cancel
Showing results for 
Search instead for 
Did you mean: 
Jmac24
Level 9
Report Inappropriate Content
Message 1 of 4

Automatic Response for apply tag event

Jump to solution

Sparing all the details for why, I want to trigger an automatic response to notify people when a specific tag is applied to any system. It's a troubleshooting tag that will disable all ENS components through a policy assignment rule when the tag applies. 

I dug around in the client, server and threat event names in the automatic responses under epo notification events and I am not seeing anything for "Apply Tag" or anything related to tags. I do see the event showing in the Audit Log, so I am guessing the ability to do this should be there. 

Can someone please assist?

Thanks

1 Solution

Accepted Solutions
McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 4 of 4

Re: Automatic Response for apply tag event

Jump to solution

Server events are more like pull task failures, etc.  I don't believe an audit event is an automatic response functionality. 

 

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

3 Replies
McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 2 of 4

Re: Automatic Response for apply tag event

Jump to solution

What type event is it?  The only option you have for that is if the event is a client or threat event, trigger a response for that event and under action, run a server task.  That server task can then apply a tag.  You would need to have a server task already set up for that - possibly run a query that then applies a tag based on the query results.  Your query would need to be a table type.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Highlighted
Jmac24
Level 9
Report Inappropriate Content
Message 3 of 4

Re: Automatic Response for apply tag event

Jump to solution

I'm good with using server tasks and applying tags. What I am looking for is an automatic response for when someone manually applies a specific tag to any system. That's it, I'm good with all the rest with queries, tags and server tasks. I'm assuming that it would be a server event since it's run on the server and creates an entry in the audit log. 

McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 4 of 4

Re: Automatic Response for apply tag event

Jump to solution

Server events are more like pull task failures, etc.  I don't believe an audit event is an automatic response functionality. 

 

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

More McAfee Tools to Help You
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • Visit: Business Service Portal
  • More: Search Knowledge Articles
  • ePolicy Orchestrator Support

    • Download the new ePolicy Orchestrator (ePO) Support Center Extension which simplifies ePO management and provides support resources directly in the console. Learn more about ePO Support Center