McAfee ePolicy Orchestrator, Руководство пользователя, Страница: 58 / 126

55
ePolicy Orchestrator
®
3.6 Walkthrough Guide Rogue System Detection
5
Machine status and rogue type
Machine status and rogue type are classifications ePolicy Orchestrator uses to
determine which systems are rogue systems. Each detected system is listed in the
Machine List
table with a status and, if classified as a rogue system, a rogue type. These
classifications are very useful for grouping systems in the
Machine List
table. You can
also use status and rogue type as criteria for automatic responses.
Machine status for detected systems
Each detected system has a basic status of
Managed
,
Rogue
,
Exception
, or
Inactive
. This
status is displayed in the
Status
column of the
Machine List
table.
Types of rogue systems
Systems with a status of
Rogue
or
Inactive
also are assigned a rogue type. These may be
systems that are not listed in the database, but are also not necessarily true rogue
systems at a given point in time. Rogue types allow you to define what exactly is a
rogue system in your network.
For example, a new system may have just logged onto the network. This system had
an agent installed with a network login script at its initial logon. Since the initial agent
call to the server may take up to ten minutes, the rogue system sensor detects the
system before the agent communicates with the server and is added to the database
as a managed system. The system is classified as a rogue system, even though it is not
really a rogue system because it already has an agent. If you configure automatic
responses or automatic e-mail alerts for rogue detections, specifying a reasonable
grace period using the
Rogue (Grace Period)
rogue type can help you minimize false
positive detections.
Table 5-1 Types of machine status
Machine Status Description
Managed
A system that has an active agent installed and running. The vast
majority of systems in the
Machine List
table should have this
status.
Rogue
A system that does not have an agent on it.
Exception
A system you have identified as an exception. An exception is a
piece of network equipment, such as a network router, switch, or
printer, that you know does not require an agent.
Inactive
A system that is listed in the ePolicy Orchestrator database but has
not been detected by a rogue system sensor in a configurable time
period. These are mostly likely systems that are shut down or
disconnected from the network.