Before you plan the implementation for Automatic Responses, understand how this feature works with the System Tree.
Note
This feature does not follow the inheritance model used when enforcing policies.
Automatic Responses use events that occur on systems in your environment and configured response rules. These rules are associated with the group that contains the affected systems and each parent above it. When an event occurs, it is delivered to the server. If the conditions of a rule are met, designated actions are taken.
This design allows you to configure independent rules at different levels of the System Tree.
These rules can have different:
Thresholds for sending a notification message. For example, an administrator of a particular group wants to be notified if viruses are detected on 100 systems in 10 minutes. But an administrator does not want to be notified unless viruses are detected on 1,000 systems in the whole environment in the same amount of time.
Recipients for the notification message. An administrator for a particular group might want to be notified only if a specified number of virus detection events occur in the group. Or, an administrator wants each group administrator to be notified if a specified number of virus detection events occur in the whole System Tree.
System Tree location does not filter server events.