McAfee EPOCDE-AA-BA Product Guide - Page 224

18 Responding to events in your network Creating and editing Automatic Response rules For option definitions click ? in the interface. Task 1 Next to Aggregation, select whether to Trigger this response for every event, or to Trigger this response if multiple events occur within a defined amount of time. If you select the latter, define the amount of time in minutes, hours, or days. 2 If you selected Trigger this response if multiple events occur within, you can choose to trigger a response when the specified conditions are met. These conditions are any combination of: • When the number of distinct values for an event property is at least a certain value. This condition is used when a distinct value of occurrence of event property is selected. • When the number of events is at least. Type a defined number of events. You can select one or both options. For example, you can set the rule to trigger this response if the distinct value of occurrence of event property selected exceeds 300, or when the number of events exceeds 3,000, whichever threshold is crossed first. 3 Next to Grouping, select whether to group the aggregated events. If you select to group the aggregated events, specify the property of event on which they are grouped. 4 As needed, next to Throttling, select At most, trigger this response once every and define an amount of time that must be passed before this rule can send notification messages again. The amount of time can be defined in minutes, hours, or days. 5 Click Next. Configuring the action for Automatic Response rules Use this task to configure the responses that are triggered by the rule on the Responses page of the Response Builder wizard. You can configure the rule to trigger multiple actions by using the + and - buttons, located next to the drop-down list for the type of notification. For option definition click ? in the interface. 224 McAfee® ePolicy Orchestrator® 4.6.0 Software Product Guide