Enable the default ePO - On-prem response rules for immediate use while you learn more about the feature.
Before enabling any of the default rules, perform these actions:
Make sure that the recipient email address is correct. This address is configured on the Actions page of the Automatic Response Builder.
Rule name | Associated events | Email sent when... |
|---|---|---|
Distributed repository update or replication failed | Distributed repository update or replication failed | Any update or replication fails. |
Malware detected | Any events from any unknown products | These criteria are met:
The email includes the source system IP address, threat names, product information, and other parameters. |
Main Repository update or replication failed | Main Repository update or replication failed | Any update or replication fails. |
Noncompliant computer detected | Noncompliant Computer Detected events | Any event is received from the Generate Compliance Event server task. |