McAfee ePolicy Orchestrator, Руководство пользователя

Страница: 12 / 126

9
ePolicy Orchestrator
®
3.6 Walkthrough Guide Introduction
Policy, properties, and events
1
Policy, properties, and events
Two main purposes of ePolicy Orchestrator are to enforce policies on the managed
systems, and to receive and process properties and events from all of the managed
systems.
Policies
A policy is a set of software configurations. The set of options differs depending on the
product and system you are managing. For example, a policy for VirusScan Enterprise
includes the configuration options for the On-Access Scanner and the On-Demand
Scanner. You can set these configuration options differently for different systems.
Policies are the security product configurations that you want to ensure each site,
group, or individual systems have. Policies are enforced during the policy enforcement
interval. This interval is set to five minutes by default. Therefore, anytime an end user
changes the settings on the system, the settings are returned to those set in the policy
within five minutes.
New to version 3.6 is the ability to create named policies, that you can assign to
independent locations of the Directory.
Properties
Properties are collected from each system by the installed agent. These include:
„
System information (system name, memory available, etc.).
„
Information from installed ePolicy Orchestrator-managed security products (for
example, VirusScan Enterprise).
Events
When a threat or compliance issue on a system is recognized by an installed and
managed security product, an event file is created by the product that the agent
delivers to the server to be processed. These events are processed and stored in the
database.
Events are processed by event parser and applied to the notification rules or ePolicy
Orchestrator Notifications. Notifications is a feature that allows you to configure rules
to alert you to events in your network.
If the event triggers a notification rule, any of the following can happen depending on
the rule’s configurations:
„
Notification messages are sent to specified recipients.
„
Actions, such as agent deployment, can be taken against the system.
„
Specified registered executables can be launched.