The agent-server communication interval (ASCI) determines how often the agent calls into ePO - On-prem.
The ASCI is set on the General tab of the Trellix Agent policy page. The default setting of 60 minutes means that Trellix Agent contacts ePO - On-prem once every hour. When deciding whether to change the interval, consider that Trellix Agent performs each of the following actions at each ASCI:
Collects and sends its properties.
Sends non-priority events that have occurred since the last agent-server communication.
Receives new policies and tasks. This action might trigger other resource-consuming action based on tasks, and or schedules received.
Enforces policies.
Although these activities do not overload any one computer, several factors can cause the cumulative demand on the network, ePO - On-prem, or Agent Handlers to be significant, including:
Note
Agent Handlers are not available on McAfee ePO Cloud.
Number of systems managed by ePO - On-prem
If your organization has stringent threat response requirements
If the network or physical location of clients in relation to servers or Agent Handlers is highly distributed
If there is inadequate available bandwidth
In general, if your environment includes these variables, you want to perform agent-server communications less often. For individual clients with critical functions, you might want to set a more frequent interval.