McAfee EPOCDE-AA-BA - ePolicy Orchestrator - PC User manual

Product Guide
McAfee® ePolicy Orchestrator® 4.6.0
Software

COPYRIGHT
Copyright © 2011 McAfee, Inc. All Rights Reserved.
No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by
any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.
TRADEMARK ATTRIBUTIONS
AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCE EXCHANGE),
MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN, WEBSHIELD are registered
trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of
McAfee brand products. All other registered and unregistered trademarks herein are the sole property of their respective owners.
LICENSE INFORMATION
License Agreement
NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS
FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU
HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR
SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A
FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET
FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF
PURCHASE FOR A FULL REFUND.
2McAfee® ePolicy Orchestrator® 4.6.0 Software Product Guide

Contents
Preface 11
About this guide ..................................11
Audience ..................................11
Conventions .................................11
What's in this guide .............................12
Finding product documentation ............................12
Introducing McAfee ePolicy Orchestrator Software
version 4.6.0
1Introducing McAfee ePolicy Orchestrator Software version 4.6.0 15
What is ePolicy Orchestrator software ......................... 15
Components and what they do ............................16
How the software works ...............................17
How to navigate the ePolicy Orchestrator interface ....................18
About the ePolicy Orchestrator navigation Menu ..................18
About the navigation bar ............................19
2Planning your ePolicy Orchestrator configuration 21
About scalability ..................................21
When to use multiple ePolicy Orchestrator servers .................21
When to use multiple remote Agent Handlers ...................22
Server configuration overview ............................ 22
Setting up and configuring your ePolicy Orchestrator
server
3Configuring essential features 27
About essential features ...............................27
Using the Guided Configuration to configure essential features ...............28
4Configuring general server settings 31
About general server settings ............................ 31
Configuring general server settings .......................... 31
Allowing agent deployment credentials to be cached ................31
Specifying default dashboards and dashboard refresh intervals ............32
Determining which events are forwarded to the server ................32
Choosing an ePO Notification Event interval ....................33
Configuring settings for global updates ......................33
Providing a license key ............................34
Creating a custom login message ........................34
McAfee Labs Security Threats ......................... 34
Controlling unsupported product policy visibility ..................35
Changing agent communication ports ......................36
McAfee® ePolicy Orchestrator® 4.6.0 Software Product Guide 3

Configuring the template and location for exported reports ..............36
Using a proxy server .............................36
SSL certificates ............................... 37
Enabling System Tree sorting on the server ....................39
ePolicy Orchestrator server settings categories and their descriptions ......... 39
5Creating user accounts 43
About user accounts ................................ 43
Global administrators .............................43
Working with user accounts ............................. 44
Creating user accounts ............................44
Editing user accounts .............................44
Deleting user accounts ............................ 45
6Setting up permission sets 47
How users, groups, and permission sets fit together ....................47
Working with permission sets .............................49
Creating a new permission set .........................49
Modifying an existing permission set .......................50
Duplicating a permission set ..........................50
Exporting permission sets ...........................50
Importing permission sets ...........................51
Removing a permission set ...........................51
Deleting permission sets ............................51
7Configuring advanced server settings 53
Configuring Active Directory user login .........................53
Managing ePolicy Orchestrator users with Active Directory ..............53
Configuring Windows authentication and authorization ................56
Authenticating with certificates ............................58
When to use certificate authentication ......................58
Configuring ePolicy Orchestrator for certificate authentication .............58
Uploading server certificates ..........................59
Removing server certificates ..........................59
Configuring users for certificate authentication ...................60
Problems with certificate authentication ......................60
Configuring Rogue System Detection server settings ................... 61
Configuring server settings for Rogue System Detection ...............61
Managing security keys ...............................64
Security keys and how they work ........................64
Master repository key pair ...........................65
Agent-server secure communication (ASSC) keys ..................67
Backing up and restoring keys .........................71
Configuring source and fallback sites ..........................73
Working with source and fallback sites ......................73
8Setting up repositories 77
Repository types and what they do .......................... 78
Types of distributed repositories .........................79
Repository branches and their purposes ..................... 80
Repository list file and its uses .........................81
How repositories work together ............................82
Ensuring access to the source site ...........................82
Configuring proxy settings ...........................83
Configuring proxy settings for the McAfee Agent ..................83
Configuring proxy settings for McAfee Labs Security Threats .............84
Contents
4McAfee® ePolicy Orchestrator® 4.6.0 Software Product Guide

Using SuperAgents as distributed repositories ......................84
Creating SuperAgent repositories ........................85
Selecting which packages are replicated to SuperAgent repositories ..........86
Deleting SuperAgent distributed repositories ....................86
Creating and configuring FTP, HTTP, and UNC repositories ................. 86
Creating a folder location on an FTP, HTTP server or UNC share ............87
Adding the distributed repository to ePolicy Orchestrator ...............87
Avoiding replication of selected packages .....................89
Disabling replication of selected packages .....................89
Enabling folder sharing for UNC and HTTP repositories ................90
Editing distributed repositories .........................90
Deleting distributed repositories .........................90
Using local distributed repositories that are not managed ................. 91
Working with the repository list files ..........................92
Exporting the repository list SiteList.xml file ....................92
Exporting the repository list SiteMgr.xml file for backup or use by other servers ..... 93
Importing distributed repositories from the SiteMgr.xml file ..............93
Importing source sites from the SiteMgr.xml file ..................93
Changing credentials on multiple distributed repositories ..................94
9Setting up registered servers 95
Registering servers .................................95
Registering McAfee ePO servers .........................95
Registering LDAP servers ........................... 97
Registering SNMP servers ...........................98
Registering a database server ......................... 99
10 Setting up Agent Handlers 101
Agent Handlers and what they do ...........................101
How Agent Handlers work ..............................101
Handler groups and priority .............................102
Working with Agent Handlers ............................103
Assigning agents to Agent Handlers .......................103
Managing Agent Handler assignments ......................104
Setting up Agent Handler groups ........................104
Managing Agent Handler groups ........................105
Moving agents between handlers ........................105
11 Other important server information 109
About Internet Protocols in managed environment ...................109
Exporting objects from ePolicy Orchestrator ......................110
Importing items into ePolicy Orchestrator .......................110
Exporting objects and data from your ePolicy Orchestrator server ..............111
ePolicy Orchestrator Log Files ............................112
The Audit Log ...............................112
The Server Task log .............................114
The Threat Event Log ............................116
Managing your network security with your ePolicy
Orchestrator server
12 Organizing the System Tree 121
The System Tree structure .............................121
Considerations when planning your System Tree .....................123
Administrator access .............................123
Environmental borders and their impact on system organization ...........124
Contents
McAfee® ePolicy Orchestrator® 4.6.0 Software Product Guide 5

Subnets and IP address ranges ........................124
Tags and systems with similar characteristics ...................124
Operating systems and software ........................125
Tags and how they work ..............................125
Active Directory and NT domain synchronization .....................126
Active Directory synchronization ........................126
NT domain synchronization ..........................127
Criteria-based sorting ...............................128
How settings affect sorting ..........................129
IP address sorting criteria ...........................129
Tag-based sorting criteria ...........................130
Group order and sorting ...........................130
Catch-all groups ..............................130
How a system is added to the System Tree when sorted .................130
Working with tags .................................132
Creating tags with the Tag Builder .......................132
Excluding systems from automatic tagging ....................133
Applying tags to selected systems .......................133
Applying criteria-based tags automatically to all matching systems ..........133
Creating and populating groups ...........................135
Creating groups manually ...........................136
Adding systems manually to an existing group ..................137
Exporting systems from the System Tree .....................138
Importing systems from a text file .......................138
Sorting systems into criteria-based groups ....................140
Importing Active Directory containers ......................142
Importing NT domains to an existing group ....................144
Synchronizing the System Tree on a schedule ...................146
Updating the synchronized group with an NT domain manually ............147
Moving systems manually within the System Tree ....................147
Transferring systems between McAfee ePO servers ....................148
13 Working with the agent from the McAfee ePO server 149
Agent-server communication ............................149
Agent-server communication interval ......................150
Agent-server communication interruption handling ................150
Wake-up calls and tasks ...........................151
SuperAgents and broadcast wake-up calls ....................151
SuperAgent caching and communication interruptions ...............152
Viewing agent and product properties .........................153
Responding to policy events .............................153
Running client tasks immediately ...........................154
Sending manual wake-up calls to systems .......................155
Sending manual wake-up calls to a group .......................155
Locate inactive agents ...............................156
Queries provided by McAfee Agent ..........................156
Windows system and product properties reported by the agent ...............157
14 Using the Software Manager to check in software 159
What's in the Software Manager ...........................159
Checking in, updating, and removing software using the Software Manager ..........160
15 Using policies to manage products and systems 163
Policy management ................................163
Policy application .................................165
How policy assignment rules work ..........................166
Contents
6McAfee® ePolicy Orchestrator® 4.6.0 Software Product Guide

Policy assignment rule priority .........................166
About user-based policy assignments ......................167
About system-based policy assignments .....................168
Using tags to assign system-based policies ....................168
Working with policy assignment rules ......................169
Creating Policy Management queries .........................170
Working with the Policy Catalog ...........................171
Creating a policy from the Policy Catalog page ..................172
Duplicating a policy on the Policy Catalog page ..................172
Editing a policy’s settings from the Policy Catalog .................173
Renaming a policy from the Policy Catalog ....................173
Deleting a policy from the Policy Catalog .....................173
Working with policies ................................173
Configuring agent policies to use a distributed repository ..............174
Changing the owners of a policy ........................175
Moving policies between McAfee ePO servers ...................175
Assigning a policy to a group of the System Tree .................176
Assigning a policy to a managed system .....................177
Assigning a policy to multiple managed systems within a group ...........177
Enforcing policies for a product on a group ....................178
Enforcing policies for a product on a system ...................178
Copying and pasting assignments .......................179
Viewing policy information .............................180
Viewing groups and systems where a policy is assigned ...............181
Viewing the settings of a policy ........................181
Viewing policy ownership ...........................182
Viewing assignments where policy enforcement is disabled .............182
Viewing policies assigned to a group ......................182
Viewing policies assigned to a specific system ...................183
Viewing a group’s policy inheritance .......................183
Viewing and resetting broken inheritance ....................183
Sharing policies among McAfee ePO servers ......................183
Setting up policy sharing for multiple McAfee ePO servers ..............184
Frequently asked questions .............................185
16 Using tasks to manage products and systems 187
Deployment packages for products and updates .....................187
Product and update deployment ...........................189
First time product and update deployment overview ...................189
Server tasks and what they do ...........................190
Global updating ...............................190
Pull tasks .................................192
Replication tasks ..............................193
Deploying update packages with pull and replication tasks ..............194
Allowed Cron syntax when scheduling a server task ................198
About the pull and replication task information in the Server Task log .........199
Client tasks and what they do ............................199
How the Client Task Catalog works .......................200
Deployment tasks ..............................200
Update tasks ................................203
Working with client tasks ...........................204
Confirming that clients are using the latest DAT files ...................205
Evaluating new DATs and engines before distribution ...................206
17 Managing packages and extensions manually 207
Bringing products under management .........................207
Contents
McAfee® ePolicy Orchestrator® 4.6.0 Software Product Guide 7

Checking in packages manually ...........................207
Deleting DAT or engine packages from the master repository ...............208
Manually moving DAT and engine packages between branches ...............208
Checking in engine, DAT and ExtraDAT update packages manually .............209
18 Responding to events in your network 211
About using Automatic Responses ..........................212
Automatic Responses and how it works ........................212
Throttling, aggregation, and grouping ......................213
Default rules ................................213
Planning .....................................214
Determining how events are forwarded ........................214
Determining which events are forwarded immediately ...............215
Determining which events are forwarded .....................215
Configuring Automatic Responses ...........................216
Assigning permission sets to access Automatic Responses ..............216
Working with SNMP servers ..........................217
Working with registered executables and external commands ............220
Creating and editing Automatic Response rules .....................222
Describing the rule .............................222
Setting filters for the rule ...........................223
Setting thresholds of the rule .........................223
Configuring the action for Automatic Response rules ................224
Frequently asked questions .............................226
Monitoring and reporting on your network security status
19 Monitoring with Dashboards 229
Working with dashboards ..............................229
Creating dashboards .............................230
Adding monitors to dashboards ........................230
Removing monitors from dashboards ......................231
Duplicating dashboards ............................231
Deleting dashboards .............................232
Importing dashboards ............................232
Exporting dashboards ............................232
Changing the system default dashboard .....................233
Assigning permissions to dashboards ......................233
Working with dashboard monitors ..........................234
Configuring dashboard monitors ........................234
Moving and resizing dashboard monitors .....................235
Default dashboards and their monitors ........................235
20 Querying the database and reporting on system status 239
Query and report permissions ............................240
About queries ..................................240
Query Builder ................................242
Working with queries ................................243
Creating custom queries ...........................243
Running an existing query ..........................244
Running a query on a schedule .........................245
Creating a query group ............................245
Moving a query to a different group .......................246
Duplicating queries .............................246
Deleting queries ..............................246
Exporting a query ..............................247
Contents
8McAfee® ePolicy Orchestrator® 4.6.0 Software Product Guide

Importing a query ..............................247
Exporting query results to other formats .....................248
Multi-server rollup querying .............................249
Creating a Rollup Data server task .......................249
Creating a query to define compliance ......................250
Generating compliance events .........................250
About reports ...................................251
Structure of a report .............................251
Working with reports ................................252
Creating a new report ............................253
Editing an existing report ...........................253
Viewing report output ............................258
Grouping reports together ..........................258
Running reports ...............................259
Configuring Internet Explorer 8 to automatically accept McAfee ePO downloads .....259
Running a report with a server task .......................260
Exporting reports ..............................260
Importing reports ..............................261
Deleting reports ...............................261
Using database servers ...............................261
Working with database servers ............................262
Modifying a database registration ........................262
Removing a registered database ........................262
21 Detecting Rogue Systems 265
What are rogue systems ..............................265
Rogue System Detection states ........................266
Rogue Sensor Blacklist ............................269
Rogue System Detection policy settings .....................269
Rogue System Detection permission sets .....................271
How the Rogue System Sensor works .........................272
Passive listening to layer-2 traffic ........................272
Intelligent filtering of network traffic ......................272
Data gathering and communications to the server .................273
Systems that host sensors ..........................273
How detected systems are matched and merged ....................274
Working with detected systems ...........................274
Configuring Rogue System Detection policy settings ................275
Adding systems to the Exceptions list ......................276
Adding systems to the Rogue Sensor Blacklist ..................277
Adding detected systems to the System Tree ...................277
Editing system comments ...........................277
Exporting the Exceptions list ..........................278
Importing systems to the Exceptions list .....................278
Merging detected systems ..........................278
Pinging a detected system ..........................279
Querying detected system Agents .......................279
Removing systems from the Detected Systems list .................279
Removing systems from the Exceptions list ....................280
Removing systems from the Rogue Sensor Blacklist ................280
Viewing detected systems and their details ....................280
Working with sensors ...............................280
Installing sensors ..............................281
Editing sensor descriptions ..........................283
Removing sensors ..............................283
Working with subnets ...............................284
Contents
McAfee® ePolicy Orchestrator® 4.6.0 Software Product Guide 9

Adding subnets ...............................284
Deleting subnets ..............................285
Ignoring subnets ..............................285
Including subnets ..............................285
Renaming subnets ..............................286
Viewing detected subnets and their details ....................286
Rogue System Detection command-line options .....................286
Default Rogue System Detection queries ........................287
22 Managing Issues and Tickets 289
Issues and how they work .............................290
Working with issues ................................290
Creating basic issues manually .........................290
Configuring responses to automatically create issues ................291
Managing issues ..............................294
Purging closed issues ...............................295
Purging closed issues manually ........................295
Purging closed issues on a schedule .......................295
Tickets and how they work .............................296
Ways to add tickets to issues .........................296
Assignment of ticketed issues to users .....................296
How tickets and ticketed issues are closed ....................296
Benefits of adding comments to ticketed issues ..................297
How tickets are reopened ...........................297
Ticketed issue synchronization .........................297
Integration with ticketing servers ...........................297
Considerations when deleting a registered ticketing server .............298
Required fields for mapping ..........................298
Sample mappings ..............................298
Working with tickets ................................301
Adding tickets to issues ............................301
Synchronizing ticketed issues .........................302
Synchronizing ticketed issues on a schedule ...................302
Working with ticketing servers ............................302
Installing extensions for ticketing server .....................303
Registering and mapping a ticketing server ....................305
Configuring the field mappings .........................306
Upgrading a registered ticketing server ........................308
AAppendix: Maintaining ePolicy Orchestrator Databases 311
Perform regular maintenance of SQL Server databases ..................311
Backup and restore ePolicy Orchestrator databases ...................312
Changing SQL Server information ..........................312
Index 315
Contents
10 McAfee® ePolicy Orchestrator® 4.6.0 Software Product Guide

Preface
This guide provides the information you need to configure, use, and maintain your McAfee product.
Contents
About this guide
Finding product documentation
About this guide
This information describes the guide's target audience, the typographical conventions and icons used
in this guide, and how the guide is organized.
Audience
McAfee documentation is carefully researched and written for the target audience.
The information in this guide is intended primarily for:
•Administrators — People who implement and enforce the company's security program.
•Users — People who use the computer where the software is running and can access some or all of
its features.
•Security officers — People who determine sensitive and confidential data, and define the
corporate policy that protects the company's intellectual property.
•Reviewers — People who evaluate the product.
Conventions
This guide uses the following typographical conventions and icons.
Book title or Emphasis Title of a book, chapter, or topic; introduction of a new term; emphasis.
Bold Text that is strongly emphasized.
User input or Path Commands and other text that the user types; the path of a folder or program.
Code A code sample.
User interface Words in the user interface including options, menus, buttons, and dialog
boxes.
Hypertext blue A live link to a topic or to a website.
Note: Additional information, like an alternate method of accessing an option.
Tip: Suggestions and recommendations.
McAfee® ePolicy Orchestrator® 4.6.0 Software Product Guide 11

Important/Caution: Valuable advice to protect your computer system,
software installation, network, business, or data.
Warning: Critical advice to prevent bodily harm when using a hardware
product.
What's in this guide
This guide is organized to help you find the information you need.
It's divided into functional parts intended to support the goals you need to accomplish when using
your McAfee ePolicy Orchestrator (McAfee ePO™) software. Each part is then further divided into
chapters that group relevant information together by feature and associated tasks, so you can go
directly to the topic you need to successfully accomplish your goals.
Finding product documentation
McAfee provides the information you need during each phase of product implementation, from
installation to daily use and troubleshooting. After a product is released, information about the product
is entered into the McAfee online KnowledgeBase.
Task
1Go to the McAfee Technical Support ServicePortal at http://mysupport.mcafee.com.
2Under Self Service, access the type of information you need:
To access... Do this...
User documentation 1Click Product Documentation.
2Select a Product, then select a Version.
3Select a product document.
KnowledgeBase • Click Search the KnowledgeBase for answers to your product questions.
• Click Browse the KnowledgeBase for articles listed by product and version.
Preface
Finding product documentation
12 McAfee® ePolicy Orchestrator® 4.6.0 Software Product Guide

Introducing McAfee ePolicy
Orchestrator Software version
4.6.0
Get familiar with what ePolicy Orchestrator software is, the components of
the software, and how they protect your environment. Then, review the
configuration process overview.
Chapter 1 Introducing McAfee ePolicy Orchestrator Software version 4.6.0
Chapter 2 Planning your ePolicy Orchestrator configuration
McAfee® ePolicy Orchestrator® 4.6.0 Software Product Guide 13

1Introducing McAfee ePolicy Orchestrator
Software version 4.6.0
McAfee ePolicy Orchestrator software is a key component of the McAfee Security Management Platform
which provides unified management of endpoint, network, and data security. It provides you with
end-to-end visibility and powerful automation features that reduce incident response times,
strengthens protection, and decreases the complexity of managing risk and security.
See also
What is ePolicy Orchestrator software on page 15
Components and what they do on page 16
How the software works on page 17
How to navigate the ePolicy Orchestrator interface on page 18
Contents
What is ePolicy Orchestrator software
Components and what they do
How the software works
How to navigate the ePolicy Orchestrator interface
What is ePolicy Orchestrator software
ePolicy Orchestrator software is a scalable, extensible management platform that enables centralized
policy management and enforcement of your security products and the systems on which they reside.
It also provides comprehensive reporting and product deployment capabilities, all through a single
point of control.
Using an ePolicy Orchestrator server, you can:
• Deploy security products, patches, and service packs to the systems in your network.
• Manage the host and network security products deployed to your systems through the enforcement
of security policies, client tasks, and server tasks.
• Update the DATs, Engines and other security content required by your security software to ensure
your managed systems are secure.
1
McAfee® ePolicy Orchestrator® 4.6.0 Software Product Guide 15

Components and what they do
The ePolicy Orchestrator software is comprised of these components.
• McAfee ePO server — The center of your managed environment. The server delivers security
policies and tasks, controls updates, and processes events for all managed systems. The ePolicy
Orchestrator server includes these subcomponents:
• Apache server — Along with the event parser, this component is responsible for communicating
with the McAfee Agent. Together, these two components receive updated events and properties
from agents, and send updated policies and tasks.
• Application server — This component hosts the user interface and server task scheduler.
• Event parser — This component works in conjunction with the apache server to communicate
events and properties from the agent to the server, and send policies and tasks from the server
to the agent.
• Database — The central storage component for all data created and used by ePolicy Orchestrator.
You can choose whether to house the database on your McAfee ePO server or on a separate
system, depending on the specific needs of your organization.
• McAfee Agent — A vehicle of information and enforcement between the ePolicy Orchestrator server
and each managed system. The agent retrieves updates, ensures task implementation, enforces
policies, and forwards events for each managed system. It uses a separate secure data channel to
transfer data to the server. A McAfee Agent can also be configured as a SuperAgent.
• Master repository — The central location for all McAfee updates and signatures, residing on the
ePolicy Orchestrator server. Master repository retrieves user-specified updates and signatures from
McAfee or from user-defined source sites.
• Distributed repositories — Local access points strategically placed throughout your environment for
agents to receive signatures, product updates, and product installations with minimal bandwidth
impact. Depending on how your network is configured, you can set up SuperAgent, HTTP, FTP, or
UNC share distributed repositories.
• Remote Agent Handlers — A server that you can install in various network locations to help
manage agent communication, load balancing, and product updates. Remote Agent Handlers are
comprised of an apache server and an event parser. They can help you manage the needs of large
or complex network infrastructures by allowing you more control over agent-server communication.
• Registered servers — Used to register other servers with your ePolicy Orchestrator server.
Registered server types include:
• LDAP server — Used for Policy Assignment Rules and to enable automatic user account creation.
• SNMP server — Used to receive an SNMP trap. You must add the SNMP server’s information so
that ePolicy Orchestrator knows where to send the trap.
• Database server — Used to extend the advanced reporting tools provided with ePolicy
Orchestrator software.
• Ticketing server — Before tickets can be associated with issues, you must have a registered
ticketing server configured. The system running the ticketing extension must be able to resolve
the address of the Service Desk system.
Depending on the needs of your organization and the complexity of your
network, you might only need to use some of these components.
1Introducing McAfee ePolicy Orchestrator Software version 4.6.0
Components and what they do
16 McAfee® ePolicy Orchestrator® 4.6.0 Software Product Guide

How the software works
McAfee ePO software is designed to be extremely flexible. It can be set up in many different ways, to
meet your unique needs.
The software follows the classic client-server model, in which a client system (system) calls into your
server for instructions. To facilitate this call to the server, a McAfee Agent is deployed to each system
in your network. Once an agent is deployed to a system, the system can be managed by your ePolicy
Orchestrator server. Secure communication between the server and managed system is the bond that
connects all the components of your ePolicy Orchestrator software. The figure below shows an
example of how your ePolicy Orchestrator server and components inter-relate in your secure network
environment.
Introducing McAfee ePolicy Orchestrator Software version 4.6.0
How the software works 1
McAfee® ePolicy Orchestrator® 4.6.0 Software Product Guide 17

1Your ePolicy Orchestrator server connects to the McAfee update server to pull down the latest
security content.
2The ePolicy Orchestrator database stores all the data about the managed systems on your network,
including:
• System properties
• Policy information
• Directory structure
• All other relevant data the server needs to keep your systems up-to-date.
3McAfee Agents are deployed to your systems to facilitate:
• Policy enforcement
• Product deployments and updates
• Reporting on your managed systems
4Agent-server secure communication (ASSC) occurs at regular intervals between your systems and
server. If remote Agent Handlers are installed in your network, agents communicate with the server
through their assigned Agent Handlers.
5Users log onto the ePolicy Orchestrator console to perform security management tasks, such as
running queries to report on security status or working with your managed software security policies.
6The McAfee update server hosts the latest security content, so your ePolicy Orchestrator can pull
the content at scheduled intervals.
7Distributed repositories placed throughout your network host your security content locally, so
agents can receive updates more quickly.
8Remote Agent Handlers help to scale your network to handle more agents with a single ePolicy
Orchestrator server.
9Ticketing servers connect to your ePolicy Orchestrator server to help manage your issues and tickets.
10 Automatic Response notifications are sent to security administrators to notify them that an event
has occurred.
How to navigate the ePolicy Orchestrator interface
The ePolicy Orchestrator interface uses a menu-based navigation model with a customizable favorites
bar to ensure that you can get where you need to go quickly.
Menu sections represent the top-level features of your ePolicy Orchestrator server. As you add new
managed products to your server, the associated interface pages are either added to an existing
category, or a new category is created in the Menu.
About the ePolicy Orchestrator navigation Menu
The ePolicy Orchestrator Menu provides the primary navigation for your server.
1Introducing McAfee ePolicy Orchestrator Software version 4.6.0
How to navigate the ePolicy Orchestrator interface
18 McAfee® ePolicy Orchestrator® 4.6.0 Software Product Guide

The Menu uses categories that comprise the various features and functionality of your ePolicy
Orchestrator server. Each category contains a list of primary feature pages associated with a unique
icon. Select a category in Menu to view and navigate to the primary pages that make up that feature.
About the navigation bar
Customize the navigation bar to provide quick access to the features and functionality you use most
often.
You can decide which icons are displayed on the navigation bar by dragging any Menu item on or off the
navigation bar. When you navigate to a page in the Menu, or click an icon in the navigation bar, the
name of that page is displayed in the blue box next to the Menu.
On systems with 1024x768 screen resolution, the navigation bar can display six icons. When you place
more than six icons on the navigation bar, an overflow menu is created on the right side of the bar.
Click > to access the Menu items not displayed in the navigation bar. The icons displayed in the
navigation bar are stored as user preferences, so each user's customized navigation bar is displayed
regardless of which console they use to log on to the server.
Introducing McAfee ePolicy Orchestrator Software version 4.6.0
How to navigate the ePolicy Orchestrator interface 1
McAfee® ePolicy Orchestrator® 4.6.0 Software Product Guide 19