cancel
Showing results for 
Search instead for 
Did you mean: 
pierce
Level 13
Report Inappropriate Content
Message 1 of 4

Rogue Sensor - what to do with unwanted devices apart from just unplugging them?

Jump to solution

Hey There,

I have started to test the Rogue sensors in my environment to pick up on machines without agents and its working reasonably well at the moment.

I have a question though,

what do you do if you detect a machine, its not one of yours and you dont want it on your network?

Is there any automatic response in ePO I can kick off to block this device?

All endpoints have VSE 8.8, HIPS 7.0 Safeboot 5.2 and DLP 9.1.

I think the answer is 'go and unplug device' but just want to be sure I am not missing anything obvious I could do to reduce the urgency to unplug these devices.

many thanks,

Pierce

1 Solution

Accepted Solutions
McAfee Employee spamidi
McAfee Employee
Report Inappropriate Content
Message 4 of 4

Re: Rogue Sensor - what to do with unwanted devices apart from just unplugging them?

Jump to solution

Looks like what you are asking is more of NAC (Network Access Control) - please check on McAfee NAC - it might be a more appropriate solution for your needs.

View solution in original post

3 Replies
Highlighted
McAfee Employee spamidi
McAfee Employee
Report Inappropriate Content
Message 2 of 4

Re: Rogue Sensor - what to do with unwanted devices apart from just unplugging them?

Jump to solution

You can add the device to Exception list. This is one of the valid actions in the Automatic Response rule configuration.

pierce
Level 13
Report Inappropriate Content
Message 3 of 4

Re: Rogue Sensor - what to do with unwanted devices apart from just unplugging them?

Jump to solution

So for example, say im based in one country and I see a device come online in another country where no one will be on site for several hours.

Its not an exception as I dont want it on the network, but cant do anything until someone gets in to remediate the issue.

Can ePO do anything to reduce my exposure to this device? say block all end points from seeing it via some HIPS policy?

Or is rogue sensors only options to install agent, add to exception or information only.

thanks!

McAfee Employee spamidi
McAfee Employee
Report Inappropriate Content
Message 4 of 4

Re: Rogue Sensor - what to do with unwanted devices apart from just unplugging them?

Jump to solution

Looks like what you are asking is more of NAC (Network Access Control) - please check on McAfee NAC - it might be a more appropriate solution for your needs.

View solution in original post

More McAfee Tools to Help You

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community