Rogue Sensor - what to do with unwanted devices apart from just unplugging them?

[pierce]

Hey There,

I have started to test the Rogue sensors in my environment to pick up on machines without agents and its working reasonably well at the moment.

I have a question though,

what do you do if you detect a machine, its not one of yours and you dont want it on your network?

Is there any automatic response in ePO I can kick off to block this device?

All endpoints have VSE 8.8, HIPS 7.0 Safeboot 5.2 and DLP 9.1.

I think the answer is 'go and unplug device' but just want to be sure I am not missing anything obvious I could do to reduce the urgency to unplug these devices.

many thanks,

Pierce

[spamidi]

You can add the device to Exception list. This is one of the valid actions in the Automatic Response rule configuration.

[pierce]

So for example, say im based in one country and I see a device come online in another country where no one will be on site for several hours.

Its not an exception as I dont want it on the network, but cant do anything until someone gets in to remediate the issue.

Can ePO do anything to reduce my exposure to this device? say block all end points from seeing it via some HIPS policy?

Or is rogue sensors only options to install agent, add to exception or information only.

thanks!

[spamidi · Accepted solution]

Looks like what you are asking is more of NAC (Network Access Control) - please check on McAfee NAC - it might be a more appropriate solution for your needs.