Choose method of adding

Provides options for adding subnets to the Trellix ePO - On‑prem server, including:

• Add a single subnet — Adds individual subnets by name, network address, and network mask. Subnet names are user‑configured text strings, such as Engineering Lab 1.

• Add a list of subnets — Adds multiple subnets.

• Import a file with a list of subnets to add — Adds subnets listed in an external file.

Use the following formats when importing:

• Subnet names — Name,xxx.xxx.xxx.xxx/yy

• Subnet addresses — xxx.xxx.xxx.xxx/yy

Sensor’s detected system cache lifetime

Specifies how long detected systems remain in the sensor’s memory cache. The maximum value for this field is 168 hours, or 7 days. The default is 5 minutes.

Note: Systems in the sensor’s memory cache are not considered new detections and the software does not scan them again for their Trellix Agent.

Reporting time for active sensors

Specifies how often the active sensors report to the server and send their detected data. Type the number and click hour(s), minute(s), or second(s) in the list. The maximum value for this field is 168 hours, or 7 days. The default is 5 minutes.

Active sensor election

Specifies which method to use to determine the active sensors.

• Click Use ePO server to determine active sensors. The default method.

Note: The maximum number of active sensors is set in the server settings.

• Communication time for inactive sensors — Specify how often the inactive sensors report to the server to check whether to become active. Type the number and click minute(s) or second(s) in the list. The maximum value for this field is 1 hour. Default is 1 hour.

• Click Use Local Sensor Election to configure the sensors and election process.                        

  • Configure active sensors, either:                                

    • Type the number of active sensor(s).

    • Click to set All sensors active.

• Type Wait time for an election result and click second(s) or minute(s). The default is 300 seconds, or 5 minutes.

• Type Wait time between active sensor elections and click  second(s), minute(s), or hour(s). The default is 3,600 seconds or 1 hour.                        

Note: This section is relevant for 4.x sensors only.

• Set the multicast group to receive the active sensors. Either:                            

  • Type Ipv4 multicast group address. The default address is 239.5.6.7.                                

  • Type Ipv6 multicast group address. The default address is ff12::1.                                

Note: You might need to change one of these default addresses if another feature is using the default.

• Type the Sensor-to-Sensor communication port number. The default is port 19001.      

Actions

Specifies the actions you can take on this Detected Systems table, including:

• Choose Columns — Opens the Select the Columns to Display page. Use this page to select the columns of data to display on the Detected Subnets page.

• Export — Opens the Export page. Use this page to specify the format and the package of files to be exported. You can save or email the detected subnets.

• Detected Systems — Specifies different actions you can perform on the selected detected system, including:                        

  • Delete — Removes the selected subnets from the Detected Subnets list. Deleting subnets removes all references to them, including any rogue systems whose only interfaces are in this subnet. The next time ePolicy Orchestrator detects the systems in the deleted subnet, they are detected as new systems.

  • Ignore — Designates the selected subnets as ignored. ePolicy Orchestrator disregards ignored subnets.

  • Include — Includes the subnet in the Detected Subnets list. When a subnet has been ignored, click Include to bring it back into the Detected Subnets list.

  • Rename — Changes the name of the selected subnet.

  • View Managed Systems — Opens the Managed Systems for Subnet page. Use this page to view the systems managed by the selected subnet.

Detected Subnets Information

Specifies information about detected subnets, including:

• Contains Rogue — Specifies whether the subnet contains rogue systems.

• Covered — Indicates whether a Rogue System Sensor covers the displayed subnet.

• Ignored — Indicates whether the displayed subnet is designated as ignored.

• IP Address — Specifies the IP address of the displayed subnet.

• Subnet Mask — Specifies the subnet mask (IP address netmask) for the displayed subnet.

• Subnet Name — Specifies the name of the displayed subnet. The default name for a subnet is its IP address.

Sensor Information

Specifies the IP address of the sensor, whether it is active, its last communication time, and provides a link to the Rogue System Sensor Details page.

Actions

Specifies the actions that can be performed on selected entries in the Master Repository, including:

• Delete — Removes the selected subnets from the Detected Subnets list. Deleting subnets removes all references to them, including any rogue systems whose only interfaces are in this subnet. The next time ePolicy Orchestrator detects the systems in the deleted subnet, they are detected as new systems.

  • Ignore — Designates the selected subnets as ignored. ePolicy Orchestrator disregards ignored subnets.

  • Include — Includes the subnet in the Detected Subnets list. When a subnet has been ignored, click Include to bring it back into the Detected Subnets list.

  • Rename — Changes the name of the selected subnet.

  • View Managed Systems — Opens the Managed Systems for Subnet page.

Detected System Interfaces Information

Specifies the details of the detected system interface, including:

• Last Detected Time — Specifies the date and time of the last detection of the interface.

• IP Address — Specifies the IP address of the interface.

• IPv6 Address — Specifies the IPv6 address of the interface.

• MAC Address — Specifies the MAC address of the interface.

• Organization Name (OUI) — Specifies the manufacturer of the interface as identified by the MAC address, which includes the organizationally unique identifier.

• Organizationally Unique ID (OUI) — Specifies the portion of the MAC address that identifies the manufacturer of the device.

• Source — Specifies the source of the last detection of the interface.

Related Items

Provides links to information related to the detected system interface, including:

• Go to related Detected Subnets — Links to the Detected Subnets Details page for the subnet on which the interface is located.

• Go to related Detected Systems — Links to the Detected Systems Details page that provides details about the system associated with the interface.

Actions

Specifies the actions that can be performed on selected entries in the master repository, including:

• Add to Exceptions — Moves the selected systems to the Exceptions list. This tells ePolicy Orchestrator not to manage the system. For example, printers or routers.

• Add to System Tree — Displays the Add to System Tree page, where you can add specific systems to selected groups in your Trellix ePO - On-prem System Tree.

• Delete — Removes the selected systems from the Detected Systems list. Deleting removes all references to them. The next time ePolicy Orchestrator detects the systems, they are detected as new rogue systems.

  • Edit Comment — Opens the Edit Comment dialog box. User-supplied comments are displayed in detected system details.

  • Merge Systems — Opens the Merge Systems page. Select between two and six systems to be merged into a single detected system. Use this option to combine multiple detected systems or system interfaces into a single detected system. For example, when you have a system in your network that has multiple NICs (Network Interface Cards) that are being detected as separate systems, but have not been automatically matched and merged.

  • Query Agent — Opens the Query McAfee Agent Results page, which provides the name or IP address of the detected system and details about the agent installed on it.

  • Remove from Exceptions — Removes the selected systems from the Exceptions list. This list tells ePolicy Orchestrator to manage the systems, and returns them to their original category. For example, managed systems return to the managed category.

Additional Detail for Managed Systems

Links to the ePolicy Orchestrator System Details page for this system.

Detected System Interfaces

Specifies the detected system interface by number and details about each interface, including:

• IP Address — Specifies the IP address of the interface.

• Last Detected Time — Specifies the date and time of the last detection of the interface.

• MAC Address — Specifies the MAC address of the interface.

• Organization Name (OUI) — Specifies the manufacturer of the interface as identified by the first three digits of the MAC address, which are the organizationally unique identifier (OUI).

• Source — Specifies the source of the last detection of the interface.

Detected Systems Information

Specifies information about the detected system you are viewing, including:

• Agent GUID — Specifies the globally unique identifier (GUID) of the agent deployed to the system.

• Agent Version — Specifies the version of the agent deployed to the system.

• Canonical Name — Displays the friendly name of the system.

• Comments — Displays user comments about the system.

• Computer Name — Specifies the name of the system.

• DNS Name — Specifies the domain name of the system.

• Domain — Specifies the domain the system is on.

• McAfee ePO Server Name — Specifies the name of the Trellix ePO - On-prem server that manages this detected system.

• Exception — Specifies whether the system is marked as an exception.

• Exception Category — Specifies which exception category this system belongs to.

• Is New Detection — Specifies whether this system is a new detection.

• Last Agent Communication — Specifies the date and time of the last communication from the agent deployed to the system.

• Last Detected IP Address — Specifies the last detected IP address of the system.

  • Last Detected MAC Address — Specifies the last detected MAC address of the system.

  • Last Detected Time — Specifies the date and time of the last detection of the system.

  • Last Detected Organization Name — Specifies the organization name of the system at its last detection, for example, Dell.

  • NetBIOS Comment — Specifies the NetBIOS comment for the detected system, if any.

  • OS Family — Specifies the family of the operating system.

  • OS Platform — Specifies the operating system installed on the system.

  • OS Version — Specifies the version number of the operating system installed on the system.

  • OUI — Specifies the Organizationally Unique Identifier of the detected system. The OUI identifies the manufacturer of the detected system, for example, Dell.

  • Recorded Time — Specifies the time this system was first detected and recorded in the Trellix ePO - On-prem database.

  • Rogue Action — Specifies the action being performed on a rogue system, for example, Agent Push in Progress.

  • Rogue State — Specifies the rogue state of a detected system, for example, Inactive Agent.

  • Source — Specifies the source of the last detection of the system, such as Broadcast or DHCP.

  • Users — Specifies the users currently associated with the system as defined by the NetBIOS call, which is typically the currently logged-on user.

Show/Hide Filter

Shows or hides the filter options

Quick Find

Allows you to type search strings to find detected systems. Click Apply to perform the search.                     You can search for detected systems based on their IP address and MAC address.

Clear

Removes any text from the Quick find text entry box.

Show selected rows

Displays only the rows you have selected.

Actions

Specifies the actions you can perform on the selected rogue systems, including:

• Add to Exceptions — Allows you to optionally assign a category to each item you designate as an exception.

  • Add to System Tree — Allows you to add an item to the System Tree.

  • Choose Columns — Opens the Select the Columns to Display page. Use this to select the columns of data to display on the Server Task Log page.

  • Delete — Deletes the selected systems from the Rogue System Interfaces by Subnet table. Systems deleted from this table reappear the next time a sensor detects them.

  • Deploy Agent — Launches the Deploy Agents page, where you configure the deployment settings with which to deploy agents to the systems of the selected group.

  • Export Table — Opens the Export page. Use this page to specify the format and the package of files to be exported. You can save or email the exported file.

  • Query Agent — Displays only the rows you have selected.

Actions

Specifies the actions you can perform on detected systems, including:

• Choose Columns — Opens the Select the Columns to Display page. Use this to select the columns of data displayed in the Detected Systems page.

• Detected Systems — Specifies the actions you can perform on the selected detected systems, including:

  • Add to Exceptions — Moves the selected systems to the Exceptions list. This tells ePolicy Orchestrator not to manage the system. For example, printers or routers.

  • Add to System Tree — Displays the Add to System Tree page, where you can add specific systems to selected groups in your Trellix ePO - On‑prem System Tree.

  • Delete — Removes the selected systems from the Detected Systems list. Deleting systems removes all references to them. The next time ePolicy Orchestrator detects the systems, they are detected as new rogue systems.

  • Merge Systems — Opens the Merge Systems page. Select between 2 and 6 systems to be merged into a single detected system. Use this option to combine multiple detected systems or system interfaces into a single detected system. For example, when you have a system in your network that has multiple NICs (Network Interface Cards) that are detected as separate systems, but have not been automatically matched and merged.

  • Ping — Sends an ICMP echo to the selected system to verify that it can be reached.

  • Query Agent — Opens the Query McAfee Agent Results page, which provides the name or IP address of the detected system and details about the agent.

  • Remove from Exceptions — Removes the selected systems from the Exceptions list. This list tells ePolicy Orchestrator to manage the systems, and returns them to their original category. For example, managed systems return to the managed category.

• Rogue Sensors — Specifies the actions you can perform on the selected rogue sensor, including:

  Edit Comment — Opens the Edit Comment dialog box. User-supplied comments are displayed in Detected System details.

• Export Table — Opens the Export page. Use this page to specify the format and the package of files to be exported. You can save or email the detected subnets.

DHCP monitoring

Specifies the settings for Configuration Protocol (DHCP) monitoring. When you enable DHCP monitoring, a single sensor installed on a DHCP server can monitor all systems and subnets that it serves:

Note: This section is relevant for 4.x sensors only.

• Disabled — Select this box to disable DHCP monitoring.

• Report only systems whose IP address is inside the sensor's network — Select this box to ignore VLAN traffic. This option is overridden when DHCP monitoring is enabled.

• Enabled — Select this box to enable DHCP monitoring.

Note: DHCP monitoring is disabled by default.

Device details detection

Specifies the settings for Subnet Port Scanning, which scans the ports your network uses to detect specific information about the devices connected to it:

• Enabled — Select this box to enable device details detection and allow the sensor to scan your network ports. Then configure the following settings as needed:

  • Do not run OS detection against devices on these networks — Prevents use of OS detection to user-specified subnets. Enter a subnet’s network address and click Add To List to specify a network. Select a network from the list and click Remove From List to permit port scanning on that network.

  • Run OS detection only against devices on these networks — Limits use of OS detection to user-specified subnets. Enter a subnet’s network address and click Add To List to specify a network. Select a network from the list and click Remove From List to stop port scanning on that network.

  • Scan detected systems for OS details — Select this box to allow the sensor to scan detected systems for detailed information about a device’s operating system. Then configure the following settings as needed:

    • OS scanning interval — Specify the operating system scanning interval. Type the number and click hour(s), minute(s), or second(s) in the list. Default is 30 seconds.

    • OS scanning initial delay — Specify the operating system scanning interval delay. Type the number and click hour(s), minute(s), or second(s) in the list. The default is 60 seconds.

    • How long to cache OS data — Specify how long to cache operating system scan data. Type the number and click second(s), minute(s), hour(s), or day(s). Default is 1 day.

    • Scan systems marked as exceptions — Click to scan systems, such as routers and printers, even if they have been designated as exceptions. This setting is disabled default.

  • Use OS detection on all networks to determine detailed device information — Tells sensors to scan all subnets to discover detailed information about detected systems. This setting is the default option.

Report on self-configured subnets

Select the Enabled box to enable reporting on self-configured subnets. This setting prevents subnets that have a netmask of /32 from being ignored.

Note: This section is relevant for 4.x sensors only.

Sensor Scanning

Select Use active zero-configuration resolution to enable the sensor to send multicast DNS requests. This setting is enabled by default.

Select Use DNS queries for DNS name resolution to enable the sensor to query DNS servers for DNS names. This setting is enabled by default.

Note: This section is relevant for 5.0 sensors only.

Alternative McAfee Agent Ports

Specifies alternate ports to use when querying a detected system for a Trellix Agent.                

Matching Detected Systems

Defines the properties that determine when to match newly detected system interfaces to an existing detected system.                

Matching Managed Systems

Defines the properties that determine when to match newly detected system interfaces to an existing managed system.                

Static IP Ranges for Matching

Specifies the static IP address ranges for use when matching static IP addresses.                

Note: The IP addresses in the range can be either IPv4 or IPv6 addresses.

Last Updated

Specifies the last time Trellix ePO - On-prem server updated your OUI file.

Update from

Specifies the source used to update the OUI file, including:

• File Upload — Use this option to manually upload a text file (.txt) containing an updated OUI list. Choosing this option disables the ability to save default settings for this page.

• Server location — Specifies a location on the Trellix ePO - On-prem server that contains an updated OUI file.

• URL — Specifies a website or other resource that contains an updated OUI file.

Categories

Add new categories — Allows you to add new exception categories for detected systems.

Note: The Rogue System Sensor cannot be installed on a detected system that has been added to an exception category.

Name

Name — Displays the name of any previously configured exception categories for detected systems.

Description — Displays the description of any previously configured exception categories for detected systems.

Change — Edits the detected system exception category.

Delete — Deletes the detected system exception category.

Create and edit Rogue System information; manage Rogue Sensors

Grants the ability to deploy sensors, create and edit Trellix RSD configuration, and other data.

Create and edit Rogue System information; manage Rogue Sensors; Deploy Agents and Add to System Tree

Grants full access to Trellix RSD.                

No permissions

Grants no access to Trellix RSD. A user with this level of permissions cannot access any Trellix RSD assets.

View Rogue System information

Grants only the ability to view Trellix RSD information. A user granted this level of permissions cannot create, edit, or modify information.

Active Period

Specifies the maximum amount of time before the server asks a sensor to sleep, to allow a new sensor to become active. The maximum active period for a sensor is 24 hours (1,440 minutes).

Sensors per Subnet

Specifies the maximum number of active sensors on a subnet at any time. Active sensors report system detections and other information during their active period.

Sensor Scanning

Specifies a list of MAC addresses or OUIs that sensors do not scan, regardless of the sensor's policy.

For version 5.0 sensors, you can add a list of IP addresses or subnet masks that sensors do not scan actively. The sensor does not scan these systems regardless of the sensor's policy settings.

Sensor Timeout

Specifies the maximum amount of time a sensor can be out of contact before being designated as missing. The maximum sensor timeout period is 7 days (168 hours or 10,080 minutes).

Server Settings Revision ID

Specifies the revision number of the setting. The ID is incremented every time the Server Settings are saved.

Target systems

Displays the names of the systems that were selected when you clicked Deploy Agents.

Agent version

Specifies the version of the agent to send and install on the selected systems. Agent versions that are available depends on which agent installation packages are checked in to the Master Repository.

Installation options

Specifies the agent installation options available, including:

• Install only on systems that do not have an agent — Sends the agent installation package only to systems without an agent installed. When deselected, sends the agent installation package to all selected systems, regardless of whether the agent is already installed on them.

• Force installation over existing version — Replaces existing agents in the selected group with the selected versions. This option is not available when you select Install only on systems that do not have an agent.

Installation path

Specifies the path on the client system (default is <system_drive>\McAfee\Common Framework) where you want to install the agent. The location you specify must exist on managed systems.

Credentials for agent installation

Specifies the domain name, user name, and password of the user account with which to install the agent on selected systems.

Number of attempts

Specifies the number of deployment attempts before it quits. Type 0 for continuous attempts.

Retry interval

Specifies the interval in seconds between deployment attempts.

Abort after

Specifies the number of minutes after the start of the agent deployment before the deployment quits.

Import Exceptions tab

Choose method of Importing — Specifies the method used for importing systems to the exceptions category in different formats, including:

• By Text — Imports exceptions by MAC address. Format MAC addresses using unseparated hexadecimal characters, colons, or hyphens. For example, xx:xx:xx:xx:xx:xx.

• By File — Files imported must be formatted as a single column list of MAC addresses.

Export Exceptions tab

Exporting — Exports a list of systems, categorized as exceptions, to a file.

Systems to Add

Specifies the detected systems that you have selected to be added to the System Tree.

System Tree Location

Specifies the location on the System Tree where you want to add the selected systems. Click Browse to open the Select System Tree Group dialog box, which allows you to navigate to the location where you want to add the selected systems.

Duplicate System Names

Allows duplicate entries to be added to the System Tree. For example, you might have two systems with the same name. Allowing duplicate entries permits you to add the system with the duplicate name to the System Tree.

Apply Tag

Applies tag names that are used for sorting systems on your network.

• Server

• Workstation

Assign Policy

Opens the Assign Policy page for the selected systems.

Change Sorting Status

Allows you to disable or enable System Tree sorting on the selected systems.

Clear Tag

Removes previously applied tags from the selected systems.

Delete

Removes the selected systems from the Detected Systems list. Deleting systems removes all references to them from the Trellix ePO - On-prem database. The next time ePolicy Orchestrator detects the systems, they are detected as new systems.

Edit Description

Allows you to edit the user-defined description of the selected systems.

Exclude Tag

Specifies system tags that can be used to exclude groups of systems when sorting.

• Server

• Workstation

Export Systems

Exports the selected systems to an external file.

Filter

Specifies which managed systems in this subnet are shown in the table.

• In Blacklist — Shows the managed systems in this subnet listed in the Sensor Blacklist.

• Show All — Shows all managed systems in this subnet.

• With Sensors — Shows the managed systems in this subnet with sensors installed.

• Without Sensors — Shows the managed systems in this subnet without sensors installed.

Modify Policies on a Single System

Opens the Policy Assignment page for the selected system.

Modify Tasks on a Single System

Opens the Client Tasks page for the selected system.

Move Systems

Opens the Select the New Group page to move the selected systems.

Options

Specifies the available options.

• Choose Columns — Choose the columns of data to display on the Covered Subnets page.

• Export Table — Exports the table of data to a user-specified format and location.

Show Agent Log

Opens the Agent Log page.

Sort Now

Sorts the selected systems according to their tags.

Test Sort

Performs a test sort on the selected systems, and opens the Test Sort page.

Agent GUID

Specifies the globally unique identifier (GUID) of the agent deployed to the system.

Canonical Name

Displays the friendly name of the system. The friendly name of a system is the least complex unique name available to identify the system. For example, a DNS name is less complex than an MAC address. Therefore, the DNS name is displayed instead of the MAC address, if it is available.

Close

Cancels the merge operation and reopens the previous page.

Comments

Displays user comments about the system.

Computer Name

Specifies the name of the system.

DNS Name

Specifies the domain name of the system.

Domain

Specifies the domain the system is on.

Exception

Specifies whether the system is selected as an exception.

Ignored

Specifies whether the system has been ignored.

Last Detected IP Address

Specifies the last detected IP address of the system.

Last Detected IPv6 Address

Specifies the last detected IPv6 address of the system.

Last Detected MAC Address

Specifies the last detected MAC address of the system.

Last Detected Time

Specifies the date and time of the last detection of the system.

Merge

Merges the systems detailed in the Source System columns into one detected system, with the details listed in the Target System column.

NetBIOS Comment

Specifies the NetBIOS comment for the detected system.

OS Family

Specifies the family of the operating system.

OS Platform

Specifies the operating system installed on the system.

OS Version

Specifies the version number of the operating system installed on the system.

Users

Specifies the user logged on to the system at the last detected time.

Rogue System Sensor

Enables sensors when they are deployed.

Server name or IP address

Specifies the name or IP address of the system where your Trellix ePO - On-prem server is installed. Trellix RSD treats agents managed by any other Trellix ePO - On-prem server as alien agents. Therefore, the systems where those alien agents are deployed are identified as rogue systems. The default value in this field is the IP address of the system where Trellix RSD is installed. When changing this value, use standard IP address format (xxx.xxx.xxx.xxx), DNS name, or the FQDN.

Log File Settings

Specifies whether the software logs only messages with Error and Critical priority or logs all messages.

Note: This section is relevant for 5.0 sensors only.

Policy Revision ID

Specifies the revision number of the policy, which is incremented every time you save the policy.

Note: This section is relevant for 5.0 sensors only.

Choose method of importing

Specifies the method for importing systems into the Rogue Sensor Blacklist, including:

• Manually add systems to the Sensor Blacklist — Specifies whether to add systems manually by system name, with each system separated by a new line. System names must be formatted as standard system names, for example, xx-100.                    

• Import file with list of systems to add to the Sensor Blacklist — Specifies whether to add systems by uploading a text file containing a list of system names. The list separates each system by a new line.            

Initial Interface Binding

Select this box to tell sensors to listen only to the interfaces whose IP addresses were present at the time of installation.

Listen only on interfaces with IP addresses in these networks

Tells sensors to listen to interfaces only in user-specified networks. Type a network address and click Add To List to specify a network. Select a network from the list and click Remove From List to stop listening to interfaces on that network. IP addresses must use standard IP address format followed by the two-digit Classless Inter-Domain Routing (CIDR) that specifies the subnet mask.

Do not listen on interfaces with IP addresses in these networks

Tells sensors not to listen to interfaces in user-specified networks. Type a network address and click Add To List to specify a network. Select a network from the list and click Remove From List to allow sensors to listen to interfaces on that network. IP addresses must use standard IP address format followed by the two-digit CIDR number that specifies the subnet mask.

Exceptions

Specifies the number of systems on your network that are designated as exceptions. Exceptions are systems that you don’t want ePolicy Orchestrator to manage.

Import/Export Exceptions

Displays the Import and Export Exceptions page.

Inactive

Specifies the number of systems on your network identified as rogues not detected by a sensor in a specified time period.

Managed

Specifies the number of systems on your network that ePolicy Orchestrator manages.

Rogue

Specifies the number of systems on your network that ePolicy Orchestrator does not manage.

Detected System

Specifies the names of systems on which the Trellix Agent query was performed.

Agent Details

Specifies details about the agents deployed to selected detected systems, including:                

• Computer Name — Specifies the name of the system the agent is deployed to.

• Trellix ePO Server Name — Specifies the name of the server that the agent reports to.

• Agent Version — Specifies the version of the agent deployed to the system.

• Agent GUID — Specifies the globally unique identifier (GUID) of the agent deployed to the system.

When the query is unsuccessful, you can click Retry, which performs another query on this agent.

Rogue Sensor Blacklist Information

Provides information about the selected system on the Rogue Sensor Blacklist, including:

• Agent GUID — Specifies the globally unique identifier (GUID) of the agent deployed to the system.

• Computer Name — Specifies the name of the system.

• DNS Name — Specifies the domain name of the system.

• Domain — Specifies the domain the system is on.

• IP Address — Specifies the IP address of the system.

• MAC Address — Specifies the MAC address of the system.

Actions

Specifies the actions you can perform on the system, including:

• Remove — Removes the system from the Rogue Sensor Blacklist.

Show/Hide Filter

Shows or hides the filter options.

Show selected rows

Select this box to display only the rows you have selected.

Selected Row Actions

Specifies the actions that can be performed on selected systems in the Rogue Sensor Blacklist, including:

• Remove — Removes the selected systems from the sensor blacklist and returns them to their previous category. For example, if you add a managed system to the Rogue Sensor Blacklist, the software returns it to the Managed list when you remove it from the blacklist.

Table Actions

Specifies the actions that you can perform on the Rogue Sensor Blacklist page, including:

• Choose Columns — Choose the columns of data to display on the Rogue Sensor Blacklist page.

• Export Table — Exports the table of data to a user-specified format and location

• Rogue Sensor — Specifies actions you can take on the Rogue Sensor Blacklist.                        

  • Export Blacklist — Downloads a list of the systems in the Rogue Sensor Blacklist table in XML format.

  • Import Blacklist — Opens the Import Sensor Blacklist page, where you can import systems to the sensor blacklist manually by adding system names, or by selecting a file to import.

Action

Specifies the actions that you can perform on this sensor, including:

• Delete Sensor — Removes the sensor from the system.

• Edit Description — Changes the description of the Rogue System Sensor.

Rogue System Sensor Information

Specifies details about the Rogue System Sensor installed on this system, including:

• Agent GUID — Specifies the globally unique identifier (GUID) of the agent deployed to the system.

• Computer Name — Specifies the name of the system this sensor is installed on.

• Description — Specifies a user-defined description.

• Installed — Specifies whether this sensor is installed.

• Last Communication Time — Specifies the date and time of the last communication from the agent deployed to the system.

• Sensor Name — Specifies the name of the sensor.

• Sensor Type — Specifies the type of sensor.

• Sensor Version — Specifies the version number of the sensor on this system.

• Status — Specifies the status of this sensor. For example, Missing.

Sensor's Managed System Information

Specifies the name of the system where the sensor is installed, and links to the ePolicy Orchestrator system details for the system.

Sensor's Subnet Information

Specifies information about systems detected by the sensor, including:

• Covered — Specifies the detected system coverage.

• Ignored — Specifies whether the detected system is ignored.

• IP Address — Specifies the detected system IP address.

• Subnet Mask — Specifies the detected system subnet mask.

Selected Row Actions

Specifies the actions that you can perform on Rogue System Sensors, including:

• Delete Sensor — Removes the selected sensor from the system it is installed on.

• Edit Description — Changes the user-defined description of the Rogue System Sensor.

Table Actions

Specifies the available options, including:

• Choose Columns — Choose the columns of data to display on the Rogue System Sensor page.

• Rogue System Sensor Export Table — Exports the table of data to a user-specified format and location.

Add Subnet

Displays the Add Subnet page.

Contains Rogues

Specifies the number of covered subnets on your network that contain rogue systems.

Covered

Specifies the number of subnets on your network that are covered. Covered subnets have 2 active sensors.

Uncovered

Specifies the number of subnets on your system that do not have two active sensors.

Ignore

Designates as ignored the highlighted subnet in the Top 25 Subnets list. ePolicy Orchestrator does not monitor ignored subnets.

Selected Row Actions

Specifies the actions that can be performed on entries in Rogue System Interface by Subnet table, including:

• Add to Exceptions — Moves the selected rogue systems to the Exceptions list. Check the box next to a system to enable this button.

• Add To System Tree — Displays the Add To System Tree page.

• Query Agent — Opens the Query McAfee Agent Results page, which provides the name or IP address of the detected system and details about the agent installed on it.

Table Actions

Specifies the actions you can take on the Top 25 Subnets table, including:

• Choose Columns — Choose the columns of data to display on the Covered Subnets page.

• Export Table — Exports the table of data to a user-specified format and location.