detected as a rogue because the agent is considered an alien agent Interface settings Interface settings deter...

Страница 198: ...System Detection events Configuring Rogue System Detection policy settings Use this task to configure Rogue System Detection policy settings Policy settings determine how the sensor obtains and report...

Страница 199: ...ying the options 1 Go to Configuration Server Settings then in the Settings Categories list click Rogue System Compliance 2 In the details pane click Edit 3 Edit the number of days to categorize Detec...

Страница 200: ...o edit the sensor settings for Rogue System Detection Sensor settings are user configured and specify The amount of time sensors are active The maximum number of sensors active in each subnet How long...

Страница 201: ...ls Into Uncovered State Triggers a response any time a rogue system is detected Rogue System Detected d Select Enabled to activate the response then click Next 3 On the Filter page from the Available...

Страница 202: ...k to add detected systems to the Exceptions list Getting there This task can be performed from Go to Network Detected Systems click any detected system category in the Overall System Status monitor an...

Страница 203: ...ed from Go to Network Detected Systems click any detected system category in the Overall System Status monitor and click any system Detected Systems Details page Go to Network Detected Systems and cli...

Страница 204: ...e Detected Systems For example you might want to remove systems from the Detected Systems list when you know it is no longer in service Once a system has been removed it will not appear in the Detecte...

Страница 205: ...ystems you are viewing 2 Click Remove from Exceptions Removing systems from the Rogue Sensor Blacklist Use this task to remove detected systems from the Rogue Sensor Blacklist Rogue System Detection p...

Страница 206: ...sensors Editing sensor descriptions Removing sensors Changing the sensor to server port number Use this task to change the sensor to server port number You can change the port that the Rogue System Se...

Страница 207: ...k any system Systems Details page Go to Systems System Tree Systems page Task For option definitions click on the page displaying the options 1 Select the systems where you want to install sensors the...

Страница 208: ...hedule for the task then click Next 13 Review the summary of the task then click Save Using client tasks to install sensors Use this task to create a client task that installs sensors to systems on yo...

Страница 209: ...Managed Systems Managed Systems for Subnet xxx xxx xxx xxx page Go to Systems System Tree Systems and click any system Systems Details page Go to Systems System Tree Systems page Task For option defi...

Страница 210: ...ding subnets Renaming subnets Viewing detected subnets and their details Adding subnets Use this task to add subnets to Rogue System Detection Task For option definitions click on the page displaying...

Страница 211: ...o ignore and click Ignore 2 In the Action pane click OK When ignoring a subnet on the Detected Systems homepage in the Top 25 Subnets list a dialog box opens Click OK Including subnets Use this task t...

Страница 212: ...unctionality or to check the sensor version The following table lists the run time command line options for the sensor Description Switch Forces the sensor to run as a normal command line executable o...

Страница 213: ...eturns the details of passive sensors installed on your network in the last 24 hours in pie chart format RSD Passive Sensor Response Last 24 Hours Returns the details of systems detected on your netwo...

Страница 214: ...to maintain both MSDE and SQL Server databases Contents Performing daily or weekly database maintenance Backing up ePolicy Orchestrator databases regularly Changing SQL Server information Restoring e...

Страница 215: ...ompatible with simple recovery If you have multiple databases with different recovery models you can create separate database maintenance plans for each recovery model In this way you can include a st...

Страница 216: ...Microsoft SQL Server or SQL 2005 Express as the database see the SQL Server product documentation Backing up an MSDE database If you are using Microsoft Data Engine MSDE as the ePolicy Orchestrator d...

Страница 217: ...ges to take affect As a last resort you could always edit the config file by hand orion server home conf orion db properties putting in the plaintext password starting the server and then using the co...

Страница 218: ...les and remote consoles 3 Start the Database Backup Utility DBBAK EXE The default location is C PROGRAM FILES MCAFEE EPO 4 Type the Database Server Name 5 Type the Database Name 6 Select NT Authentica...

Страница 219: ...nt activity logs 69 85 agent distribution deploying from ePolicy Orchestrator 74 FRMINST EXE command line 81 94 methods 72 74 agent distribution continued Novell NetWare servers 79 requirements for de...

Страница 220: ...eries and 184 configuring access and behavior 185 configuring for exported reports 28 configuring refresh frequency 185 creating 186 default monitors 184 granting permissions to 185 how they work 184...

Страница 221: ...gue System Blacklist 195 rogue system status 193 Exceptions list adding systems 202 compared to Rogue Sensor Blacklist 195 events and automatic responses 201 Exceptions list continued exporting 203 im...

Страница 222: ...ories about 96 checking in packages manually 148 communicating with source site 101 configuring proxy settings 102 ePO components 13 key pair for unsigned content 72 key pairs using 91 pulling from so...

Страница 223: ...rk 17 rogue system detection 197 working with 24 25 26 permissions assigning for notifications 157 permissions continued for queries 171 global administrator 17 to dashboards 185 policies about 115 as...

Страница 224: ...result types 172 query names Agent Communication Summary 180 Agent Version Summary 180 Compliance History 181 Compliance Summary 181 Detection History 181 Distributed Repository Status 182 Failed Log...

Страница 225: ...ask Builder wizard 51 server task log about 138 server task log continued filtering for recent activity 30 Pull Now task 144 purging 31 Replicate Now task 146 reviewing status of tasks 30 working with...

Страница 226: ...k bandwidth 41 operating systems 42 planning considerations 40 text files importing systems and groups 54 using subgroups 59 System Tree sorting default settings 48 enabling 56 on agent server communi...

Страница 227: ...4 scheduling an update task 149 user accounts about 17 changing passwords 24 creating 23 creating permission sets for 25 user accounts continued permission sets and 17 working with 23 24 user interfac...

Страница 228: ...McAfee ePolicy Orchestrator 4 0 2 Product Guide 228 Index...

Отзывы:

Нет отзывов