Yes it seems MA registers the node in both places. I would not expect that 🙂
How about the following theory: when the ePOLeafNode.LastUpdate and RSDDetectedSource.LastDetected fields values equal, (plus Detection Source equals 'McAfee Agent') then it signifies a new node being added. I would expect that these two fields are less likely to be equal later (under certain conditions, like ASCI interval and RSD detection frequency, how these two relates).
As for the deletion of a node: I have no theory just now.. 🙂
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.
Community Help Hub
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.