Set up an automatic response in ePO - On-prem that is filtered to see only policy events.
Select → → to open the Automatic Responses page.
Click New Response.
Enter a Name for the response, and an optional Description.
Select ePO Notification Events for the Event group, and Client, Threat, or Server for the Event type.
Click Enabled to enable the response, then click Next.
From Available Properties, select Event Description.
Click ... in the Event Description row and choose an option:
Agent failed to collect properties for any point products — This event is generated and forwarded when a property collection failure first occurs. A subsequent success event is not generated. Each failing managed product generates a separate event.
Agent failed to enforce policy for any point products — This event is generated and forwarded when a policy enforcement failure first occurs. A subsequent success event is not generated. Each failing managed product generates a separate event.
Enter remaining information into the filter as needed, then click Next.
Select Aggregation, Grouping, and Throttling options as needed.
Choose an action type and enter a behavior depending on the action type, then click Next.
Review the summarized response behavior. If correct, click Save.
The automatic response performs the described action when a policy event occurs.