Please modify your RSD policy you should be able to do that from there
Thanks Allamiro for taking time to respond.
I looked at our RSD policy and it appears to be the same as before. It doesnt appear to have changed any. So I would suspect all the rogue sensors to use that policy like they did before the updated version.
Check inside the server settings, and change the settings for rogue system, in there you can specify how many sensors should be active or passive.
Hey thanks netsec. That appears to be what I need to do. That setting is now set at 2 instead of 1 like we had previously. Dont know why or how that changed.
We updated EPO some time ago (2 months). We are still 4.5 but at the current patch level. I am assuming it could have changed then. Does McAfee reccomend 2 active sensors? I notice when we have rogue detections we arent notified very promptly (5 to 10 mins later). Do you know if this will make for faster detections?
You can go and edit the automated response task
In there edit the aggression limit to "