- You can use "Non-compliant computer detected" it can be find under Automatic responses tab.
- you can customise the query as you want.
- you can set the threshold value.
Where to I set the criteria? What I am looking to "flag" are systems that have any out of date product or definitions, whether it's the agent, HIPS, VSE, engine, etc. I don't see anywhere in the automatic response filters to set that. I see that the default is the non compliance event ID 16000. What feeds ePO the criteria that will generate that event?