McAfee ePolicy Orchestrator, Руководство пользователя, Страница: 61 / 126

58
ePolicy Orchestrator
®
3.6 Walkthrough Guide Rogue System Detection
Taking actions on detected rogue systems manually
5
For instructions, see the ePolicy Orchestrator 3.6 Product Guide .
Installing the sensor manually
If you do not want to deploy sensors from the ePolicy Orchestrator console, you can
perform the installation manually. To do so, you must be at the system you want to host
the sensor. You must also be using an account that has administrative privileges on the
system.
You can install the sensor either via a
SETUP.EXE
installation wizard or via the command
line.
For specific instructions, see the ePolicy Orchestrator 3.6 Product Guide .
Taking actions on detected rogue systems manually
You can perform actions on one or more systems listed in the
Machine List
table. For
example, you may want to deploy an agent to a detected rogue system or mark
systems for later action. In addition to these manual actions, you can configure
automatic responses that can be initiated by a detection event.
The following table lists the manual actions you can take on selected systems in the
Machine List
table. Some of these are covered in greater detail in following sections.
Table 5-4 Available manual actions
Action Description
Add to ePO tree
Adds a system node to a
Rogue System
site in the Directory. You
can place the systems into an appropriate site or group manually
after it is added to this site.
Mark for Action
Marks the detected system as a system still needing action.
Mark as Exception
Marks selected system as a machine that does not require an
agent. For example, routers and printers.
Push ePO Agent
Instructs the server to deploy an agent to the selected system.
Query ePO agent
Queries the detected system to ascertain whether there is an
agent installed on it. This query is required for systems to appear
as the
Alien Agent
rogue type.
Consider creating an automatic response that uses this action if
you have multiple ePolicy Orchestrator servers in your network.
If travellers from other parts of your organization frequently log
onto your network, they appear as rogue systems even if they
have an agent from another server.
Remove Host
Hides the detected system in the
Machine List
table but does not
delete it from the database.
Unmark for Action
Unmarks systems that you have already marked for action.
Unmark as Exception
Unmarks systems that you have already marked as exceptions.