# Table of Contents - [Introduction | Trellix ePolicy Orchestrator - On-prem 5.1](#introduction-trellix-epolicy-orchestrator-on-prem-5-1) - [Module Intro | Trellix ePolicy Orchestrator - On-prem 5.1](#module-intro-trellix-epolicy-orchestrator-on-prem-5-1) - [Communications: Tomcat Service | Trellix ePolicy Orchestrator - On-prem 5.1](#communications-tomcat-service-trellix-epolicy-orchestrator-on-prem-5-1) - [How it Works | Trellix ePolicy Orchestrator - On-prem 5.1](#how-it-works-trellix-epolicy-orchestrator-on-prem-5-1) - [Communications: Security Keys | Trellix ePolicy Orchestrator - On-prem 5.1](#communications-security-keys-trellix-epolicy-orchestrator-on-prem-5-1) - [ePO Overview | Trellix ePolicy Orchestrator - On-prem 5.1](#epo-overview-trellix-epolicy-orchestrator-on-prem-5-1) - [Product Overview | Trellix ePolicy Orchestrator - On-prem 5.1](#product-overview-trellix-epolicy-orchestrator-on-prem-5-1) - [Trellix Agent Overview | Trellix ePolicy Orchestrator - On-prem 5.1](#trellix-agent-overview-trellix-epolicy-orchestrator-on-prem-5-1) - [Basic Product Components | Trellix ePolicy Orchestrator - On-prem 5.1](#basic-product-components-trellix-epolicy-orchestrator-on-prem-5-1) - [Module Summary | Trellix ePolicy Orchestrator - On-prem 5.1](#module-summary-trellix-epolicy-orchestrator-on-prem-5-1) - [ePO Resources | Trellix ePolicy Orchestrator - On-prem 5.1](#epo-resources-trellix-epolicy-orchestrator-on-prem-5-1) - [Installation and Upgrade | Trellix ePolicy Orchestrator - On-prem 5.1](#installation-and-upgrade-trellix-epolicy-orchestrator-on-prem-5-1) - [Module Intro | Trellix ePolicy Orchestrator - On-prem 5.1](#module-intro-trellix-epolicy-orchestrator-on-prem-5-1) - [Security Management Framework | Trellix ePolicy Orchestrator - On-prem 5.1](#security-management-framework-trellix-epolicy-orchestrator-on-prem-5-1) - [Module Summary | Trellix ePolicy Orchestrator - On-prem 5.1](#module-summary-trellix-epolicy-orchestrator-on-prem-5-1) - [Module Summary | Trellix ePolicy Orchestrator - On-prem 5.1](#module-summary-trellix-epolicy-orchestrator-on-prem-5-1) - [Module Intro | Trellix ePolicy Orchestrator - On-prem 5.1](#module-intro-trellix-epolicy-orchestrator-on-prem-5-1) - [Key Features | Trellix ePolicy Orchestrator - On-prem 5.1](#key-features-trellix-epolicy-orchestrator-on-prem-5-1) - [Tag Management | Trellix ePolicy Orchestrator - On-prem 5.1](#tag-management-trellix-epolicy-orchestrator-on-prem-5-1) - [Upgrade | Trellix ePolicy Orchestrator - On-prem 5.1](#upgrade-trellix-epolicy-orchestrator-on-prem-5-1) - [ePO Console | Trellix ePolicy Orchestrator - On-prem 5.1](#epo-console-trellix-epolicy-orchestrator-on-prem-5-1) - [Module Intro | Trellix ePolicy Orchestrator - On-prem 5.1](#module-intro-trellix-epolicy-orchestrator-on-prem-5-1) - [Services | Trellix ePolicy Orchestrator - On-prem 5.1](#services-trellix-epolicy-orchestrator-on-prem-5-1) - [Software Catalog | Trellix ePolicy Orchestrator - On-prem 5.1](#software-catalog-trellix-epolicy-orchestrator-on-prem-5-1) - [Pre-Installation Auditor Tool | Trellix ePolicy Orchestrator - On-prem 5.1](#pre-installation-auditor-tool-trellix-epolicy-orchestrator-on-prem-5-1) - [Module Intro | Trellix ePolicy Orchestrator - On-prem 5.1](#module-intro-trellix-epolicy-orchestrator-on-prem-5-1) - [Product Deployment | Trellix ePolicy Orchestrator - On-prem 5.1](#product-deployment-trellix-epolicy-orchestrator-on-prem-5-1) - [Module Summary | Trellix ePolicy Orchestrator - On-prem 5.1](#module-summary-trellix-epolicy-orchestrator-on-prem-5-1) - [Post-Installation Tasks | Trellix ePolicy Orchestrator - On-prem 5.1](#post-installation-tasks-trellix-epolicy-orchestrator-on-prem-5-1) - [Extension and Package Management | Trellix ePolicy Orchestrator - On-prem 5.1](#extension-and-package-management-trellix-epolicy-orchestrator-on-prem-5-1) - [Creating a Custom Properties Client Task Simulation | Trellix ePolicy Orchestrator - On-prem 5.1](#creating-a-custom-properties-client-task-simulation-trellix-epolicy-orchestrator-on-prem-5-1) - [Module Summary | Trellix ePolicy Orchestrator - On-prem 5.1](#module-summary-trellix-epolicy-orchestrator-on-prem-5-1) - [Module Summary | Trellix ePolicy Orchestrator - On-prem 5.1](#module-summary-trellix-epolicy-orchestrator-on-prem-5-1) - [Module Intro | Trellix ePolicy Orchestrator - On-prem 5.1](#module-intro-trellix-epolicy-orchestrator-on-prem-5-1) - [ePServer Configuration | Trellix ePolicy Orchestrator - On-prem 5.1](#epserver-configuration-trellix-epolicy-orchestrator-on-prem-5-1) - [Duplicating and Editing a Policy Simulation | Trellix ePolicy Orchestrator - On-prem 5.1](#duplicating-and-editing-a-policy-simulation-trellix-epolicy-orchestrator-on-prem-5-1) - [Module Intro | Trellix ePolicy Orchestrator - On-prem 5.1](#module-intro-trellix-epolicy-orchestrator-on-prem-5-1) - [User Accounts | Trellix ePolicy Orchestrator - On-prem 5.1](#user-accounts-trellix-epolicy-orchestrator-on-prem-5-1) - [System Tree | Trellix ePolicy Orchestrator - On-prem 5.1](#system-tree-trellix-epolicy-orchestrator-on-prem-5-1) - [Creating a New Permission Set Simulation | Trellix ePolicy Orchestrator - On-prem 5.1](#creating-a-new-permission-set-simulation-trellix-epolicy-orchestrator-on-prem-5-1) - [Permission Sets | Trellix ePolicy Orchestrator - On-prem 5.1](#permission-sets-trellix-epolicy-orchestrator-on-prem-5-1) - [Contacts | Trellix ePolicy Orchestrator - On-prem 5.1](#contacts-trellix-epolicy-orchestrator-on-prem-5-1) - [Module Summary | Trellix ePolicy Orchestrator - On-prem 5.1](#module-summary-trellix-epolicy-orchestrator-on-prem-5-1) - [Module Summary | Trellix ePolicy Orchestrator - On-prem 5.1](#module-summary-trellix-epolicy-orchestrator-on-prem-5-1) - [Module Intro | Trellix ePolicy Orchestrator - On-prem 5.1](#module-intro-trellix-epolicy-orchestrator-on-prem-5-1) - [Module Intro | Trellix ePolicy Orchestrator - On-prem 5.1](#module-intro-trellix-epolicy-orchestrator-on-prem-5-1) - [Building a Report Simulation | Trellix ePolicy Orchestrator - On-prem 5.1](#building-a-report-simulation-trellix-epolicy-orchestrator-on-prem-5-1) - [Creating a New Dashboard Simulation | Trellix ePolicy Orchestrator - On-prem 5.1](#creating-a-new-dashboard-simulation-trellix-epolicy-orchestrator-on-prem-5-1) - [Reports | Trellix ePolicy Orchestrator - On-prem 5.1](#reports-trellix-epolicy-orchestrator-on-prem-5-1) - [Module Summary | Trellix ePolicy Orchestrator - On-prem 5.1](#module-summary-trellix-epolicy-orchestrator-on-prem-5-1) - [Running a Disaster Recovery Snapshot Simulation | Trellix ePolicy Orchestrator - On-prem 5.1](#running-a-disaster-recovery-snapshot-simulation-trellix-epolicy-orchestrator-on-prem-5-1) - [Course Summary | Trellix ePolicy Orchestrator - On-prem 5.1](#course-summary-trellix-epolicy-orchestrator-on-prem-5-1) - [Client Task Management | Trellix ePolicy Orchestrator - On-prem 5.1](#client-task-management-trellix-epolicy-orchestrator-on-prem-5-1) - [Queries and Reports | Trellix ePolicy Orchestrator - On-prem 5.1](#queries-and-reports-trellix-epolicy-orchestrator-on-prem-5-1) - [ePO Dashboards | Trellix ePolicy Orchestrator - On-prem 5.1](#epo-dashboards-trellix-epolicy-orchestrator-on-prem-5-1) - [Disaster Recovery Overview | Trellix ePolicy Orchestrator - On-prem 5.1](#disaster-recovery-overview-trellix-epolicy-orchestrator-on-prem-5-1) - [Troubleshooting Tools | Trellix ePolicy Orchestrator - On-prem 5.1](#troubleshooting-tools-trellix-epolicy-orchestrator-on-prem-5-1) - [Policies Overview | Trellix ePolicy Orchestrator - On-prem 5.1](#policies-overview-trellix-epolicy-orchestrator-on-prem-5-1) - [Troubleshooting using Log Files | Trellix ePolicy Orchestrator - On-prem 5.1](#troubleshooting-using-log-files-trellix-epolicy-orchestrator-on-prem-5-1) --- # Introduction | Trellix ePolicy Orchestrator - On-prem 5.1 ![Page cover](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FioaW93P1MscfVyNlUTh4%252F0.jpg%3Falt%3Dmedia%26token%3Dbb385b6a-1714-4803-a56d-fccde133f780&width=1248&dpr=4&quality=100&sign=275a82ce&sv=2) Welcome to the Trellix ePolicy Orchestrator - On-prem 5.10 Service Pack 1 Essentials course. This course provides an overview of the **Trellix ePolicy Orchestrator (ePO) - On-prem product**, key features, purpose, and benefits. You will also learn how to install, configure, operate, and troubleshoot issues relating to ePO. The Course is divided into lessons and a final exam. Each lesson is a combination of instructional material such as texts, videos, external links, knowledge checks, and interactive learning experiences. To successfully complete this training, you need to take and pass the final course exam with a minimum score of 80%. This course is six hours in length. Learning objektives[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1#learning-objektives) Upon completion of this training, you will be able to: · Describe ePO and the Trellix Agent. · Install and upgrade ePO. · Deploy and configure products to endpoints. · Configure the ePO server. · Create and manage policies and rules. · Manage ePO user accounts and permission sets. · Create and interpret ePO dashboards, queries, and reports. · Describe the Disaster Recovery feature and how it works. · Explain how to perform basic troubleshooting on ePO. Useful Links[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1#useful-links) **Product and Solutions Training** Learn the skills to successfully deploy and manage your products and solutions. [EDUCATION SERVICES(OPENS IN A NEW TAB)](https://www.trellix.com/en-us/services/education-services.html) **Trellix Advanced Research Center** The Trellix Advanced Research Center provides information on current and emerging threats including: * Threat analysis and research * Threat predictions and trends * Searchable threat library * Podcast offerings, blogs, tips, and techniques * Security updates * Feedback, threat detection resources, and free tools [TRELLIX ARC(OPENS IN A NEW TAB)](https://www.trellix.com/en-us/threat-center.html) **Trellix on YouTube** Subscribe to the only official YouTube channel for Trellix technical support. Provides help to ensure your products successfully protect your organization, and that your experience meets your expectations. [TRELLIX ON YOUTUBE(OPENS IN A NEW TAB)](https://www.youtube.com/c/TrellixSecurity) **Service Portal** The Business Service Portal provides a single point of access to valuable resources and tools including: * ︎Knowledge Center: Search for documentation, technical articles, and other resources for your products. * Patches and Downloads: Obtain patches, hotfixes, and product downloads as well as manage product licenses. * Support Tools: Run Virtual Technician or other diagnostic tools to help solve problems. * Customer Community: Collaborate and engage in ongoing conversations with other product users. [SERVICE PORTAL(OPENS IN A NEW TAB)](https://supportm.trellix.com/) **Enterprise Product Documentation** This is a single location for all product information on ePO including: * Release Notes * Installation Guide * Product Guide * Reference Guide [DOCUMENTATION(OPENS IN A NEW TAB)](https://docs.trellix.com/) **Support Notification Service (SNS)** The Support Notification Service (SNS) delivers valuable product news, alerts, and best practices to help you increase the functionality and protection capabilities of your products . [SNS(OPENS IN A NEW TAB)](https://www.trellix.com/en-us/contact-us/sns-preferences.html) **Security Content Release Notes** Read about the security content of products, download .DAT files, or sign up for the .DAT Notification Service. [SECURITY CONTENT](https://www.trellix.com/en-us/downloads/security-updates.html?selectedTab=updates) Disclaimer[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1#disclaimer) This content was developed using Trellix ePO - On-prem 5.10 Service Pack 1 and may vary from the latest version of the product. All screenshots in the course were accurate at the time of course publication. Copyright[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1#copyright) Duplication of course materials is strictly prohibited by copyright. Copyright © 2023 Musarubra US LLC. All Rights Reserved. Module Intro[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1#module-intro) The Security Connected model drives how the company delivers and looks at security. In this module, you will learn about applications and tools to help you better understand the threat landscape, vulnerabilities, and relevant countermeasures, translating into more effective risk management. You will also learn about ePO solutions basics, solution components, and key features along with how ePO fits in the Security Connected model. **Module Objectives** By the end of this module, you should be able to: · Identify ePO components, architecture, and communications · Navigate within the ePO console · Describe the ePO Single Sign-On feature · Explain the purpose, key features, and functions of the Trellix Agent · Describe the basic functionality available from the Trellix Agent system tray icon [NextModule Intro](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/module-intro) Last updated 1 year ago --- # Module Intro | Trellix ePolicy Orchestrator - On-prem 5.1 The Security Connected model drives how the company delivers and looks at security. In this module, you will learn about applications and tools to help you better understand the threat landscape, vulnerabilities, and relevant countermeasures, translating into more effective risk management. You will also learn about ePO solutions basics, solution components, and key features along with how ePO fits in the Security Connected model. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/module-intro#module-objectives) **Module Objectives** By the end of this module, you should be able to: * Identify ePO components, architecture, and communications * Navigate within the ePO console * Describe the ePO Single Sign-On feature * Explain the purpose, key features, and functions of the Trellix Agent * Describe the basic functionality available from the Trellix Agent system tray icon [PreviousIntroduction](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1) [NextePO Overview](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/epo-overview) Last updated 1 year ago --- # Communications: Tomcat Service | Trellix ePolicy Orchestrator - On-prem 5.1 The Application Server (Tomcat Service) provides the most tangible services of the ePO core components. · It provides the front end of the console’s user interface for management tasks and standardized database interface and handles application features, such as System Tree organization, user management, policy management, dashboards, and more. · It runs the Notification System and supports the interactions between endpoints and ePO through extensions. Extensions are special software files that are supplied in a zipped format and are installed on the ePO server. They contain static files necessary for ePO to manage other endpoint security products. Examples: Endpoint Security (ENS) and Rogue Detection System (RSD). · In addition, registered server types are added using extensions. Once the registered server types are added, users can register their servers with another ePO server for multi-server functions, such as shared policies. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F2cySQbD4cHfPsF0t0iEI%252Fimage.png%3Falt%3Dmedia%26token%3D2d4cb9ad-4047-4ffd-84c5-8251acad4aa2&width=768&dpr=4&quality=100&sign=87349e99&sv=2) [Supported platforms for ePolicy Orchestrator (trellix.com)](https://kcm.trellix.com/corporate/index?page=content&id=KB51569) [PreviousBasic Product Components](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/epo-overview/basic-product-components) [NextCommunications: Security Keys](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/epo-overview/communications-security-keys) Last updated 1 year ago --- # How it Works | Trellix ePolicy Orchestrator - On-prem 5.1 rellix security software and ePO work together to stop malware attacks on your systems and notify you when they occur. During an attack, ePO components and processes stop an attack, notify you when it occurs, and record the incident. Click on the numbers below to see what happens during an attack. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FABGfbQY55ZRYRR3k52rg%252Fimage.png%3Falt%3Dmedia%26token%3Daca0cfa9-0a8b-4c84-9936-dd56f5dc3fc9&width=768&dpr=4&quality=100&sign=a5d421e3&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FHbos2yh3k3avYMrL7GBV%252Fimage.png%3Falt%3Dmedia%26token%3D73dce2bc-ae32-4f8e-ba0b-5b85f7fae24c&width=768&dpr=4&quality=100&sign=32e64fb6&sv=2) [PreviousSecurity Management Framework](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/epo-overview/security-management-framework) [NextBasic Product Components](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/epo-overview/basic-product-components) Last updated 1 year ago --- # Communications: Security Keys | Trellix ePolicy Orchestrator - On-prem 5.1 Security keys are used to verify, authenticate, and encrypt communications and content within your ePO-managed environment. The ePO server relies on three security key pairs to verify and authenticate communications and content within your ePO environment. These security key pairs are used to: · Authenticate agent‑server communication · Verify the contents of local repositories · Verify the contents of remote repositories Each key pair has: · A secret key that signs messages or packages at the source · A public key that verifies the messages or packages at the target ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Fk5KYrsJX1LyKL5oPk3uj%252Fimage.png%3Falt%3Dmedia%26token%3D41958746-e5e5-47a3-92cc-0352be66942d&width=768&dpr=4&quality=100&sign=d661a1ba&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FZ2l4LoDvVNh6fj7SVE71%252Fimage.png%3Falt%3Dmedia%26token%3D354a5a40-8b22-4492-8412-66c8ccf5cb30&width=768&dpr=4&quality=100&sign=f355bb28&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FK91HwwmViy9NcpolYb76%252Fimage.png%3Falt%3Dmedia%26token%3Dfa5cb63f-7666-44dc-af21-fa565306e0b8&width=768&dpr=4&quality=100&sign=2371b23d&sv=2) [PreviousCommunications: Tomcat Service](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/epo-overview/communications-tomcat-service) [NextePO Console](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/epo-overview/epo-console) Last updated 1 year ago --- # ePO Overview | Trellix ePolicy Orchestrator - On-prem 5.1 [Security Management Framework](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/epo-overview/security-management-framework) [How it Works](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/epo-overview/how-it-works) [Basic Product Components](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/epo-overview/basic-product-components) [Communications: Tomcat Service](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/epo-overview/communications-tomcat-service) [Communications: Security Keys](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/epo-overview/communications-security-keys) [ePO Console](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/epo-overview/epo-console) [PreviousModule Intro](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/module-intro) [NextSecurity Management Framework](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/epo-overview/security-management-framework) Last updated 1 year ago --- # Product Overview | Trellix ePolicy Orchestrator - On-prem 5.1 The Trellix Agent is the client-side component of ePO. You must install it on each system in your network that you want ePO to manage. Key functions: · Provides a secure communication channel to ePO and local services for other point-products · Includes an updater component that uses the Sitelist.XML file (list of available repositories) to find and download client or endpoint product updates; it can retrieve files from Hypertext Transfer Protocol (HTTP) sites, File Transfer Protocol (FTP) sites, Universal Naming Convention (UNC) shares, and ePO repositories. The order of sites in the site list controls the site chosen to do downloads. The updater attempts to get files from sites at the top of the list first. If it cannot get the files from the first site (perhaps because the site is down or the files it wants aren't there or are corrupted), it goes to the next one in order, and so on. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Feekii1qODHcOeZUtGSf0%252Fimage.png%3Falt%3Dmedia%26token%3D21d2c6d2-ec9c-4dba-ae6a-c907a24fddd8&width=768&dpr=4&quality=100&sign=79fe0973&sv=2) In addition to providing a secure communication channel, the Agent provides local services to managed Trellix products and to products developed by Trellix Security Innovation Alliance partners. While running silently in the background, the Agent: · Gathers information and events from managed systems and sends them to the ePO server. · Installs products and their upgrades on managed systems. · Enforces policies and schedules tasks on managed systems. · Updates security content, such as the DAT files associated with Endpoint Security or Host Intrusion Prevention. The Agent uses Hypertext Transfer Protocol (HTTP) over an IP connection to communicate and uses TCP Port 80 or 443 by default, except for Agent Wakeup calls. Agent Wakeup calls use Transmission Control Protocol (TCP) Port 8081. Except for wakeup calls, the Agent initiates all communication between the ePO server and client. This communication is called the Agent-to-Server-Communication-Interval (ASCI). [PreviousTrellix Agent Overview](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/trellix-agent-overview) [NextKey Features](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/trellix-agent-overview/key-features) Last updated 1 year ago --- # Trellix Agent Overview | Trellix ePolicy Orchestrator - On-prem 5.1 [Product Overview](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/trellix-agent-overview/product-overview) [Key Features](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/trellix-agent-overview/key-features) [Services](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/trellix-agent-overview/services) [PreviousePO Console](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/epo-overview/epo-console) [NextProduct Overview](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/trellix-agent-overview/product-overview) --- # Basic Product Components | Trellix ePolicy Orchestrator - On-prem 5.1 The diagram below displays the ePO basic product components. Click on the information (i) icons for a detailed description of each component. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FScuNLsoIOeXLTrRDiKkm%252Fimage.png%3Falt%3Dmedia%26token%3D3d6613b7-4372-408d-b900-3100b46d017b&width=768&dpr=4&quality=100&sign=4ba9ce8&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Fqwq3NadDK1cINtiVjq8q%252Fimage.png%3Falt%3Dmedia%26token%3D22584af8-4db0-429c-9541-e05dbcd5010e&width=768&dpr=4&quality=100&sign=1db95e60&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FBKBDqTnRRAzN5GBwhYKe%252Fimage.png%3Falt%3Dmedia%26token%3D0d5d4046-f8ea-4d08-b8d2-015c2d55afb5&width=768&dpr=4&quality=100&sign=9c1a1910&sv=2) [PreviousHow it Works](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/epo-overview/how-it-works) [NextCommunications: Tomcat Service](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/epo-overview/communications-tomcat-service) Last updated 1 year ago --- # Module Summary | Trellix ePolicy Orchestrator - On-prem 5.1 ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/module-summary#key-points) **Key Points** **ePO provides:** * Unified management of endpoint, network, and data security * Web browser for configuration and management tasks * Integration with Trellix and third-party solutions **Trellix Agent:** * Is a client-side component of ePO * Is an updater for all managed applications In the next lesson, you'll learn about ePO installation and upgrades. [PreviousePO Resources](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/epo-resources) [NextModule Intro](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/module-intro) Last updated 1 year ago --- # ePO Resources | Trellix ePolicy Orchestrator - On-prem 5.1 [https://docs.trellix.com/bundle/epolicy-orchestrator-5.10.0-product-guide https://docs.trellix.com/bundle/epolicy-orchestrator-5.10.0-installation-guide https://docs.trellix.com/bundle/epolicy-orchestrator-5.10.0-release-notes](https://docs.trellix.com/bundle/epolicy-orchestrator-5.10.0-product-guidehttps://docs.trellix.com/bundle/epolicy-orchestrator-5.10.0-installation-guidehttps://docs.trellix.com/bundle/epolicy-orchestrator-5.10.0-release-notes) [PreviousServices](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/trellix-agent-overview/services) [NextModule Summary](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/module-summary) Last updated 1 year ago --- # Installation and Upgrade | Trellix ePolicy Orchestrator - On-prem 5.1 **ePO 5.10 - On-prem Installation Guide** Pay special attention to the pre-requisites. [INSTALLATION GUIDE(OPENS IN A NEW TAB)](https://docs.trellix.com/bundle/epolicy-orchestrator-5.10.0-installation-guide) **ePO 5.10 Known Issues** [KB90382(OPENS IN A NEW TAB)](https://kcm.trellix.com/corporate/index?page=content&id=KB90382) **ePO installation and update checklist for known issues** [KB71825(OPENS IN A NEW TAB)](https://kcm.trellix.com/corporate/index?page=content&id=KB71825) **Supported platforms for ePO** Contains supported platforms, environments, and operating systems for ePO [KB51569(OPENS IN A NEW TAB)](https://kcm.trellix.com/corporate/index?page=content&id=KB51569) **Supported upgrade paths for on-Prem ePO Service Pack 1** Contains explanation of changes to the ePO update strategy and supported upgrade paths [KB96141](https://kcm.trellix.com/corporate/index?page=content&id=KB96141) [PreviousModule Intro](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/module-intro) [NextPre-Installation Auditor Tool](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/pre-installation-auditor-tool) Last updated 1 year ago --- # Module Intro | Trellix ePolicy Orchestrator - On-prem 5.1 There are two categories of ePO software installations: a new installation in an environment where no previous version of ePO software has been installed and an upgrade where you are replacing an existing version of ePO software. Before you install your ePO server software, it is important to know which method you plan to use and have a solid understanding of the corresponding workflow, requirements, and procedures. In this module you will learn about ePolicy Orchestrator installations. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/module-intro#module-objectives) **Module Objectives** By the end of this module, you should be able to: * Identify installation requirements, recommendations, and best practices * Describe the Pre-Installation Auditor tool functionality * Install and upgrade the ePO software * Perform post-installation tasks * Identify configuration tools for the initial setup of the ePO environment * Identify the upgrade checklist tasks [PreviousModule Summary](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/module-summary) [NextInstallation and Upgrade](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/installation-and-upgrade) Last updated 1 year ago --- # Security Management Framework | Trellix ePolicy Orchestrator - On-prem 5.1 ePO is a key component of the Security Management framework, providing unified management of endpoint, network, and data security products. Click on each card below to see some of the key features. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FnsJLXTvTEjorrCv54nQ5%252Fimage.png%3Falt%3Dmedia%26token%3D523210a2-fecb-4e3a-807b-419c5749b1c4&width=768&dpr=4&quality=100&sign=368e098e&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FLvWAdx0MKSgC8u0Sq8Z5%252Fimage.png%3Falt%3Dmedia%26token%3D52d5fc3d-065a-48bb-8732-fd6b25d39fc4&width=768&dpr=4&quality=100&sign=79a1a7d6&sv=2) [PreviousePO Overview](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/epo-overview) [NextHow it Works](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/epo-overview/how-it-works) Last updated 1 year ago --- # Module Summary | Trellix ePolicy Orchestrator - On-prem 5.1 ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/module-summary#key-points) **Key Points** * The ePO server can be fine-tuned to the needs of an organization through entries available in the Server Settings. * Agent Handlers distribute network traffic via agent-to-server communication interval (ASCI). * The System Tree contains all the systems managed by ePO. * You can group systems based on machine-type, geography, political boundaries, or any other logical criteria that supports your needs. * ePO offers two System Tree synchronization features: NT Domain Integration, and Active Directory Synchronization. * Tags can be used to identify and sort systems, simplify the creation of tasks and queries, and tailor reports to be more meaningful. * Use the Tag Catalog page to view summary information for any tag, begin creating or editing tags, and run sorting criteria. * You organize tags within the Tag Group Tree in a hierarchical structure, similar to ePO System Tree structure. * * * In the next lesson, you will learn how to deploy software manually and automatically in ePO. * * * [PreviousTag Management](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/tag-management) [NextModule Intro](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/module-intro) Last updated 1 year ago --- # Module Summary | Trellix ePolicy Orchestrator - On-prem 5.1 ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/module-summary#key-points) **Key Points** * You will need to use a SQL Server as the ePO database. Launch SQL Server Configuration Manager and verify the following before installing ePO: - Verify that the SQL Server service is running. - Verify TCP/IP is enabled. * Follow best practices for installing ePO software * The Pre-Installation Auditor now runs automatically as part of the installation process to validate that your existing configuration is ready for the upgrade. * After the installation is complete, connect to the ePO server and verify the ePO console is accessible. In the next lesson, you will learn how to configure the ePO server. [PreviousUpgrade](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/upgrade) [NextModule Intro](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/module-intro) Last updated 1 year ago --- # Module Intro | Trellix ePolicy Orchestrator - On-prem 5.1 In this module, you will learn the basics of configuring the ePO server. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/module-intro#module-objectives) **Module Objectives** By the end of this module, you should be able to: * Describe the various ePO server configuration options * Explain how to configure an Agent Handler * Describe when to use an Agent Handler in your environment * Provide an overview of the ePO System Tree * Use different methods for creating the System Tree * Describe the various methods of organizing the System Tree * Describe Tag Catalog functionality * Describe how to add, delete, clear, exclude, and move Tags and Tag groups [PreviousModule Summary](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/module-summary) [NextePServer Configuration](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration) Last updated 1 year ago --- # Key Features | Trellix ePolicy Orchestrator - On-prem 5.1 ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Fp6BcOmUuoO9x4U5N10OE%252Fimage.png%3Falt%3Dmedia%26token%3D6438c1bd-011f-47cf-8d2e-2efd6904ac90&width=768&dpr=4&quality=100&sign=5a91cad3&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Fr5EsQJ4bzZrTWQ0hQ9uW%252Fimage.png%3Falt%3Dmedia%26token%3Dbeea0851-0b23-4cdd-99c2-259db00240c3&width=768&dpr=4&quality=100&sign=a4f25703&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FFbJodTUYcDhibIaOQ2gD%252Fimage.png%3Falt%3Dmedia%26token%3D1eb797bf-e70a-4db9-a726-140385e4964d&width=768&dpr=4&quality=100&sign=fd210c3b&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FztNuwq8gEqoSNcJWzO4y%252Fimage.png%3Falt%3Dmedia%26token%3D693269ff-bc70-4e00-a07c-9439db20fc2a&width=768&dpr=4&quality=100&sign=5a306a91&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FqydeUpAZXjJIaYo24Y6l%252Fimage.png%3Falt%3Dmedia%26token%3D9e310654-4afb-4989-aea5-869441b85ec8&width=768&dpr=4&quality=100&sign=ba44c340&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FHZ5fUfQgijlpOgYBTkkO%252Fimage.png%3Falt%3Dmedia%26token%3D5cca2893-2a89-40dc-8581-094f4a079d69&width=768&dpr=4&quality=100&sign=c3953c26&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FwoZZNX9IVoZYvZ5cxWqJ%252Fimage.png%3Falt%3Dmedia%26token%3D2693c222-2b5f-4210-93c4-9fde41e5f41d&width=768&dpr=4&quality=100&sign=ddee487d&sv=2) [PreviousProduct Overview](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/trellix-agent-overview/product-overview) [NextServices](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/trellix-agent-overview/services) Last updated 1 year ago --- # Tag Management | Trellix ePolicy Orchestrator - On-prem 5.1 ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/tag-management#tag-catalog) **Tag Catalog** Tags and tag groups allow you to select groups of systems and simplify the creation of tasks and queries. Some uses of tags are: * Automatic placement in System Tree groups * System Identification * Unique update and scan tasks for specific groups * Extra monitoring oversight and extra attention * Custom policies for specific systems/groups * Inclusion of selected system information in reports The Tag Catalog is accessed from the Menu page (**Menu** \> **Systems** \> **Tag Catalog)**. The page has two basic parts: Tag Group Tree and Tags. * **Tag Group Tree** (left pane): Displays tags grouped by a hierarchical tree of groups and subgroups. * **Tags** (right pane): Tags help you identify and sort systems. The tag list displays the tags available for use. There typically are default Server and Workstation tags. Use this page to view summary information for any tag, begin creating or editing tags, and run sorting criteria. _**Click on the information (i) icons for further information.**_ ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FVBwquZzcVk2WuPPm4gdO%252Fimage.png%3Falt%3Dmedia%26token%3D0cd5e424-2f35-44a1-b4c7-330d6d4fa592&width=768&dpr=4&quality=100&sign=cdea7051&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/tag-management#tag-permissions) **Tag Permissions** To create or edit tags, or to apply, exclude and clear tags, you must have the appropriate permissions selected in the Systems Permission Set. Administrators have these rights by default, but other administrative users may need these permissions enabled on the Permission Sets page (**Menu** \> **User Management** > **Permission Sets**). Since the Tag Builder accesses the Criteria definition page for a tag regardless if you use it, you will need to give anyone who will be creating tags the ability to use tag criteria, as displayed in this slide, as well as access to the **Create and edit private queries** set within the permission set. The ePO administrator can also restrict usage of tags to available Permission Sets. This can be handy for administrators to help identify & sort systems accordingly in their environments. By default, Tags are set to “**Do not restrict by Permission Sets**”. To access & configure Tag Permissions, open the **Tag Catalog**, click on the desired Tag, and expand the **Restrictions** entry under the _Tag Details_ section. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FWFN21rs8Rb5Z5e0kqxC5%252Fimage.png%3Falt%3Dmedia%26token%3Df007d97e-693c-48ca-b234-9e480aac6e9f&width=768&dpr=4&quality=100&sign=6f30bbea&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FPnvj9WmnNQisqa8qCiBL%252Fimage.png%3Falt%3Dmedia%26token%3Daf9e25cc-4adc-41a2-82ff-b90c0f10a3dc&width=768&dpr=4&quality=100&sign=eb391264&sv=2) > The ePO administrator can also restrict usage of tag to available Permission Sets. This can be handy for administrators to help identify and sort systems accordingly in their environments. > > By default, Tags are set to “**Do not restrict by Permission Sets**”. > > To access and configure Tag Permissions, open the **Tag Catalog**, click on the desired Tag, and expand the **Restrictions** entry under the _Tag Details_ section. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/tag-management#tag-actions-in-the-system-tree) **Tag Actions in the System Tree** Using the Tag **Actions** in the System Tree, you can manually apply tags to systems, clear tags from systems, and exclude system from automatic tagging. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FlWSOUVufhKFKsvPOy7hO%252Fimage.png%3Falt%3Dmedia%26token%3D414dc7f2-6095-4b95-b891-5ebf8d964e09&width=768&dpr=4&quality=100&sign=40f4894f&sv=2) > * **Apply Tag**: Allows you to manually apply tags to systems > > * **Clear Tag**: Allows you to manually clear tags applied to systems > > * **Exclude Tag**: Allows you to exclude systems from having specific tags applied. Alternatively, you can use a query to collect systems, then, from the query results, you can exclude those tags from those systems. > **Creating a Tag Demonstration** [PreviousSystem Tree](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/system-tree) [NextModule Summary](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/module-summary) Last updated 1 year ago --- # Upgrade | Trellix ePolicy Orchestrator - On-prem 5.1 ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/upgrade#changes-with-epo-5.10-service-pack-1) **Changes with ePO 5.10 Service Pack 1** ePO 5.10 Update 15 is the latest update in the initial series of cumulative updates (CUs) for ePO 5.10. The next release after that may have two different packages. Cumulative update indicates any update that is applied using the ePO 5.10 update tool. * **ePO 5.10 Service Pack 1** (ePO 5.10 SP1): This package can be used to install ePO for the first time and includes the updates in CU 1-15. It is also used to upgrade some versions of ePO 5.9.1 and earlier to ePO 5.10 SP1. * **ePO 5.10 Service Pack 1 Update** (ePO 5.10 SP1 CU): This package can be used to upgrade an existing ePO 5.10 server to service pack 1. _You do not need to install this if you have already installed ePO 5.10 Service Pack 1_. EPO 5.10 SP1 Update is the last update to support both upgrading from and rolling back to ePO 5.10 CU 1–15. The update numbering then resets so that the next release after ePO 5.10 SP1 might be ePO 5.10 SP1 Update 1 (ePO 5.10 SP1 CU1), and so on. If you are on ePO 5.10 Update 15 or earlier, you must first apply ePO 5.10 SP1 CU before upgrading to ePO 5.10 SP1 CU1 or later. **See** [**KB96141** (opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content&id=KB96141) **for the full list of upgrade paths supported for ePO - On-prem 5.10 Service Pack 1.** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FKsK7JtMuxchjdHCd1nTq%252Fimage.png%3Falt%3Dmedia%26token%3D9ce1e856-9764-4f39-bccc-7ad44a7cf7b1&width=768&dpr=4&quality=100&sign=bbcbff63&sv=2) * The upgrade path does not allow an upgrade from ePO 5.3.0 or earlier to ePO 5.10 SP1. * The Pre-Installation Auditor (embedded in the ePO 5.10 installer) verifies the ePolicy Orchestrator and SQL Database readiness for upgrade to ePO 5.10. * The Pre-Installation Auditor utility provides remediation steps for any conflicts found. * The Pre-Installation Auditor utility file (ePIP.exe) is also provided in the extracted folder and can be executed outside of the ePO installer file (setup.exe). **After upgrading to ePO 5.10, you might need to rebuild indexes if index fragmentation gets too high or the built-in task fails to rebuild those indexes. Rebuilding the indexes is beneficial for better ePO performance. See** [**KB87769** (opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content&id=KB87769) **for details.** ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/upgrade#upgrading-epo-checklist) **Upgrading ePO Checklist** #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/upgrade#plan-the-upgrade) **Plan the Upgrade** * Read the release notes. * Review Knowledge Base articles for ePO: * Known Issues: [KB90382(opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content&id=KB88906) * Upgrade Paths: [KB86693(opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content&id=KB86693) * Upgrade Paths for Service Pack 1 (SP1): [KB96141(opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content&id=KB96141) * Minimum Supported Extensions/Versions: [KB94079(opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content&id=KB94079) * Policy & System Migration: [KB88822(opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content&id=KB88822) * Gather required information: Grant Number License Key Database server and Database name DB Server credentials Primary administrator account credentials for ePO Keystore encryption passphrase * The Pre-Installation Auditor runs in installer by default. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/upgrade#prepare-the-environment) **Prepare the Environment** * Perform any updates as recommended by the Pre-Installation Auditor for the ePO server. * Back up ePO databases and directories. * Update registered server certificates. * Disable Trellix Agent installation tasks set to Run Immediately. * Disable scheduled server tasks and Windows tasks. * Disable third-party software. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/upgrade#prepare-sql-database) **Prepare SQL Database** * Perform any updates for the SQL Server as recommended by the Pre-Installation Auditor assessment of the SQL database. * Update your Windows Server to the latest Microsoft Service Packs and hotfixes. * Make sure that IPv6 is enabled. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/upgrade#perform-the-upgrade) **Perform the Upgrade** Download and extract the software[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/upgrade#download-and-extract-the-software) Download the ePO software to your Windows Server. Stop automatic updates[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/upgrade#stop-automatic-updates) Disable Windows updates to ensure they do not interfere with your ePO installation or upgrade. Stop remote Agent Handlers services before upgrading[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/upgrade#stop-remote-agent-handlers-services-before-upgrading) If you use remote Agent Handlers in your environment, you must stop two services on each remote Agent Handler server to successfully complete your upgrade. Stop ePO services[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/upgrade#stop-epo-services) Make sure that the Apache Tomcat service stops. Start and complete the InstallShield wizard[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/upgrade#start-and-complete-the-installshield-wizard) Use Setup.exe to upgrade your ePO server. Upgrade your remote Agent Handlers[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/upgrade#upgrade-your-remote-agent-handlers) When you upgrade your ePO server software, you must manually reinstall the Agent Handler software on any remote Agent Handlers installed throughout your environment. Agent Handlers are not automatically updated to the latest version when the ePO server is upgraded. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/upgrade#restart-process-and-verify-upgrade) **Restart Process and Verify Upgrade** To remediate vulnerabilities in your ePO environment, migrate SHA-1 certificates to SHA-2 or higher; refer to [KB87017(opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content&id=KB87017) . Verify the upgrade: 1. Run a query or server task. 2. Perform an Agent wake-up call with one or more managed systems. 3. Verify registered servers are communicating with the ePO server. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/upgrade#migrate-sha-1-certificates-to-sha-2-or-higher) **Migrate SHA-1 Certificates to SHA-2 or Higher** The Certificate Manager allows you to: * Migrate certificates that are signed by older signing algorithm to the new algorithm, such as SHA-1 to SHA-256 * Regenerate your certificates when your existing certificates are compromised due to vulnerabilities in your environment * Migrate or regenerate certificates for managed products that are derived from McAfee ePO root CA This task replaces certificates that are used for all these ePO operations: * Agent-server communication * Authenticating to browsers * Certificate-based user authentication **Read the instructions carefully before proceeding with the steps. If you activate the new certificates before they are populated on the systems in your network, those systems will not be able to connect to your ePO server, until the agents on those systems are re-installed** ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/upgrade#card-title-22) Using Certificate Manager The Certificate Manager page provides information about the installed Root Certificate, Agent Handler certificates, server certificates, and other certificates that are derived from ePO root Certificate Authority (CA). ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FaY4gLh8gktQIvkWv858J%252Fimage.png%3Falt%3Dmedia%26token%3D19b0be46-d273-489c-abbe-62d76c8e2647&width=768&dpr=4&quality=100&sign=ebe0512c&sv=2) Log on as an administrator, then click **Menu** \> **Configuration** \> **Certificate Manager**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FTLsDI5hP2BoMIKP1b4he%252Fimage.png%3Falt%3Dmedia%26token%3D4ceef781-15c2-4d96-ba5b-67c1693bb47e&width=768&dpr=4&quality=100&sign=59585a22&sv=2) Click **Regenerate Certificate** . ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FEQ50EaNJNL1IN5EkQ2XP%252Fimage.png%3Falt%3Dmedia%26token%3D872dedce-5abd-41b9-ba55-56ef8ff949ac&width=768&dpr=4&quality=100&sign=83ab74ef&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FM0OIEBj0J21riS1YeIxd%252Fimage.png%3Falt%3Dmedia%26token%3Dbe66d5d1-3f80-4dfd-87a0-0e6a9f4dde51&width=768&dpr=4&quality=100&sign=2962d25c&sv=2) After the certificates regenerate, wait for sufficient saturation of the new certificates throughout your environment. As agents communicate to the ePO server, they are given the new certificate. The percentage of agents that have received the newly-generated certificates is provided in the **Certificate Manager** under **Product**: **Agent Handler** > **Status**. This distribution percentage is based on the number of agent-server communications that have occurred since the certificates were regenerated. Unmanaged inactive systems will affect this percentage. **Note**: Make sure that the distribution percentage is as close to 100% as possible before you continue; otherwise, any pending systems will not receive the newly generated certificates and will be unable to communicate with ePO after the certificates are activated. You can stay in this state for as long as is necessary to achieve sufficient saturation. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FwpqkwgBY3Tohr46pBUSq%252Fimage.png%3Falt%3Dmedia%26token%3Ddb46e4c2-bd9e-4405-8bb8-f6bbd6dbe9d3&width=768&dpr=4&quality=100&sign=1dd0961a&sv=2) 1. Once you've achieved a distribution percentage close to 100%, click **Activate Certificates** to carry out all future operations using the new certificates. A backup of the original certificates is created, and a message appears. 2. Click **OK**. You must reinstall any agents that still use the old certificates to restore agent-to-server communication. Once activation of certificates is complete, perform these steps: 1. Stop the Agent Handler services (including the Remote Agent Handler services). 2. Restart the ePO services. 3. Start the Agent Handler services. Monitor your environment and make sure that your agents are successfully communicating. You can cancel the migration at this point to roll back the certificate and restore agent-to-server communication; however, **after you’ve completed the next step, you can no longer cancel the certification migration**. Click **Finish Migration** to complete the certificate migration. The certificate backup, taken during activation, is deleted. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/upgrade#card-title-31) Summary For any issues during the migration, click **Cancel Migration** to revert to the previous certificates. If you cancel the migration, stop the Agent Handler services, restart the ePO service, and start the Agent Handler service again. You can start the certificate migration again after fixing any issues. [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/upgrade#undefined) --------------------------------------------------------------------------------------------------------------------- [PreviousPost-Installation Tasks](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/post-installation-tasks) [NextModule Summary](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/module-summary) Last updated 1 year ago --- # ePO Console | Trellix ePolicy Orchestrator - On-prem 5.1 Access the ePO console using a web browser. **Design and Layout** The ePO interface uses a menu-based navigation model and includes a navigation bar. The first menu in the bar is the one used when you log in to ePO. The default is Dashboards unless you have installed Protection Workspace. By default, the navigation bar includes access to these pages: Protection Workspace (if installed), Dashboards, System Tree, Support Center, Trellix ePO - SaaS Migration, Queries & Reports, Policy Catalog, and Security Resources. It also provides a new updates/notifications icon and a User Quick Access menu to let you log off the ePO console, view online help, and get support. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F5FFeA0Z2dLH33tF9k4OE%252Fimage.png%3Falt%3Dmedia%26token%3D138537c6-4cca-4e47-afb2-ea0da2feb051&width=768&dpr=4&quality=100&sign=7405bc48&sv=2) **Customizing the Navigation Bar** You have the flexibility to customize the navigation bar for quick access to the features and functionality you use most often. You can decide which features are displayed on the navigation bar by dragging any menu item on or off the navigation bar. The features displayed in the navigation bar are stored as user preferences, so each user’s customized navigation bar displays regardless of which console they use to log on to the server. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FI1mSgGgNzETyXnxTdVNz%252Fimage.png%3Falt%3Dmedia%26token%3Db34b2297-db71-4f92-99ae-4307d598c503&width=768&dpr=4&quality=100&sign=4bd0b74f&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FowoueMm3tbQMFO9icxx0%252Fimage.png%3Falt%3Dmedia%26token%3Da86e383c-2610-45b1-b9de-ce2f5bba7df9&width=768&dpr=4&quality=100&sign=74023497&sv=2) **Menu Page** Click the **Menu** (three line stack) icon on the navigation bar to go to the Menu page. The Menu page provides a central launching point for all ePO pages. The Menu organizes the pages by category and includes links to the subpages for the category; for example, to manage users, go to the User Management category and then click the Users link. As you add new managed products to your server, the associated interface pages are either added to an existing category, or a new category is added to the Menu page. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FX0htXxn0dLvybEP8BPlO%252Fimage.png%3Falt%3Dmedia%26token%3Dbf107417-25dd-41e5-9048-b3d3336be3e6&width=768&dpr=4&quality=100&sign=7e55b77e&sv=2) [PreviousCommunications: Security Keys](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/epo-overview/communications-security-keys) [NextTrellix Agent Overview](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/trellix-agent-overview) Last updated 1 year ago --- # Module Intro | Trellix ePolicy Orchestrator - On-prem 5.1 ePO simplifies the process of deploying products to the managed systems in your network by providing a user interface to configure and schedule deployments. In this module, you will learn how to deploy software manually and automatically. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/module-intro#module-objectives) **Module Objectives** By the end of this module, you should be able to: * Explain how the Software Catalog works * Install extensions and software components using the Software Catalog * Install extensions and software components manually * Create a Product Deployment Project * Deploy software to endpoints through the Client Task Catalog * Describe the purpose of client tasks * Access and navigate the Client Task Catalog [PreviousModule Summary](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/module-summary) [NextSoftware Catalog](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/software-catalog) Last updated 1 year ago --- # Services | Trellix ePolicy Orchestrator - On-prem 5.1 Trellix Agent provides these services: · Trellix Agent Service: Performs property collection, policy enforcement, schedules tasks, performs agent-server communication, and triggers the update session o Service name: Masvc o Windows processes: masvc.exe o Non-Windows processes: masvc · Trellix Agent Common Services: Hosts multiple Trellix Agent services, such as Peer-to-Peer, Wake-up, and RelayServer o Service name: Macmnsvc o Windows processes: macmnsvc.exe o Non-Windows processes: macmnsvc · Trellix Agent Backwards Compatibility Service: The Trellix Agent service starts this service and communicates to the various managed product plugins. You only see this when the executable is invoked. o Service name: McAfee Framework o Windows processes: macompatsvc.exe o Non-Windows processes: macompatsvc ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FhQuVb2qlMdBZwNwuaySx%252Fimage.png%3Falt%3Dmedia%26token%3D052fe4d2-99e3-43bf-9f53-cd44b8948e74&width=768&dpr=4&quality=100&sign=c1497491&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FlNXXzLn4tT2dISI6WndN%252Fimage.png%3Falt%3Dmedia%26token%3D477380a7-7bf5-4081-ad6c-2a67776a1384&width=768&dpr=4&quality=100&sign=e7d9fcba&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F4SBY1ECYYk6vtzRpxH0n%252Fimage.png%3Falt%3Dmedia%26token%3D8d299442-635c-4745-9c70-b46cb87d1d7a&width=768&dpr=4&quality=100&sign=54f23504&sv=2) First Tab [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/trellix-agent-overview/services#tab-first-tab) Second Tab [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/trellix-agent-overview/services#tab-second-tab) On Windows client systems, the install logs are saved in **%TEMP%\\McAfeeLogs**. Log files can be found in these locations, depending on the managed system’s operating system: 1. On Windows client 2. systems: \\All Users\\Application Data\\McAfee\\ Agent\\Logs 3. If no Documents and Settings folder:\\McAfee\\Agent\\Logs 4. On non-Windows client systems: /var/McAfee/agent/logs **Using the System Tray Icon** In a Windows environment, if the Agent policy is set to show the Agent icon in the system tray of the managed system, you can access shortcuts to information and functionality of managed products. **Update Security** – Triggers immediate updating of all installed Trellix software products. This includes application of patches and hotfixes, as well as DAT and signature updates. Note this feature is available only if specifically enabled in the Agent policy. **Quick Settings** – Links to product menu items that are frequently used **Manage Features** – Displays links to the administrative console of managed products **Scan Computer for** – Launches Trellix programs, such as Endpoint Security, that scan systems on-demand and detect unwanted malicious software **View Security Status** – Displays the current system status of managed Trellix products, including current events **Agent Status Monitor** – Triggers the Agent Status Monitor, which: * Displays information on the collection and transmission of properties * Sends events * Downloads and enforces policies **About** – Displays system and product information for products installed on the system, including the Agent, the ePO server with which the Agent communicates, and the software products being managed ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FqdWShBRqiNqsbZ8KC4aJ%252Fimage.png%3Falt%3Dmedia%26token%3D7a6478d6-0f07-4e3a-a438-5256a24b4637&width=768&dpr=4&quality=100&sign=4bf958cb&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/trellix-agent-overview/services#forcing-trellix-agent-activity) Forcing Trellix Agent Activity There are two methods available to force communications to occur from a managed client to the ePO server: opening the Trellix Agent Status Monitor and using the command line. **Open the Trellix Agent Status Monitor** If the ePO icon displays in the Windows system tray, open the Agent Monitor. The following options are available: · **Collect and Send Props**: Forces the Agent to collect machine and product properties configuration and communicate them to the ePO server. **Note**: The Agent policy controls whether full or incremental properties are sent to the ePO server. · **Send Events**: Forces the Agent to send events to the ePO server. Note: This action sends all events to the ePO server irrespective of their severity. · **Check New Policies**: Forces the Agent to communicate with the ePO server and check for the existence of updated policies; will also update any modified or newly created tasks. · **Enforce Policies**: Forces the Agent to read the local copy of the ePO policy and enforce this on the machine. · **Agent Settings**: Configures Trellix Agent settings and Network Settings · **Save Contents to Desktop**: Saves the contents of the Trellix Agent log to a file · **Close**: Closes the Trellix Agent Monitor window ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FpGQdERSl7TkK1JErwvle%252Fimage.png%3Falt%3Dmedia%26token%3D4484a047-3f65-4cb2-ae25-56d469705107&width=768&dpr=4&quality=100&sign=61538002&sv=2) Note that you can see the Agent icon in the system tray only if the Show system tray icon (Windows only) option is selected on the General tab of the Trellix Agent policy pages. If you cannot see the icon, select this option and apply it. When you finish viewing the log file content, you can hide the icon again by deselecting the option and applying the change. Use the Command Line When the Agent is installed, an executable (CMDAGENT.EXE) is also installed in the Agent directory (:\\Program Files\\Trellix\\Common Framework, by default). This command line utility lets you to execute Agent commands without using the Trellix Agent Status Monitor. Switches allow you to specify the action(s) the Agent undertakes and are equivalent to the options provided by the Trellix Agent Status Monitor: · **Collect and Send Properties and Events: CMDAGENT.EXE /p** **· Check New Policies: CMDAGENT.EXE /c** **· Enforce Policies: CMDAGENT.EXE /e** **· Show Agent monitor: CMDAGENT.EXE /s** **· Forward events from Windows based client systems to ePO server: CMDAGENT.EXE /f** **· Displays the agent information: CMDAGENT.EXE /i** **· Sets the logfile location: CMDAGENT.EXE -l** **· Displays the help information**: CMDAGENT.EXE /h · **Forward events from Unix based and Macintosh client systems to ePO server: CMDAGENT /f** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FFE2Ctuqa23DP5gll4inh%252Fimage.png%3Falt%3Dmedia%26token%3D52476582-9574-4800-8e3c-d6c8b2d8801c&width=768&dpr=4&quality=100&sign=63b00026&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F8pSasIfhXVq8n80ljZGm%252Fimage.png%3Falt%3Dmedia%26token%3D86a2fc6c-07b3-4205-a44a-f7bb3d95ef90&width=768&dpr=4&quality=100&sign=680b37b0&sv=2) [PreviousKey Features](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/trellix-agent-overview/key-features) [NextePO Resources](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-overview/epo-resources) Last updated 1 year ago --- # Software Catalog | Trellix ePolicy Orchestrator - On-prem 5.1 ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/software-catalog#software-catalog-user-interface) **Software Catalog User Interface** The Software Catalog informs you about the availability of new and updated licensed software products that your organization uses, as well as trial (evaluation) versions. It also lets you check in, update, and remove many managed product components from the ePO server. Software availability and whether it is in the Licensed or Evaluation category depends on your license key. Some components, such as Help extensions or those made up of MSI installers, cannot be installed using this action. You must download and manually install these types of components. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FLPzj5KnZqmSqnXq1BrxT%252Fimage.png%3Falt%3Dmedia%26token%3D7975b302-cb0c-4927-9032-e0660da140b8&width=768&dpr=4&quality=100&sign=1d472059&sv=2) **Your ePO server must have Internet access because it connects to the download server to verify which products are available.** > ### > > [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/software-catalog#card-title-2) > > Package/Extension Check-in > > From the Software Catalog, you can download, check in, update, and remove managed product components from your server. > > To download software or product documentation to a location on your network and check in a product package or extensions to your ePO server, complete these steps from the Software Catalog. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Fc1zNzaupnTgF2vCECwbN%252Fimage.png%3Falt%3Dmedia%26token%3D0e620a04-991a-4adf-9ea6-837b829d0fff&width=768&dpr=4&quality=100&sign=3094a85f&sv=2) Select **Menu** \> **Software** \> **Software Catalog** to open the Software Catalog page. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FUQK8HhSUzKcTaWsPikdN%252Fimage.png%3Falt%3Dmedia%26token%3D5bcb985b-53f9-4a99-9d19-ec2c0df45e0a&width=768&dpr=4&quality=100&sign=50db0d42&sv=2) Click on the desired category entry under **Products**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FZdTYenED2d9BGjClBE8I%252Fimage.png%3Falt%3Dmedia%26token%3D394a8b78-6e60-45c1-8935-bd1a5be857ab&width=768&dpr=4&quality=100&sign=8379b511&sv=2) In the table in the right pane, select (highlight) a product/type, such as **Trellix Data Exchange Layer 6.0**. In this case, you can expand the product and select the extension or package you wish to install (for example, DXL Broker 6.0.3). ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F2zmIzCYXAS0bfFM9kXN1%252Fimage.png%3Falt%3Dmedia%26token%3D856e86d4-f111-47e4-a9f4-b5406c84dc1d&width=768&dpr=4&quality=100&sign=dd38e6ac&sv=2) In the details pane to the far-right, click **Check In** under **Actions** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FlyVJYKVN9B6HEr0r8oHm%252Fimage.png%3Falt%3Dmedia%26token%3Da0cdc996-cc0b-4bfc-b1d0-afa497a41a58&width=768&dpr=4&quality=100&sign=598694f3&sv=2) In the _Check In_ pane, review and accept the product details and End User License Agreement (EULA). ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FeDuFEYG5g4IWzbc9VSsE%252Fimage.png%3Falt%3Dmedia%26token%3Df110da98-1d68-44bb-a794-a9143d36e7a4&width=768&dpr=4&quality=100&sign=8e448a27&sv=2) If you are checking in a package, in the _Check In Options_ pane, select the desired branch. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FO5J5SzkCMNupTydWSbAN%252Fimage.png%3Falt%3Dmedia%26token%3D5f6acdf1-bc89-4eed-a911-1369ef32cf1e&width=768&dpr=4&quality=100&sign=ead6204d&sv=2) Click **Check In**. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/software-catalog#card-title-10) Verifying Package/Extension Check-in ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FwJiQVw7IBgN2XME8X8wE%252Fimage.png%3Falt%3Dmedia%26token%3Df71f5734-5143-42ed-acfd-218ac20297b8&width=768&dpr=4&quality=100&sign=8669448a&sv=2) To verify the task completed successfully once the check-in completes, click the product entry again under the Software Catalog pane and do the following: 1. Compare the _**Available Version**_ against the _**Check in Version**_ entry. 2. To see details for the task, expand **Actions** and click **View Task Log**. **To update a package or extension, follow the same steps as you would for check-in, but instead of choosing** _**Check in**_ **under Actions, choose** _**Update**_**. If you wish to remove a package or extension, choose** _**Remove**_ **under Actions.** [PreviousModule Intro](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/module-intro) [NextExtension and Package Management](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/extension-and-package-management) Last updated 1 year ago --- # Pre-Installation Auditor Tool | Trellix ePolicy Orchestrator - On-prem 5.1 When you install or upgrade to ePO 5.10 or later, the ePO Pre-Installation Auditor (PIA) utility is integrated into the installer and enabled by default. The PIA tool helps to reduce or prevent installation or upgrade issues. The auditor automates many of the verification tasks included in the installation or upgrade process to make sure your environment meets the minimum requirements. Additionally, ePO Pre-Installation Auditor allows you to change your ePO Admin password. The ePO Pre-Installation Auditor utility performs many checks, from confirming ePO and SQL Server hardware requirements to various SQL database compatibility checks. For detailed information on all of the checks this tool performs, see the Pre-Installation Auditor section in the ePO 5.10 Installation Guide. If you need to run the ePO Pre-Installation Auditor utility outside of the installer, follow these steps: 1. The ePO Pre-Installation Auditor tool is located within the ePO 5.10 Installation files under the **ePOIP** folder. Double-click **ePIP.exe** to start the auditor, then follow the prompts. 2. Once all checks have passed, click **Finish**. For details on known issues with ePolicy Orchestrator Pre-Installation Auditor, see [KB88906(opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content&id=KB88906) . Additionally, review [KB87017 (opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content&id=KB87017) carefully to avoid a possible disruption in agent-to-server communication. **ePO Installation Preparation** **Best Practices** * Install latest Microsoft updates. * Update the ePO database server with the latest Microsoft security updates for the database software you use. * Ensure ports to be used by ePO are available. * If Endpoint Security (ENS) is installed, disable Access Protection and stop ENS services. * After ePO installation, install firewall software (for example, ENS) on the ePO server. * Update your software with the most current intrusion detection signature files. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/pre-installation-auditor-tool#prerequisites) **Prerequisites** Local administrator account credentials[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/pre-installation-auditor-tool#local-administrator-account-credentials) An account with local administrator permissions is required to log on to the Windows server computer to be used as the ePO server. Product License Key[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/pre-installation-auditor-tool#product-license-key) If you don't have a license key, you can select **Evaluation** to continue installing the software. The evaluation period is limited to 90 days. You can provide a license key after installation is complete from within the application. For more information, see the product guide or Help. Authentication credentials[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/pre-installation-auditor-tool#authentication-credentials) Supports Windows and SQL authentication. * **Microsoft Windows authentication**: Credentials for a domain administrator user account * **SQL authentication**: Required SQL Server permissions (Discussed later in this module) Destination folder[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/pre-installation-auditor-tool#destination-folder) Folder for ePO software, if different than the default (C:\\Program Files (86)\\Trellix \\ePolicy Orchestrator\\) Supported SQL Server[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/pre-installation-auditor-tool#supported-sql-server) It is important to know if you plan to install SQL Server or plan to use a manually installed or existing SQL server. SQL Server details[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/pre-installation-auditor-tool#sql-server-details) * Name of the SQL Server (This name should be formatted using the SQL Server name or the SQL Server name with instance name.) * Dynamic port number used by your SQL Server ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/pre-installation-auditor-tool#downloading-epo-software) **Downloading ePO Software** A grant number is required to obtain ePO software and documentation from Product Download Site ([**https://www.trellix.com/en-us/downloads/my-products.html**(opens in a new tab)](https://www.trellix.com/en-us/downloads/my-products.html) ). ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FXpfDdHskhXMQo7bRRBfN%252Fimage.png%3Falt%3Dmedia%26token%3Dd8b90df0-1bd0-42d4-8f17-7e99f2be2ded&width=768&dpr=4&quality=100&sign=772f32d9&sv=2) Click on **Download**, and the screen below displays. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F3d9iN0c7gAzw5ZwtZQRy%252Fimage.png%3Falt%3Dmedia%26token%3D3a4eb85e-7775-46bd-9098-6930d00d4db2&width=768&dpr=4&quality=100&sign=973e2d74&sv=2) **Installing ePO Software** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FfeOY8nXc8SPx2B1ctvpr%252Fimage.png%3Falt%3Dmedia%26token%3D4f49b6bc-86e3-40a7-9628-0e8d8e83728c&width=768&dpr=4&quality=100&sign=b33611d6&sv=2) 1. From the ePO server, extract your ePO software files to a temporary directory, then browse to the temporary directory and double click on the Setup icon (Setup.exe), or select **File** \> **Open**. Wait while the program prepares for the install. Do not attempt to run Setup.exe without first extracting the .zip file. **Note**: You may be alerted about RAM or monitor requirements. With ePO 5.10, 8 GB available RAM minimum is recommended. The monitor should be 1024x768, 256-color, VGA. 2. Click **OK** to continue. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FDoqylfdJIrQmupttSaaV%252Fimage.png%3Falt%3Dmedia%26token%3D0f1727cd-28dd-4bfb-9e5c-c74d8e5174a0&width=768&dpr=4&quality=100&sign=ca681ff0&sv=2) 1. A welcome window opens. Read the information on the window, then click **Next** to begin. 2. If any prerequisite software is needed, click **Next** to install the software. Wait while the software is installed. **Note**: Disregard the _Restore_ option as it does not apply to a new install. The restore option is used to quickly recover if the hardware hosting your ePO server fails. It saves your ePO configuration, extensions, keys, and more to Snapshot records in the ePO database. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FTlT1mXB8Y4Msd4aJmrKw%252Fimage.png%3Falt%3Dmedia%26token%3D9609249c-e1c7-4411-93d1-9406e4b83e70&width=768&dpr=4&quality=100&sign=2fcef4fe&sv=2) In the Destination Folder step, click: * **Next** to install the ePO software in the default location (C:\\Program Files (x86)\\Trellix\\ePolicy Orchestrator\\). * **Change** to specify a custom destination location for your ePO software. When the Change Current Destination Folder window opens, browse to the destination and create folders if needed. After specifying the new destination, click **Next** to continue. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FvjA2rUSq6GFnuGLAh3GD%252Fimage.png%3Falt%3Dmedia%26token%3D2b784595-a747-4a4d-8e15-81700c737bf3&width=768&dpr=4&quality=100&sign=42106287&sv=2) Complete the Database Information window, then click **Next**. * **Database Server**: Select from drop-down list. * **Database Name**: The Database Name is populated automatically. * **Database Server credentials**: Select and define the authentication type. * **Windows authentication**: Select the domain of the user account to be used to access the SQL Server. If using a previously-installed SQL server, also type the User name and Password. If you are using a previously installed SQL Server, make sure your user account has access. * **SQL authentication**: Type the User name and Password for your SQL Server. Make sure that the credentials you provide represent an existing user on the SQL Server, with appropriate rights. * **Username / Password**: Enter user name and password that ePO will use to connect to the SQL server. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Flw6a6OzMx2Kz0yRZHXHs%252Fimage.png%3Falt%3Dmedia%26token%3D540233da-e4bc-4ab4-9d1a-02da634a8df8&width=768&dpr=4&quality=100&sign=f144efa1&sv=2) The Pre-Installation Auditor starts automatically and begins running checks to on all the components to determine compliance with requirements. A warning appears if the system does not pass all the checks. Click **OK** and resolve issues as needed, then click **Finish**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FRbmqtRbsPKw2NmBEW9qT%252Fimage.png%3Falt%3Dmedia%26token%3Df616fbaa-afba-439e-869a-1a482909166a&width=768&dpr=4&quality=100&sign=a12d75b7&sv=2) The ports that ePO uses are predefined and populated by default. If a SQL Server is installed on the same server as ePO, then ePO uses the dynamically assigned port on a local SQL Server port. The port for the remote SQL server remains 1433. In the example, the local port assignment is shown. After your installation is complete, you can change only the Agent wake‑up communication port and Agent broadcast communication port. If you need to change your other port settings later, reinstall your ePO software. Refer to the Installation Guide on the dynamic ports that are assigned to the SQL Server by the SQL Server. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FjK1LlRwkIP7vfQbMgaSz%252Fimage.png%3Falt%3Dmedia%26token%3D77f85a68-c713-4171-8b8b-c9adb42995dd&width=768&dpr=4&quality=100&sign=2c3702c3&sv=2) Complete the Administrator Information dialog, then click **Next**. * **Username / Password**: Enter the Username and Password for primary global administrator account. * **Keystore Encryption Passphrase**: Enter passphrase (8-20 characters). Required for Disaster Recovery. After installation, you can reset the Keystore Encryption Passphrase from the Server Settings page (**Menu** \> **Server Settings** > **Disaster Recovery** > **Edit**). ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FEnbDPHwv1yS7jIxRqcaN%252Fimage.png%3Falt%3Dmedia%26token%3Dc026edb2-fdbf-4f7a-b63b-b1945ac71d32&width=768&dpr=4&quality=100&sign=7c9d0d5c&sv=2) Enter the **License Key** or select **Evaluation**, then click **Next**. The evaluation period expires after 90 days. **Automatic Product Configuration** During an automatic configuration, your ePO server downloads and installs all the products entitled to you by your site license. In most cases, during an automatic configuration, you never see the Automatic Product Configuration process run. It starts running as soon as you finish installing the ePO software and is usually finished before you log on. If the Automatic Product Configuration page appears when you initially log on to ePO, an error occurred while downloading or installing your products. **Example**: If your Internet connection is interrupted. Make a note of the product that failed to install and click **Retry** to attempt the product installation again. To stop the automatic product installation, click **Stop**. A confirmation dialog box asks you to confirm that you want to use Software Manager to install your products. **IMPORTANT**: Once you click **OK** in the **Stop Automatic Product Setup** confirmation dialog box, you must use the Software Manager to install your products. The Automatic Product Configuration is available only once during your initial configuration. If a product continues to fail during Automatic Product Configuration, contact Technical Support, or click **OK** to exit the Automatic Product Configuration page and begin setting up the ePO server. For future product installation status information, open the Software Manager (**Menu** \> **Software** \> **Software Manager**). ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Fs9hhEq6dT7cIvBFPlffE%252Fimage.png%3Falt%3Dmedia%26token%3D5735c88e-d195-4a14-965b-c3d59333d5fd&width=768&dpr=4&quality=100&sign=899e46a2&sv=2) 1. Accept the End User License Agreement to continue the installation. Optionally, change the location if different than United States. Click **OK** to continue. 2. The Ready to Install the Program window appears. Optionally, disable the option to allow Trellix to collect system and software telemetry data, then click **Install**. **Product Improvement Program** The Product Improvement Program collects the data from the client systems where Trellix products are installed and that are managed by ePO. It helps improve Trellix products. The Product Improvement Program collects these types of data: * System environment (software and hardware details) * Effectiveness of installed Trellix product features * Trellix product errors and related Microsoft Windows events Trellix product errors and related Microsoft Windows events The collected data is aggregated on the ePO server, then sent to the Product Improvement Program server once a day (default collection period) and stored at \\TelemetryData. Trellix uses the data that is collected by the program to analyze and improve the product experience for customers. The collected data is analyzed by Trellix to improve product features and customers' experiences with the product. It is also used by Trellix Technical Support for troubleshooting. To learn about this program, click the **More Information** button. (Requires internet access). **Privacy Protection** The collected data is used only for product improvement and technical support. The system-specific data is filtered or used in aggregate form, unless it is required for technical support. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FtVDwQKqn3kmwqqKirI4v%252Fimage.png%3Falt%3Dmedia%26token%3D882e437c-0260-4089-9d2b-b844c59fd8b3&width=768&dpr=4&quality=100&sign=c9bb2dd8&sv=2) 1. Wait while the installation program installs ePO. This may take some time. 2. The InstallShield Wizard dialog appears after the installation is complete. Click **Finish**. [PreviousInstallation and Upgrade](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/installation-and-upgrade) [NextPost-Installation Tasks](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/post-installation-tasks) Last updated 1 year ago --- # Module Intro | Trellix ePolicy Orchestrator - On-prem 5.1 In this module, you will learn about the default policies included with ePO, as well as the Policy Catalog organization and controls. You will learn how to create, assign, enforce, and share policies. You will also learn about policy inheritance, permission sets, and policy comparison. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/module-intro#module-objectives) **Module Objectives** By the end of this module, you should be able to: * Describe the purpose of policies * Create and edit policy objects * Manage policy configuration and assignment * See policy inheritance in action * Enforce policy changes on client machines (endpoints) [PreviousModule Summary](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/module-summary) [NextPolicies Overview](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview) Last updated 1 year ago --- # Product Deployment | Trellix ePolicy Orchestrator - On-prem 5.1 ePO simplifies the process of deploying security products to the managed systems in your network, by providing a user interface to configure and schedule deployments. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2Fa7-br7FSQpqocEao_sr0CJOAnNS6kLZQq.png&width=768&dpr=4&quality=100&sign=5e33c4ad&sv=2) There are three processes you can follow to deploy products using ePO. Product Deployment Projects[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/product-deployment#product-deployment-projects) Streamline the deployment process by consolidating many of the steps needed to create and manage product deployment tasks, individually. Provide more functionality than client tasks. **Examples**: The ability to run a deployment continuously, stop a deployment, and uninstall a previously deployed product. Client Tasks[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/product-deployment#client-tasks) The Client Tasks Catalog applies the concept of logical objects to ePO client tasks. You can create client task objects for a variety of purposes, without the need to assign them immediately. As a result, you can treat these objects as reusable components when assigning and scheduling client tasks. Install with an Installation URL[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/product-deployment#install-with-an-installation-url) You can install the product on a local system with an installation URL. You can create a custom installation URL and use it to install the client software on your own local system or send it to end users to install the client software on their systems. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/product-deployment#product-deployment-project) **Product Deployment Project** The Product Deployment page is a single location, where you can create, monitor, and manage your product deployment projects. _**Click on the information (i) icons to view additional information about each main part of the page.**_ ![Product Deployment Project.png](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FLoU3k12jz-MUdfpt_zqqXSoBqrGC1widv.png&width=768&dpr=4&quality=100&sign=a4ec50d&sv=2) 1. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FA4EkSNEtHn02tPRr3Gyd%252Fimage.png%3Falt%3Dmedia%26token%3D54232144-8b86-4fcd-b4b8-4a03f36f15fa&width=300&dpr=4&quality=100&sign=63047555&sv=2) 2. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FgN5pjtDfonwFZcqi1xTT%252Fimage.png%3Falt%3Dmedia%26token%3Dcf77d814-9a47-493f-afec-90e81dce2b30&width=300&dpr=4&quality=100&sign=188b26fd&sv=2) 3. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Fs2XoIv4CeQZn9XKCxLTJ%252Fimage.png%3Falt%3Dmedia%26token%3D0040d25e-bb15-4aa8-9394-7028752339e1&width=300&dpr=4&quality=100&sign=15c080df&sv=2) 4. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F2xdyc2I8gIYiTQ5SBo0Q%252Fimage.png%3Falt%3Dmedia%26token%3Dd7db128c-f5e8-4eba-8764-c07d63bc6488&width=300&dpr=4&quality=100&sign=d5a3ca1b&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/product-deployment#system-selection-continuous-deployment) **System Selection: Continuous Deployment** _Continuous deployments_ use System Tree groups or tags for the systems, which allows you to move systems to those groups or assign system tags, applying the deployment to those systems. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2Fn30kF3wYLg2UyBYf_TYvFP1OJmGxP3jBo.png&width=768&dpr=4&quality=100&sign=7507e75b&sv=2) **There is no limit to number of systems selected for a continuous deployment but be mindful of any bandwidth, implications with scheduling, etc.** #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/product-deployment#system-selection-fixed-deployment) **System Selection: Fixed Deployment** _Fixed_ deployments use a fixed or defined set of systems. System selection is done using your System Tree or Managed Systems Query output tables. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2F9DA8HvvdsEgQ6X1Z_MA43oXO_8S1QoeFe.png&width=768&dpr=4&quality=100&sign=8d96c68a&sv=2) **Limited to 500 systems in a Product Deployment Project. If more than 500 systems are selected, you will be prompted to select few systems.** #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/product-deployment#reviewing-product-deployments) **Reviewing Product Deployments** Audit logs from your deployment projects contain records of all product deployments made from the console, using the **Product Deployment** feature. These audit log entries are displayed in a sortable table within the Deployment details area of the Product Deployment page, as well as on the Audit Log page, which contains log entries from all auditable user actions. You can use these logs to track, create, edit, duplicate, delete, and uninstall product deployments. Click a log entry to display entry details. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FZmv4HUlYk088miTG__g4WVrZnwN-mzMSb.png&width=768&dpr=4&quality=100&sign=6ebc220&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/product-deployment#client-task-catalog) **Client Task Catalog** Another way to deploy software products is using the Client Task Catalog. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FW7kSMRN8xYvSc7vd_9veeAEbYak8oKLEc.png&width=768&dpr=4&quality=100&sign=a4d5a9e&sv=2) * Assigned at any level in the System Tree * Inherited by groups and systems lower in the tree * Allows inheritance to be broken * Can be shared across multiple registered ePO servers * Must be assigned to managed systems * Can be scheduled to run or run immediately **Product Deployment client tasks deploy products to your managed systems from the Main Repository. Product Update client tasks control when and how managed systems receive updates when global updating is not used. If you are not using global updating, client update tasks is the only way you can control client updating with ePO software.** ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/product-deployment#using-the-main-repository-to-create-a-deployment-task) **Using the Main Repository to Create a Deployment Task** You can also create a deployment task from the Main Repository as shown below. Click the **Create Deployment Task** button to create a task. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2F1ydQh8HSDKAfXjTc_WhNwOt_DORi8lNG2.png&width=768&dpr=4&quality=100&sign=8e1c6957&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/product-deployment#using-the-main-repository-to-create-a-deployment-task-workflow) **Using the Main Repository to create a Deployment Task: Workflow** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FmslyVtfMzXuEjRpE_fJn5akOoFId0wmuD.png&width=768&dpr=4&quality=100&sign=4c1210d5&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/product-deployment#creating-an-installation-url) **Creating an Installation URL** Typically, ePO Cloud administrators create an installation URL that can be used to install Endpoint Security Client on managed systems. They can: * Use this URL to install the client software locally on their own system. * send this URL to users, with instructions for installing the client software on their local systems. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FjenRczulD6pocr7O_X-nz8VTxojlW8EER.png&width=768&dpr=4&quality=100&sign=e2235a5d&sv=2) 1. From the ePO console, select **Menu** \> **Dashboards**, then select **Getting Started with ePolicy Orchestrator** from the drop-down list. 2. The products in the Main Repository, available to install on managed systems, are listed under **My Products**. 3. Click the **Customize Installation** button and complete the required information. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/product-deployment#creating-an-installation-url-workflow) **Creating an Installation URL: Workflow** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FvV7LRcc9ugurmdhE_y8tCjxI50FTjKhon.png&width=768&dpr=4&quality=100&sign=a52294b0&sv=2) Client Task Management [PreviousExtension and Package Management](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/extension-and-package-management) [NextClient Task Management](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/client-task-management) Last updated 1 year ago --- # Module Summary | Trellix ePolicy Orchestrator - On-prem 5.1 ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/module-summary#key-points) **Key Points** * By default, only the administrator or creator can modify a policy. Policy ownership can be changed, and a policy can have multiple owners. * McAfee Default policy is read-only. My Default policy can be edited, renamed, duplicated, deleted, exported, and shared. * Create a custom policy by duplicating an existing one. By default, custom polices have no assignments. * A child inherits its parent’s settings unless inheritance is broken. * Policy assignment rules let you manage policies for multiple users or system based on specific criteria. * The Policy Comparison tool is used to compare policies that are similar, allowing you to determine which settings are different and which are the same. In the next lesson, you will learn how to manage ePO users. [PreviousDuplicating and Editing a Policy Simulation](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/duplicating-and-editing-a-policy-simulation) [NextModule Intro](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/module-intro) Last updated 1 year ago --- # Post-Installation Tasks | Trellix ePolicy Orchestrator - On-prem 5.1 * Verify services are installed/started. * bullet Make sure Startup type for SQL Server Agent (EPOSERVER) service is Automatic. * bullet Make sure pop-up blocker is off. * bullet Log in to ePO for first time. * bullet Import root certificate. * bullet Install required updates for Trellix security products (if appropriate). * bullet View port assignments. * bullet Configure ePO for multiple NICs (if appropriate). ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/post-installation-tasks#verify-services-are-installed-and-started) **Verify Services are Installed and Started** 1. Select **Start** \> **Programs** \> **Administrative Tools** > **Services**. 2. Identify the services installed on the server and started. Pay special attention to these services: 1. **Trellix ePolicy Orchestrator Application Server Service (Tomcat)**: Responsible for displaying the ePO console and running extensions, as well as other background functions. 2. **Trellix ePolicy Orchestrator Event Parser Service**: Takes events uploaded from clients in your environment and parses them into the SQL database. 3. **Trellix ePolicy Orchestrator Server Service (Apache)**: Processes and receives all agent-server communication. **Log Files for Application Server**, **Event Parser**, and **Server Services** The following are the primary log locations for these services: * **Application Server service (Tomcat)**: orion.log or orion\_servername.log located in: ...\\\\server\\logs\\ * **Event Parser service**: eventparser.log or eventparser\_servername.log located in: ..\\\\db\\logs\\ * **Server service (Apache)**: server.log or server\_servername.log located in: ...\\\\db\\logs\\ **List of Services** * Trellix ePO Application Server Service (Tomcat) * Trellix ePO Event Parser Service * Trellix ePO Server Service (Apache) * Product Improvement Program Service (optional) * SQL Server * SQL Server Agent * SQL Server Browser ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FdLLMdoECwRwwqwJsajxL%252Fimage.png%3Falt%3Dmedia%26token%3Dbb6c18e7-1efa-4ba2-9868-eafc3f009bfb&width=768&dpr=4&quality=100&sign=48b78636&sv=2) Rely on constant, high-speed connection to ePO SQL Server database/ Cluster installs only ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/post-installation-tasks#logging-in-to-epo-for-the-first-time) **Logging in to ePO for the First Time** After the installation is complete, connect to the ePO server and verify the ePO console is accessible. Because the console is web-based, you can also access the console remotely using a supported browser at one of these addresses: * https://:: **Configuration** \> **Server Settings**, select **Login Message** from the Settling Categories, then click **Edit**. Select **Display custom login message**, then enter your message and click **Save**. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/post-installation-tasks#logging-in-to-epo-using-identity-provider) **Logging in to ePO using Identity Provider** ePO Single Sign-On feature enables the customer to bring their own identity provider for the user authentication purposes. This feature internally uses SAML (Security Assertion Markup Language) that allows identity providers (IdPs) to pass authorization credentials to service providers (SP). Supported Identity Providers: * OKTA * ADFS * Ping Identity * Azure AD * Onelogin The service provider will be ePO. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/post-installation-tasks#card-title-14) Install Trellix ePO Single Sign-On Extension Follow this process to install the ePO Single Sign-On extension from the Trellix Download site using your Trellix Grant Number. Prerequisites: * Trellix ePO version must be 5.10.0 Update 11 or later * Configure your Identity Provider application ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F2KP1WpgwZd1YKeIqUbUH%252Fimage.png%3Falt%3Dmedia%26token%3D0c1f6e34-a197-4b79-aadc-160654ef60e6&width=768&dpr=4&quality=100&sign=9fe0a7fb&sv=2) After entering your grant number, search for ePolicy Orchestrator and select version 5.10 ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FqQNVGrVCihQDwTzLMMwu%252Fimage.png%3Falt%3Dmedia%26token%3D60142036-1336-48b8-a8c9-04a8368ab2c2&width=768&dpr=4&quality=100&sign=881b6e0&sv=2) In **Available Downloads**, select **Filters type** as **EXTENSION**, select ePO Single Sign-On version 1.0.0.xxx, and download it to your local ePO server. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F9QcEasX9lhtE58uZcssU%252Fimage.png%3Falt%3Dmedia%26token%3D474c516a-8d48-4df9-9907-d2c4254d0423&width=768&dpr=4&quality=100&sign=d26ccb45&sv=2) In ePO, go to **Menu** \> **Software** > **Extensions**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F91Dt0Y9bkV6goOZODqH9%252Fimage.png%3Falt%3Dmedia%26token%3D8f78efe4-d3ff-4332-b9d2-94f697f572cd&width=768&dpr=4&quality=100&sign=e58e298f&sv=2) Click **Install Extension**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FwWuZiMABkluIth1pIrGD%252Fimage.png%3Falt%3Dmedia%26token%3D416cb157-9d1b-4001-b399-51921848e5be&width=768&dpr=4&quality=100&sign=e7761747&sv=2) Browse to and select the **ePOSingleSignOn\_release\_..zip** extension file, click **Open**, then click **OK** twice. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/post-installation-tasks#card-title-20) Note You can also download the extension from the Software Catalog of your ePO server. **Configuring SSO to Log on to ePO** Configuring the IdP Application[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/post-installation-tasks#configuring-the-idp-application) * Configure a new IdP application in your SSO solution to get the IdP Entity Id (Issuer URL), IdP SSO URL, and X 509 certificate to input in your SAML configuration information * For instructions on how to configure your IdP application, see your identity provider’s documentation **Note**: You might need to use placeholder information for the ACS URL and the Audience URI (Service Provider Entity ID) when you configure your third-party IdP. Enter the details when you Update your IdP application SAML settings with the information from the ePO server. Input SAML Configuration Information[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/post-installation-tasks#input-saml-configuration-information) Configure the settings in the **IDP SAML Settings** page under **Server Settings** to enable SSO using your IdP application: * **Import IDP Metadata xml file** — Download the metadata from your IdP, and then click **Import** to upload the metadata to ePO * After entering the details, click **Save** * Once you log off from the ePO application, you will see the **Log On with IDP** option on the main screen **Note**: Some IdPs do not support the download of the metadata extension. You will need to input data manually after collecting the necessary details from your IdP application. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FZFZBIwnGYe5ni9lWQR10%252Fimage.png%3Falt%3Dmedia%26token%3D29f339c0-3996-4d4c-91c9-de3591777f0f&width=768&dpr=4&quality=100&sign=e057d519&sv=2) Update IdP Configuration with Information from ePO Server[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/post-installation-tasks#update-idp-configuration-with-information-from-epo-server) Edit SAML settings in your IdP application with information from ePO 1. **Audience URL (Service Provider Entity ID)**: Enter the Service Provider (ePO) Entity ID from ePO 2. **Single Sign On URL**: Enter the Service Provider Assertion Consumer Service URL from ePO Assign the User Local for the IdP Application[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/post-installation-tasks#assign-the-user-local-for-the-idp-application) When logging in using an identity provider, the user locale is assigned in the following manner: * **From the user\_locale attribute**: It is configured in the IdP application to inform the Service Provider application about the locale of a particular user; for example: Fr-fr or, FR\_fr * **Using the drop-down option**: It is present on the logon screen of the ePO application * Available as the default locale of the tenant **Using the Logon with IdP Feature** 1. After configuration, click the Log On with IDP option on the ePO logon page (Service Provider initiated SSO), or click the configured application in the IdP console (Identity Provider initiated SSO), to test the logon option. On successful authentication, a page displays with the following message: _SAML authentication is successful_. 2. Close your browser to end your session and contact your administrator for ePO permissions grant. 3. Request the ePO administrator to grant the required permissions. A new user is created in ePO with a user name which is like the email address used in your IdP application, the authentication type is set to SAML authentication, and no permission sets are assigned. An administrator must log on to the ePO console and assign the required permissions to the newly created (IdP) user. **Importing the Root Certificate** ePO uses SSL for communication between the console and the Tomcat web server, so a certificate is required. When you log on, you are prompted to accept a security certificate. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FKbwPLxj2KmLKF7IbCMYS%252Fimage.png%3Falt%3Dmedia%26token%3D878e6cb8-14b3-4d65-9eaa-002fa687d907&width=768&dpr=4&quality=100&sign=ef7d78cc&sv=2) 1. Log on to the ePO server. The Certificate Error page appears. 2. Click **Continue to this website**. 3. Click **Certificate Error**. 4. Click **View Certificates**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Fa1z5VbvgvyxJIWb2oz9J%252Fimage.png%3Falt%3Dmedia%26token%3D08a4d597-ff02-4ff6-8385-afb1bf1e648b&width=768&dpr=4&quality=100&sign=d1c4ff6e&sv=2) 1. Click **Certification Path** tab. 2. Select the **Orion\_CA\_Name\_of\_Server** certificate and then click **View Certificate**. 3. Click **Install Certificate**. 4. Browse and select **Local Computer** as the physical **store**. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/post-installation-tasks#viewing-editing-port-assignments) **Viewing/Editing Port Assignments** Use this page (**Menu** > **Configuration** \> **Settings**) to review and change selected port assignments for communication between the server, the agent, and other components. Click on the information (i) icons for more detailed information regarding each port. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FzIHpd1aw8vVVfpGlVvqX%252Fimage.png%3Falt%3Dmedia%26token%3D9f2d31db-0078-43d1-a08b-4077a205dc8b&width=768&dpr=4&quality=100&sign=cdc26a27&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FI0RV6AERnB3D4ds8tHxx%252Fimage.png%3Falt%3Dmedia%26token%3D3d6ccdbc-f545-4d82-a533-c08dbc7e2a8f&width=300&dpr=4&quality=100&sign=65314b79&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FuU98c1AUbyrFUVNBbZR6%252Fimage.png%3Falt%3Dmedia%26token%3Dcd8c5b5d-36d4-4ca4-8c31-f26e8317bd83&width=300&dpr=4&quality=100&sign=ec008161&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F3mRxqaTonC476TqDtRfu%252Fimage.png%3Falt%3Dmedia%26token%3Dd056300d-55f7-4744-91b6-c990238474c1&width=300&dpr=4&quality=100&sign=af813a03&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FrD7DKMDgDh5DmXDtKgVU%252Fimage.png%3Falt%3Dmedia%26token%3Ddca72e51-858a-424c-b259-9023dd944255&width=300&dpr=4&quality=100&sign=28f81820&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FypvhOxZBta5k0jscZvvx%252Fimage.png%3Falt%3Dmedia%26token%3D8ec73b51-d56f-4422-8448-8c4cfd3b0dd8&width=300&dpr=4&quality=100&sign=83da582a&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FsVMTtFGhdpvsbkq3cpaX%252Fimage.png%3Falt%3Dmedia%26token%3D4d2c4afb-4981-4826-8085-e99a9ef5debb&width=300&dpr=4&quality=100&sign=eb77ee43&sv=2) **The Pre-Installation Auditor tool is embedded into the ePO installer by default and identifies port conflicts prior to the installation.** The figure below shows which ports you can change from this screen. Changes take up to one minute to take effect. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FHvogJzRFecyZoXPmlO3U%252Fimage.png%3Falt%3Dmedia%26token%3D98151fe7-dbcf-4ff4-89bb-e12542c657ed&width=768&dpr=4&quality=100&sign=fb817b16&sv=2) **IMPORTANT**: Disabling the Agent-server communication secure port is **NOT** recommended as this breaks the agent-to-server communication until the agents are re-installed. Additionally, upon reinstallation, agents are forced to use a less secure, non-TLS communication path to ePO. For information about changing ports, see these Technical Articles: * [**KB72936**(opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content&id=KB72936) : How to change ePO Agent-to-Server Communication secure port * [**KB52141**(opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content&id=KB52141) : How to change the ePolicy Orchestrator Console-to-Application Server communication port ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/post-installation-tasks#configuring-epo-for-multiple-nics) **Configuring ePO for Multiple NICs** If the ePO server is multihomed (has multiple IP addresses), it is recommended to force the server to be bound to the correct interface. The server IP address is used by the master repository and for agent-server communication. If this address is not provided, the IP address of the first NIC in the binding order is used. 1. Open **C:\\Program Files (X86)\\McAfee\\ePolicy Orchestrator\\DB\\server.ini**. 2. Modify the \[server\] section of the file by adding this line: 1. **ServerIPaddress=** 2. Example: **ServerIPaddress=192.168.1.203** 3. Save and close the server.ini file. 4. Restart all ePO services. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/post-installation-tasks#basic-installation-troubleshooting) **Basic Installation Troubleshooting** Should you have problems with your install, use this methodology to help identify the cause. * Ensure minimum installation requirements are met. * Review Release Notes. * Review relevant Technical Articles. * Verify account and permissions. * Collect exact text of all messages. * Write down any message codes. * Review any installer log files (%temp%\\McafeeLogs\\). [PreviousPre-Installation Auditor Tool](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/pre-installation-auditor-tool) [NextUpgrade](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/installation-and-upgrade/upgrade) Last updated 1 year ago --- # Extension and Package Management | Trellix ePolicy Orchestrator - On-prem 5.1 ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/extension-and-package-management#installing-and-updating-extensions-manually) **Installing and Updating Extensions Manually** If you previously downloaded product components (for example, for ePO extensions), you can install or update them manually. This is a two-step process: * Install extensions * Check in deployment packages ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FCrflJrfEFH5bpjsDg4Bb%252Fimage.png%3Falt%3Dmedia%26token%3D2bb491c4-0c35-4283-83b3-6cc455fd2fef&width=768&dpr=4&quality=100&sign=8cd5ee68&sv=2) _**Menu**_ \> _**Software**_ \> _**Extensions**_ * * * Extension files for products or components are in a zip file. To install an extension manually, complete these steps from the ePO console: 1. Select **Menu** \> **Software** > **Extensions** to open the Extensions page. 2. In the top left corner, click **Install Extension**. The Install Extension dialog box appears. 3. Click **Browse** and browse to and select the desired extension (ZIP) file. Place the extension file in a location that is accessible to the client browser. 4. Click **OK**. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/extension-and-package-management#verifying-installed-updated-extensions) **Verifying Installed/Updated Extensions** After the installation is complete, verify the product name appears in the Extensions list in the left page. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FrcbQC9OLxgufLlPY_ChRNpU1NpPbkLfHE.png&width=768&dpr=4&quality=100&sign=babc0784&sv=2) Select (highlight) the extension name in the left page (Example: Endpoint Security) to see information about it in the right pane. This information includes: * **Name**: Lists the name of the extension. * **Version**: Specifies the version of the currently selected extension. **Note**: Multiple versions of the same extension can be installed. * **Installed by**: Specifies the user who installed the currently selected extension. * **Status**: Identifies whether the extension was installed successfully. If it was not installed successfully, any errors are identified. * **Requires**: Specifies any extensions that the currently selected extension depends on. * **Details**: Lists details of extension installation. * **Modules**: Specifies the modules that are controlled by this extension and whether they are running. This is valuable for troubleshooting. * **Remove**: Removes the selected extension from the Extensions list. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/extension-and-package-management#removing-extensions-manually) **Removing Extensions Manually** Click on each number below to see the process for manually removing extensions. ![Remove ext manually.png](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FD9pR2PPV94tGZ-AJ_KokYxsCzNppB3S8x.png&width=768&dpr=4&quality=100&sign=7360a1f8&sv=2) 1. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FGtNZPux93Hs7mFuErJzR%252Fimage.png%3Falt%3Dmedia%26token%3Dbafc814f-1fe9-406a-bb28-7f74e5c558df&width=300&dpr=4&quality=100&sign=8ca06498&sv=2) 2. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FcTeiguxBrU4mvJudufut%252Fimage.png%3Falt%3Dmedia%26token%3Dbc489c6c-544a-4c1b-892e-7f60aaf60f58&width=300&dpr=4&quality=100&sign=99816895&sv=2) 3. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FZRZI2QV1qXEyXVws8Q4O%252Fimage.png%3Falt%3Dmedia%26token%3D63904d8b-3094-44c0-b978-925ecbdf65ad&width=300&dpr=4&quality=100&sign=eef91068&sv=2) > ### > > [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/extension-and-package-management#card-title-12) > > Adding and Updating Packages Manually > > The ePO Main Repository is physically located on the ePO server in the ePO software installation directory (\\DB\\Software). It is always the primary repository for the ePO environment. As part of the deployment, you must check the package into the ePO Main Repository. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FydSmHUVFgufESm2PMomc%252Fimage.png%3Falt%3Dmedia%26token%3D8b96ba1c-501c-44e9-a7d5-be768a097199&width=768&dpr=4&quality=100&sign=bcdd0888&sv=2) From the Menu page, select **Software** \> **Main Repository**. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/extension-and-package-management#card-title-14) Step 2 Title ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FHbPyGfQ10QXEjFOKZ9IW%252Fimage.png%3Falt%3Dmedia%26token%3De6d8c90c-b6aa-464b-8df0-9369c13ffc7c&width=768&dpr=4&quality=100&sign=7476d8df&sv=2) Click **Check In Package**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FZtHMb3GLVd7bNhItp0G4%252Fimage.png%3Falt%3Dmedia%26token%3Df371dcb8-ab95-4313-bae5-acce17dc74b7&width=768&dpr=4&quality=100&sign=f9afc65f&sv=2) * For Package type, make sure Product or Update (.ZIP) is selected. * Click **Browse.** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Fd03ui7sbnBemdxk6MTvc%252Fimage.png%3Falt%3Dmedia%26token%3D5eeca30c-5bc5-4d7b-9a69-a6d42fba1f9a&width=768&dpr=4&quality=100&sign=18711c34&sv=2) * Navigate to the zipped packed path and select the .ZIP package file. Do not unzip the package. * Click **Open**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FyJcItzqklDLvzQB92fc7%252Fimage.png%3Falt%3Dmedia%26token%3D0d2fbbd5-0f54-4a6e-b55d-0585b1e479bd&width=768&dpr=4&quality=100&sign=dbeedfac&sv=2) On the **Check In Package** dialog, make sure the selected package displays in the text box and then click **Next**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FVfSQWqpkt7YUkbG2Hs96%252Fimage.png%3Falt%3Dmedia%26token%3D3eb1f84b-614c-4be4-b488-cc0ef2878aeb&width=768&dpr=4&quality=100&sign=69885917&sv=2) * Review the information about the package, including Name, Version, Type, and Language. * For Branch, make sure **Current** is selected. * Notice the package is signed. * Click **Save**. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/extension-and-package-management#card-title-19) Summary ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F294tCCZuGYnIGKsFbGP0%252Fimage.png%3Falt%3Dmedia%26token%3D24ed8915-bb18-4386-aef9-1ac03a889651&width=768&dpr=4&quality=100&sign=9e821299&sv=2) * Wait while the package is adding to the Main Repository. You are returned to the Main Repository after the process is complete. * Locate the product in the list. Review key information, such as _Status_, _Type_, _Version_, _Minor Version_, _Check-In Date_, and _Branch_. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/extension-and-package-management#removing-packages-manually) **Removing Packages Manually** To manually remove a software package from the ePO console, do the following: 1. Click **Menu** \> **Software** \> **Main Repository**. 2. Select the package you want to remove. 3. Expand the **Actions** entry at the bottom. 4. Click **Delete Package**. 5. On the _Delete Package_ confirmation screen, verify the package information to remove and click **OK**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FG40Km3vGlJFibIpM_D5bwYTTqHixdc7HZ.png&width=768&dpr=4&quality=100&sign=d794d0e0&sv=2) **Check the Audit Log (**_**Menu > Reporting > Audit Log**_**) to verify removal of extensions and packages.** [PreviousSoftware Catalog](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/software-catalog) [NextProduct Deployment](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/product-deployment) Last updated 1 year ago --- # Creating a Custom Properties Client Task Simulation | Trellix ePolicy Orchestrator - On-prem 5.1 Welcome to the Create a Custom Properties Client Task simulation. In this simulation, you will create a new custom properties client task for the Servers group, overwriting current system values with IT Servers Custom Property 1. _For better visibility, adjust the browser Zoom settings to 125% or greater._ ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FBHuVcxp4KoJmYG6B5qnc%252Fimage.png%3Falt%3Dmedia%26token%3Dc09a490c-4629-4217-b713-fceca0899380&width=300&dpr=4&quality=100&sign=1b002163&sv=2) [PreviousClient Task Management](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/client-task-management) [NextModule Summary](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/module-summary) Last updated 1 year ago --- # Module Summary | Trellix ePolicy Orchestrator - On-prem 5.1 ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/module-summary#key-points) **Key Points** * ePO simplifies the process of deploying products to the managed systems in your network by providing a user interface to configure and schedule deployments. * From the Software Catalog, you can download, check in, update, and remove managed product components from your server. * There are two processes you can follow to deploy products using ePO: product deployment projects and client tasks. * Client tasks automate system management activities, such as product deployment, upgrades, and updates. * Client tasks can be assigned at any level in the System Tree and are inherited by groups and systems lower in the tree. As with policies and policy assignments, you can break the inheritance for an assigned client task. * You can export and import client tasks for use with other ePO servers. * The Client Task Catalog is used to add and manage client tasks. * The Client Task Comparison tool is used to compare client tasks that are similar, allowing you to determine which settings are different and which are the same. * * * ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/module-summary#in-the-next-lesson-you-will-learn-how-to-manage-policies-in-epo) In the next lesson, you will learn how to manage policies in ePO. [PreviousCreating a Custom Properties Client Task Simulation](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/creating-a-custom-properties-client-task-simulation) [NextModule Intro](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/module-intro) Last updated 1 year ago --- # Module Summary | Trellix ePolicy Orchestrator - On-prem 5.1 ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/module-summary#key-points) **Key Points** * User accounts allow you to control how people access and use ePO. * While user account and permission sets are closely related, they are created and configured using separate steps. * ePO contains default permission sets to assign or use as templates. * For quick migration, define permission sets and then export and import them to other servers. In the next lesson, you will learn about ePO Dashboards, queries, and reports. [PreviousCreating a New Permission Set Simulation](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/creating-a-new-permission-set-simulation) [NextModule Intro](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/module-intro) Last updated 1 year ago --- # Module Intro | Trellix ePolicy Orchestrator - On-prem 5.1 User accounts allow you to control how people access and use ePO. While user accounts and permission sets are closely related, they are created and configured using separate steps. In this module, you will learn about the default permission sets that ePO provides, guidelines on using permission sets, and how to create, customize, and manage permission sets. You will also learn how to create and manage user accounts, the different options for account authentication, and ways to automate user account management, such as using Active Directory. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/module-intro#module-objectives) **Module Objectives** By the end of this module, you should be able to: * Define user accounts and permission sets * Configure settings for users and permission sets * Edit, disable, and delete user accounts * Edit and export permission sets * Create users and assign permission sets [PreviousModule Summary](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/module-summary) [NextUser Accounts](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/user-accounts) Last updated 1 year ago --- # ePServer Configuration | Trellix ePolicy Orchestrator - On-prem 5.1 ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration#server-settings) **Server Settings** All the necessary settings specific to your ePO server are in Server Settings. The available entries here allow you to fine-tune you ePO server based on the needs of your organization. Customizations made here affect all your ePO users. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FuX1BxRgBvhjwo6N0XGO6%252Fimage.png%3Falt%3Dmedia%26token%3Dfc7a39af-6e4c-4cfe-b0a3-6782cdc1b959&width=768&dpr=4&quality=100&sign=84da4f35&sv=2) _**Menu**_ \> _**Configuration**_ \> _**Server Settings**_ #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration#password-policy) **Password Policy** The ePO 5.10 release added the Password Policy feature, which allows you to define the strength of a password. For example, an administrator can restrict the number of previously used passwords and limit the number of days before the password expires. To use this feature, administrators must manually enable these settings via the Password Policy setting category in Server Settings as this feature is not enabled by default. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FdyXBCSqDUh1ePAropOI8%252Fimage.png%3Falt%3Dmedia%26token%3D06f955d5-3ecd-466e-806f-a9a4ebe3c4c7&width=768&dpr=4&quality=100&sign=facff91&sv=2) Select the **Password Policy** Setting Category, then click **Edit**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Fndw5U4vEMt8zEbTUUK7b%252Fimage.png%3Falt%3Dmedia%26token%3Da96612cb-017e-4848-bb5d-ac57daea8a70&width=768&dpr=4&quality=100&sign=5411de2a&sv=2) Once enabled, available options for this feature include: * Password Strength **Criteria**: Passwords can be defined as having 7-30 characters, and must contain at least one of the following characters: * Uppercase * Lowercase * Numeric * Special * **Password Expiration Criteria**: Expiration dates from 30-365 days can be configured before a password expires #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration#logon-protection) **Logon Protection** The ePO 5.10 release also added the ability to set user account lockouts based on multiple logon attempts or restrict access via IP address management thru the Logon Protection server setting. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FtKzl6h8NTpD9diOcSeJm%252Fimage.png%3Falt%3Dmedia%26token%3D331efce6-c944-4bca-83b7-23393cd34339&width=768&dpr=4&quality=100&sign=d1393b20&sv=2) * Select the **Logon Protection** Setting Category, then click **Edit.** * Click on the **Automatic Responses** link under **Notifications** to create you own customizable default response to failed logon attempts. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F7itC6rbR1U92FH2jrMVg%252Fimage.png%3Falt%3Dmedia%26token%3Da4c3d2c5-67cb-4252-a8d2-d93bf1fa2b87&width=768&dpr=4&quality=100&sign=8f555ab7&sv=2) Enable these features to provide added logon protection: * **Lock Out User Accounts**: Enable this feature to lock out a user account after the configurable failed attempts is met. * **Restrict IP Addresses**: Enable this feature to automatically block an IP address if 10 or more failed attempts occur in under 60 seconds. * * * #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration#queries-page) **Queries Page** **Queries** is a new category introduced in the Server settings page. Use the Queries page to set the maximum number of elements that display in the following chart types: * Single-Line Chart * Bar Chart * Stacked Bar Chart * Single Group Summary Table * Bubble Chart ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FvjvWCGcz9rMSJCquDmzq%252Fimage.png%3Falt%3Dmedia%26token%3Dcbcf4081-24a0-47b7-82ba-7bef1601c247&width=768&dpr=4&quality=100&sign=21fdcff6&sv=2) **Higher number of elements may affect query and chart performance. You can set the maximum limit up to 2000 for any of the chart types.** #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration#email-encryption) **Email Encryption** **Email Encryption (TLS support)** is a new setting on the **Email Server** page in the Server Settings. * Provides the secure channel (SMTP over TLS) for email support in ePO * Allows you to enable/disable the TLS support * When you enable this option, the port number in **SMTP server port** updates from an existing port number to 587 ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FhTfqZdTGkEbYM6meNW3m%252Fimage.png%3Falt%3Dmedia%26token%3D8fa433df-7bc2-48fa-a7a6-fd1a9f0eb732&width=768&dpr=4&quality=100&sign=f4ac16d&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration#server-information) **Server Information** The Server Information Settings page specifies Java, OpenSSL, and Apache server information for the ePO and database server, such as name, IP address, and version information. You can export the Server Information page details to a CSV file. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FlnQc9K2ljNh0Q4r5eQjF%252Fimage.png%3Falt%3Dmedia%26token%3D97a0c120-1696-4778-934e-56e600254e5f&width=768&dpr=4&quality=100&sign=f64da6&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration#personal-settings) **Personal Settings** **Personal Settings** in the ePO console allows you to customize the ePO server to your environmental needs. To configure Personal Settings, go to **Menu** \> **Configuration** \> **Personal Settings**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FA28HmHchxrmGN415vGSD%252Fimage.png%3Falt%3Dmedia%26token%3D54fbc6fa-5fc2-4449-92e0-c2cbcd0893c0&width=768&dpr=4&quality=100&sign=2af4f9a&sv=2) In **Personal Settings**, you can modify items such as: * **Appearance**: Provides the ability to change the display color of a selected entry in the console * **Password**: This option is no longer available from within Personal Settings; see the “Change Password” entry under the Help icon on the banner bar * **Queries and Reports Warning**: Determines whether a warning message appears when you try to drag a query from one query group to another * **System Tree Settings**: Determines whether a warning message appears when you try to drag systems or groups from one System Tree group to another. Enable auto-expand (default) of System Tree nodes when moving one system to another. * **Tables**: Identifies how often auto-refreshed tables are refreshed during your session * **Time Zone Preference**: Provides the ability to set the desired time zone for your ePO server * **User Session**: Controls the length of time that your user session remains open after you stop interacting with the user interface * * * ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration#registered-servers) **Registered Servers** Various types of additional servers in a customer environment can be registered in the ePO server, allowing you to integrate ePO with other external servers. To configure these external servers, go to **Menu** \> **Configuration** \> **Registered Servers**. **Registered servers are servers that work with your ePO server to support or add functionality. When you install ePO for the first time, no other servers are registered with your ePO server.** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FHZKZYG87XsdDK23QHDcO%252Fimage.png%3Falt%3Dmedia%26token%3Df3e56da7-7238-4872-96a8-22b8f1d91958&width=768&dpr=4&quality=100&sign=437575e8&sv=2) Click **New Server** to create a new registered server, or click **Action** to delete or edit an existing registered server. You can register several types of servers with your main ePO server, including: * **LDAP servers**: Registering this type of server allows you to use Policy Assignment rules to dynamically enable assigned permission sets and to enable Active Directory (AD) User Login; Active Directory servers are an example of LDAP servers that can be used to synchronize and import systems from an AD server to the ePO System Tree. * **Other ePO servers**: Registering this type of server allows you to collect or aggregate data or transfer managed systems between the registered servers. * **SNMP servers**: Registering this type of server allows ePO to know where to send the trap to so it can receive the trap info. * **Syslog servers**: Registering this type of server allows ePO to forward events received from clients to the syslog server. * **Additional, remote, database servers**: Registering this type of server allows you to retrieve data from the database in queries, reports, dashboard monitors, and server tasks. * * * **See the** [_**Registered Servers**_(opens in a new tab)](https://docs.trellix.com/bundle/epolicy-orchestrator-5.10.0-product-guide/page/GUID-946575D1-FA11-4B1A-B872-5DC6FDE8AA2C.html) **section in the ePO 5.10 Product Guide for additional details on registering servers in ePO.** * * * ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration#agent-handlers) **Agent Handlers** #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration#what-are-agent-handlers) **What are Agent Handlers?** Agent Handlers are an ePO server component that handle communication between Agent and an ePO server. Each installation of ePO includes an Agent Handler. Agent Handlers can be deployed independently on systems throughout your network. These servers should be on the same network as the ePO server and not on a remote network across a WAN link. * By default, the ePO server acts as an Agent Handler. * Agent Handlers helps offload the demand on the ePO server. * They can help scale the ePO infrastructure and reduce the load on the ePO server. * They can take care of all the ASCI communication. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration#how-agent-handlers-work) **How Agent Handlers Work** Managed system is assigned to Agent Handler[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration#managed-system-is-assigned-to-agent-handler) Agent Handlers distribute network traffic, which is generated by an agent-to-server communication interval (ASCI), by assigning managed systems or groups of systems to report to a specific Agent Handler. You can assign single system or groups of systems, as well as have distinct groups assigned to different Agent Handlers. System performs regular ASCI[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration#system-performs-regular-asci) After assignment, a managed system performs regular agent-server communication to its Agent Handler instead of to the main ePO server. Like the ePO server, communications between agents and Agent Handlers are over an Industry‑standard Transport Layer Security (TLS) network protocol for secure network transmissions. Agent pulls necessary files and information from its Agent Handler[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration#agent-pulls-necessary-files-and-information-from-its-agent-handler) The Agent Handler provides updated sitelists, policies, and policy assignment rules to clients. The handler also supplies repository content to clients configured to update from the master repository. The agent handler on the ePO server provides the content directly; additional agent handlers cache files from the main repository as clients request them. When an agent requests content from its handler, if the handler does not have the files needed, the handler retrieves them from the Main Repository and passes them to the agent. The files are cached on the additional agent handler so that subsequent requests for the same file do not require additional traffic from the Main Repository. Repositories[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration#repositories) * By default, requested repository files are cached in C:\\Program Files (x86)\\McAfee\\ePolicy Orchestrator\\DB\\RepoCache directory on the ePO server or remote Agent Handler. * The primary ePO server (i.e., the system that has the ePO Application Server service installed) hosts the Main Repository. * Agent Handlers transparently handle requests for software and cache the required files after downloading from the main repository. * No configuration is necessary. Data Channel[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration#data-channel) * API extension for Trellix products integration * Mechanism for Trellix products to exchange messages between their endpoint plugins and their management extensions * Agent properties, tagging, and policy computation performed directly against database #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration#logical-epo-infrastructure) **Logical ePO Infrastructure** An Agent Handler is installed as a part of the primary ePO server. This is sufficient for many small ePO installations. For larger and more complex networks, you can distribute services across the network by installing additional Agent Handlers. * These additional Agent Handlers co-exist within a single logical ePO infrastructure. * You can deploy Agent Handlers on separate hardware or virtual machines that coexist within a single logical ePO infrastructure. * An Agent Handler installation includes only the Trellix ePO Server service (Apache Server) and Trellix ePO Event Parser service. * The Trellix ePO Server service communicates with the Trellix Agent, receives updated events and properties from the agents, and sends updated policies and tasks as assigned by administrators in the ePO console. * The Trellix ePO Event Parser service receives events from the Trellix ePO Server service, which in turn receives them from the clients. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FYjOi6vfFkhIY1TAjQJyq%252Fimage.png%3Falt%3Dmedia%26token%3Dd0c71c3f-776f-45d7-a6eb-cc26612fbb43&width=768&dpr=4&quality=100&sign=c6c23da5&sv=2) **Agent Handler Requirements** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FmIGepr7svvdldyAze9uI%252Fimage.png%3Falt%3Dmedia%26token%3Df958fa59-f01c-4c64-a748-c8be2e4a4219&width=768&dpr=4&quality=100&sign=7a7f4c87&sv=2) Agent Handlers can be installed on virtual infrastructure systems, such as VMware ESX. Their hardware and software requirements and CPU load are approximately the same as an ePO server. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration#important-notes) **Important Notes** * Agent Handlers (AH) are NOT a solution to low bandwidth. * An additional Agent Handler with low bandwidth to the SQL server has WORSE performance than just having agents connect to the ePO server. * A single Agent Handler with a poor connection to SQL will have a massive performance impact on the whole ePO infrastructure, not just the clients it is handling. * When one AH is interacting with the database, the other AHs are locked out. The AH with the poor connection locks the database for large amounts of time, preventing the other AHs from working. * Agent Handlers MUST have a high-speed connection to the SQL server and a stable connection to the SQL server database. * If the database serving the ePO server is under heavy load, adding Agent Handlers will not help. * You may need to upgrade your SQL server hardware to take advantage of multiple Agent Handlers. * Agent Handlers should be co-located with the SQL server and never installed in “remote” locations. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration#required-ports) **Required Ports** Installing the Agent Handler server hardware, software, and configuring the firewall ports are the first steps before using ePO to manage systems behind a DMZ. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FECt5APEzN4dPyFbsVGsy%252Fimage.png%3Falt%3Dmedia%26token%3D2490654e-c4f9-4ddc-ab77-31458cd797fb&width=768&dpr=4&quality=100&sign=ec76e69d&sv=2) 1. Build the Agent Handler server hardware with the Microsoft Windows server Operating System. 2. In the DMZ of your firewall protected network, install the Agent Handler server hardware and Microsoft Windows server operating system. 3. Configure your Domain Name System (DNS) server to host the Agent Handler server to the internal ePO network. 4. Configure these ports on the _internal-facing_ firewall to communicate between the ePO server and the Agent Handler in DMZ: 1. **Port 80** — Bidirectional 2. **Port 8443** — Bidirectional 3. **Port 8444** — Bidirectional 4. **Port 443** — Bidirectional 5. **Optional**: If your SQL database is installed on a different server than your ePO server, configure these two ports on the _internal-facing_ firewall to connect to the Agent Handler: 1. **Port 1433 TCP** — Bidirectional 2. **Port 1434 UDP** — Bidirectional 6. Configure these ports on the _public-facing_ firewall to communicate between the ePO server and the Agent Handler in the DMZ: 1. **Port 80 TCP** — Inbound 2. **Port 443 TCP** — Inbound 3. **Port 8081 TCP** — Inbound 4. **Port 8082 UDP** — Inbound Now you have installed your Agent Handler hardware and server operating system in the DMZ. Plus, you configured all ports to connect through the firewall, between the ePO server and database to the Agent Handler server. **See** [**KB66797**(opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content&id=KB66797) **for additional information regarding ePO port requirements for firewall traffic.** #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration#agent-handler-deployment) **Agent Handler Deployment** The figure below shows the workflow for an Agent Handler deployment. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FjLt3E10yw9VAh9OKNS7l%252Fimage.png%3Falt%3Dmedia%26token%3D359f7bf1-3418-45e0-8cb5-4b4bc9d6d64e&width=768&dpr=4&quality=100&sign=615dd871&sv=2) **Updating the ePO Server and the Agent Handlers** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F2QAeGqQyMQT6K5PJwnNl%252Fimage.png%3Falt%3Dmedia%26token%3Dd87b9a93-eb0f-4630-89e4-68187d8a10e1&width=768&dpr=4&quality=100&sign=52154ca6&sv=2) **The ePO server and the Agent Handler must be at the same patch level. The Agent Handler checks the database version every 30 seconds and disables itself if a different schema is found.** #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration#configuring-agent-handlers) **Configuring Agent Handlers** After the installation is complete, your next step is to set up Agent Handlers in your network and assign Trellix Agents to them. Agent handler management is performed from the Agent Handlers page. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FHwOQz4NgJjo20l0WvTon%252Fimage.png%3Falt%3Dmedia%26token%3D3a42c6fb-dc88-4b3a-84bb-dcdf54faac0b&width=768&dpr=4&quality=100&sign=6f9b6165&sv=2) **Tasks** * Create Agent Handler groups * Manage Agent Handler groups * Assign Trellix Agents to Agent Handlers * Manage Agent Handler assignments * Move agents between handlers **Agent Handlers Page** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FFi2LXcxUyWKas8S7RCXt%252Fimage.png%3Falt%3Dmedia%26token%3D3a13cd97-27f9-464e-bca7-f7632c414066&width=768&dpr=4&quality=100&sign=b23fde4b&sv=2) _**Menu**_ \> _**Configuration**_ \> _**Agent Handlers**_ * * * The Agent Handlers page consists of four monitors: 1. **Handler Status**: Specifies the number of active and out-of-date handlers 2. **Systems per Agent Handler**: Specifies the number of agents assigned to each Agent Handler 3. **Handler Groups**: Specifies the number of Agent Handler groups that the ePO server manages 4. **Handler Assignment Rules**: Displays the list of Agent Handler assignments in your environment, their priority, and details about rule settings Click the active areas in each monitor to drill down and view more details about the systems informing each monitor. Actions within the Agent Handler Confirmation page are: **At the top of the page:** * **New Assignment**: Opens the Agent Handler Assignment page. Use this to create a new Agent Handler Assignment * **Edit Priority**: Opens the Edit Priority page. Use this page to change priority of the Agent Handler Assignments **By using the Actions Button in the Handler Assignment Rules window:** * **Import**: Imports a previously exported Agent Handler Assignment list * **Export**: Opens the Download Agent Handler Assignment page. Use this to download an xml file containing the Agent Handler Assignment list **Handler Assignment Rules: Row Actions**: Specifies the actions you can perform on selected Agent Handler assignments, including: * **To Edit**: Click the blue hyperlink Assignment name to open the Edit Assignment page. Use this to edit the settings of the selected Agent Handler Assignment * **Delete**: Deletes the selected agent ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration#certificate-manager) **Certificate Manager** As discussed in the previous lesson, the Certificate Manager is another part of the basic server configuration. The latest certificates are loaded by default with a fresh installation of ePO, but if you have upgraded from an older version of ePO, ensure you migrate the ePO certificates to the latest hash algorithm. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FuRqTzb7Qw61slIeIjmur%252Fimage.png%3Falt%3Dmedia%26token%3D369e1b45-3562-482e-889c-ce85a1e750d1&width=768&dpr=4&quality=100&sign=ed85e2d0&sv=2) _**Menu**_ \> _**Configuration**_ \> _**Certificate Manager**_ * * * The Certificate Manager allows you to: * Migrate certificates that are signed by older signing algorithm to the new algorithm such as SHA-1 to SHA-256 * Regenerate your certificates when your existing certificates are compromised due to vulnerabilities in your environment * Migrate or regenerate certificates for managed products that are derived from ePO root CA ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration#registered-executables) **Registered Executables** The registered executables you configure are run when the conditions of a rule are met. Automatic Responses trigger the registered executable command to run. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FgQvjwFIsMJiwi5pgaK1Z%252Fimage.png%3Falt%3Dmedia%26token%3D92311ecb-ddf1-45ff-a8d5-4596c295e41a&width=768&dpr=4&quality=100&sign=420c67b&sv=2) _**Menu**_ \> _**Configuration**_ \> _**Registered Executables**_ * * * * **You can only run registered executable commands on console applications.** * **You must be on the local server system when adding or editing a registered executable in the ePO console.** [PreviousModule Intro](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/module-intro) [NextSystem Tree](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/system-tree) Last updated 1 year ago --- # Duplicating and Editing a Policy Simulation | Trellix ePolicy Orchestrator - On-prem 5.1 Welcome to the Duplicating and Editing a Policy simulation. In this simulation, you will create a custom policy for Trellix Agent. The Default General policy meets most of your needs, so you will duplicate and edit it to fit your specific requirements. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FWNgcvUVcbW7yhLPPMOMp%252Fimage.png%3Falt%3Dmedia%26token%3D18291d50-f9b2-4e5d-a34e-cea98684cd69&width=768&dpr=4&quality=100&sign=97b833de&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FnAOS908UQ4QlOyKbEIg7%252Fimage.png%3Falt%3Dmedia%26token%3Dd26f7125-0c16-40c0-84b5-f7084a951fb4&width=768&dpr=4&quality=100&sign=3dc9f37d&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FsivqSeqwmfV69AU8P2BE%252Fimage.png%3Falt%3Dmedia%26token%3D0d0315a4-d7b5-469b-bd59-34fb627b87b7&width=768&dpr=4&quality=100&sign=fb785828&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FZZUoCYfSteYe2Bv2Qtud%252Fimage.png%3Falt%3Dmedia%26token%3Db01d5227-0531-43eb-a41f-7843fe00dd27&width=768&dpr=4&quality=100&sign=20f86c23&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FnAi6q7fGB8wxNH77Zp7j%252Fimage.png%3Falt%3Dmedia%26token%3Df37266f5-98e8-428d-95c6-4518c671bfb4&width=768&dpr=4&quality=100&sign=1d466b1b&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FlN8dyhgKB4datO33PN8j%252Fimage.png%3Falt%3Dmedia%26token%3Deec73557-cde4-4ee9-b034-8c489a98ce7d&width=768&dpr=4&quality=100&sign=e051f1cf&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FcQgU3uACNvcfJXO0sxDT%252Fimage.png%3Falt%3Dmedia%26token%3Dc4adeebc-bb1e-40a2-823b-465b8956d50d&width=768&dpr=4&quality=100&sign=ea73133b&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FT57ScigC3tWlbXLLgoqk%252Fimage.png%3Falt%3Dmedia%26token%3De348cd91-d77e-4007-922a-bbaf7f358d22&width=768&dpr=4&quality=100&sign=75b44ecd&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FteQMxU7mPHSYsAheyPqO%252Fimage.png%3Falt%3Dmedia%26token%3D5f4f7f59-82b8-45c4-bf86-f139aa7ba133&width=768&dpr=4&quality=100&sign=934f9145&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FDz8UkUkuu2Ueh7tuYGit%252Fimage.png%3Falt%3Dmedia%26token%3D6fb9a8d9-f20b-4c1b-8811-7d63693edcd9&width=768&dpr=4&quality=100&sign=6dd76e5a&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FyKRSfpocKYsbbSd82eHP%252Fimage.png%3Falt%3Dmedia%26token%3D4b75fa82-57d1-4823-a174-0b3dbce806a2&width=768&dpr=4&quality=100&sign=4a98392d&sv=2) [PreviousPolicies Overview](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview) [NextModule Summary](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/module-summary) Last updated 1 year ago --- # Module Intro | Trellix ePolicy Orchestrator - On-prem 5.1 After ePO is deployed, it is important to monitor your network’s security status on an ongoing basis. Keeping constant watch on your environment is a difficult task. Dashboards help you do this. ePO comes with its own querying and reporting capabilities, which are customizable, flexible, and easy to use. In this module, you will learn the about the types of dashboards included with ePO that you can use immediately, how to create and customize dashboards, and recommendations for designing dashboards. You will learn how permissions control dashboard access and use and factors that impact dashboard load time. You will also learn how to use queries and reports to gather information about activities that occur on your ePO server and throughout your network. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/module-intro#module-objectives) **Module Objectives** By the end of this module, you should be able to: * Identify the purpose of dashboards and monitors, as well as features and capabilities * Identify default dashboards included with ePO * Add and duplicate a dashboard * Edit and assign dashboard permissions * Query the ePO database * Use the Query Builder to create your own queries * Configure query permissions * Export query data to view outside of ePO * Identify the report management process [PreviousModule Summary](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/module-summary) [NextePO Dashboards](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/epo-dashboards) Last updated 1 year ago --- # User Accounts | Trellix ePolicy Orchestrator - On-prem 5.1 ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/user-accounts#overview) **Overview** User accounts are another important user management feature and provide a means for users to access and use the ePO console. Each user account is associated with one or more permissions sets which determine rights and access to ePO. There are two types of users: * Administrators with permissions to all products and features * Users with defined access based upon the permission set their account is assigned to ![Menu > Users Management > Users](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FkV8ekZkFogD_hku6PzTOAw%2F1694489439%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DTW9uIFNlcCAxMSAxNTozMDozOSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2Fspf-Rk7KgUuwNVd0_dq3NMaaQwnmXX8K9.png&width=768&dpr=4&quality=100&sign=8b17dd39&sv=2) _**Menu**_ \> _**Users Management**_ > _**Users**_ The figure below shows the User page. _**Click on the information (i) icons for detailed information on each field.**_ ![Users Page.png](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FkV8ekZkFogD_hku6PzTOAw%2F1694489439%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DTW9uIFNlcCAxMSAxNTozMDozOSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2Fs1fufIbZu5I5-a_N_ceZszMD_6biwCDV7.png&width=768&dpr=4&quality=100&sign=fa54d9c2&sv=2) 1. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FnMJuPWn0oXdkxUVGhqEB%252Fimage.png%3Falt%3Dmedia%26token%3D4a8c6e16-1070-47b4-b9ad-8d93e3a0d0b5&width=300&dpr=4&quality=100&sign=88e47a39&sv=2) 2. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FTVj5YTxaiWeSogCPrMPv%252Fimage.png%3Falt%3Dmedia%26token%3Dec797d25-7f04-481d-9f86-276c0eb4fe77&width=300&dpr=4&quality=100&sign=ec2a4eab&sv=2) 3. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FhRTBsdhmYhOIfueGPV9e%252Fimage.png%3Falt%3Dmedia%26token%3D79622583-3f6c-441e-a451-f38c5c21cc38&width=300&dpr=4&quality=100&sign=75d8422&sv=2) 4. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FNz5NhlxwGOnEiAtIPeLs%252Fimage.png%3Falt%3Dmedia%26token%3D0d9351a5-61f1-4705-9d46-70585323b688&width=300&dpr=4&quality=100&sign=5625479f&sv=2) 5. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FkxScWpsh99mT6ogeJW69%252Fimage.png%3Falt%3Dmedia%26token%3D28f44b59-10a4-4b5c-95c4-619fa71429cd&width=300&dpr=4&quality=100&sign=e63ff074&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/user-accounts#creating-user-accounts) **Creating User Accounts** Complete the steps in the workflow below to create user accounts. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FkV8ekZkFogD_hku6PzTOAw%2F1694489439%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DTW9uIFNlcCAxMSAxNTozMDozOSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2F3fgV1CQwOdOVVMd6_bZb1ldRFUof-xI4l.png&width=768&dpr=4&quality=100&sign=26074800&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/user-accounts#editing-disabling-and-deleting-user-accounts) **Editing, Disabling, and Deleting User Accounts** To edit a user account: 1. Select **Menu** \> **User Management** > **Users** to open the Users page. 2. Select (highlight) the source under the Users column, then select **Actions** > **Edit**, **Disable**, or **Delete**. 3. Make any necessary changes to the account and click **Save**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FkV8ekZkFogD_hku6PzTOAw%2F1694489439%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DTW9uIFNlcCAxMSAxNTozMDozOSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FXzJY0rIbfrs1oaHC_TPwq6OLTrtIolKD7.png&width=768&dpr=4&quality=100&sign=b3425478&sv=2) [PreviousModule Intro](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/module-intro) [NextPermission Sets](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/permission-sets) Last updated 1 year ago --- # System Tree | Trellix ePolicy Orchestrator - On-prem 5.1 The System Tree is one of the most important pieces of your managed environment. It is the logical representation of your managed environment. Your System Tree dictates: * How your policies for different products are inherited * How your client tasks are inherited * What groups your systems go into ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/system-tree#system-tree-overview) **System Tree Overview** The ePO server is responsible for managing exactly one System Tree. The System Tree contains all of the systems that ePO manages. A system is a managed machine, a server, workstation, laptop or an appliance. Within the System Tree, each system is represented by its NetBIOS name. Internally to ePO, each system is represented by its Globally Unique Identifier (GUID). You can open the page two ways: * Click the **System Tree** category on the navigation bar * Select **Menu** \> **Systems** \> **System Tree** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FnW66ieIMuCagEiPM8rvg%252Fimage.png%3Falt%3Dmedia%26token%3D78edb070-0cd0-4365-a508-060836ae7b04&width=768&dpr=4&quality=100&sign=d767762&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/system-tree#hierarchical-structure) **Hierarchical Structure** The System Tree initially contains two containers (groups), but lets you create additional groups to meet your organizational needs. These groups display in the tree in a hierarchical manner. * **My Organization**: Top-level (root) group. **It cannot be renamed or deleted**. All systems are organized within it in logical containers called groups and subgroups. * **Lost and Found**: Default subgroup where systems with unknown locations are placed. It always appears last in the list and is not alphabetized among its peers. It cannot be renamed or deleted. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FJnDvPQOqugHY7HE8q2kX%252Fimage.png%3Falt%3Dmedia%26token%3D2174867d-632d-4fe4-b432-e62944a72bb0&width=768&dpr=4&quality=100&sign=b22e645&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/system-tree#groups) **Groups** Although you can add all systems into one group in the System Tree, a flat list makes setting different policies for different systems very difficult, especially for large networks. By grouping systems, you can manage their policies in one place, rather than individually. You also can schedule system tasks (such as update of virus definition files) at any level of the System Tree, as well as sort systems by IP address or tags. You can group systems based on: * Machine-type: Laptops, servers, or desktops * Geography: North America or Europe * Political Boundaries (Organization Departments): Finance or Development * Any other logical criteria that supports your needs ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FsRg7qzcIw6PVhPjfjfSo%252Fimage.png%3Falt%3Dmedia%26token%3D2aea9c7a-0b20-445a-9c0a-df58822c2345&width=768&dpr=4&quality=100&sign=48afe2a8&sv=2) **As a best practice, create only as much structure as is useful for the functionality of your ePO environment.** ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/system-tree#building-the-system-tree) **Building the System Tree** During this process, you create the groups to hold your managed systems and then add your systems to the appropriate groups. The groups you add are always subgroups within the top-level My Organization group. There’s no single way to build your System Tree. Because every network is different, your System Tree organization can be as unique as your network layout. You can use more than one method to build and organize the System Tree, as shown in the figure below. **Inheritance** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F3v7qrk9FQhmfCAOPg6yY%252Fimage.png%3Falt%3Dmedia%26token%3D3d3dee27-bedb-4f26-8250-cff4481fc44d&width=768&dpr=4&quality=100&sign=53953620&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FxkXuiDeOFjaGADMSq1up%252Fimage.png%3Falt%3Dmedia%26token%3D71cfad4f-9c61-4849-a60b-0a5445724adf&width=768&dpr=4&quality=100&sign=7755e2fa&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/system-tree#adding-groups-subgroups-and-systems-manually) **Adding Groups/Subgroups and Systems Manually** #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/system-tree#adding-groups-manually) **Adding Groups Manually** The manual build process is useful where no formal Microsoft environment exists (Example: using a NetWare-based network) or when the Microsoft Networking environment does not map well to the anti-virus management structure that you require. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FM39WoyWWwKY0cS17g8DR%252Fimage.png%3Falt%3Dmedia%26token%3D03c80a61-f6ee-4841-b2ca-b36b117f7938&width=768&dpr=4&quality=100&sign=88f90a43&sv=2) 1. From the **System Tree**, select a parent group. If this is the first group, the parent is **My Organization**. 2. Click the **New Subgroups** box at the top of the page, or select **System Tree Actions** > **New Subgroups**. 3. In the **Name** box, enter the group name, and click **OK**. If adding multiple groups, separate the names with a comma. 4. The new group appears in the System Tree. Repeat as necessary until you are ready to populate the groups with the desired systems. **After you add a system, note it initially has an** _**Unmanaged State**_**. You must wake up agents on the systems to change the status to** _**Managed**_**. The Agent Wakeup process is discussed in more detail later in the course** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FQsHs6hNYZ3y5COiMLOic%252Fimage.png%3Falt%3Dmedia%26token%3D4775dfdd-3b1f-4150-a458-a77452d25b04&width=768&dpr=4&quality=100&sign=f34ce047&sv=2) Whatever group is highlighted is the one the action will be applied to, so when selecting New Subgroups the new groups will appear under the highlighted group. * * * **When adding more than one group at a time, the groups should be separated by commas.** #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/system-tree#adding-systems-manually) **Adding Systems Manually** To add systems manually, click on the **New Systems** button on the System Tree page. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F1AhAf86RLSrDIKaLCC0j%252Fimage.png%3Falt%3Dmedia%26token%3D704b316e-fa8a-4803-8b05-295a508178dc&width=768&dpr=4&quality=100&sign=7aa9cf1b&sv=2) * In this example, the systems are added and the Trellix Agent is pushed at this time. * The systems will shows as Unmanaged in the System Tree until the agent is installed and has reported back to ePO that the installation is complete. * * * From the **New Systems** page in the **How to add systems** section, select one of these options. **Note**: The fields on the page vary, depending on your selection. * **Push agents and add systems to the current group**: Adds systems and deploys agent * **Push agents and place systems in the System Tree according to sorting criteria**: Deploys agents to the specified systems in the groups of the System Tree, according to sorting criteria * **Add systems to the current group (TechLearn), but do not push agents**: Adds systems but does not deploy agent * **Create and download agent installation package**: Creates a custom agent installation package in which you can embed credentials for the installation. The package can be distributed to managed node users for self-install. The package (FramePkg.exe or install.sh) is created when you install ePO or check in an agent package. **Note**: Node users require administrative privileges to install the agent. * **Import systems from a text file into the selected group, but do not deploy agents**: Imports systems from a properly generated text file but does not deploy agents to these systems * **Create URL for client-side agent download**: The administrator can create and distribute a custom agent URL to managed node users for self-install. Each user copies and pastes the URL into a browser. The user is directed to a specific site to download an installation package, then uses the Smart Installer to install the agent. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/system-tree#importing-system-tree-structure) **Importing System Tree Structure** Another way to manually build the System Tree is with the **Import Tree Structure** function on the **System Tree** > **Group Details** tab. Using this function, you import a text file saved to a temporary directory on the ePO server. You can add systems to existing groups or subgroups, as well add new groups, subgroups, and/or systems. Systems added to the System Tree have an unmanaged state until after an agent wakeup. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FgiAWSCA84Urmw3oY6GNW%252Fimage.png%3Falt%3Dmedia%26token%3De4089ede-90de-40ac-8980-fc1490f1d98d&width=768&dpr=4&quality=100&sign=d1fad046&sv=2) * From the **Group Details** tab in the System Tree, select **Actions** \> **Import Tree Structure**. * Import a text file from a temporary directory on the server. **Note**: The text file must use UTF-8 file encoding to correctly import system names with double-byte or extended characters in them. There are third-party utilities available that can export a list of your computers into a text file. Windows 2000 and above provides CSVDE.EXE and LDIFDE.EXE, that you can use to export Active Directory objects, such as computers. * * * ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/system-tree#moving-groups-and-systems) **Moving Groups and Systems** After you populate your system tree, you can move the existing groups/subgroups and systems. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Fr6CvBHranytjpmDTlCBh%252Fimage.png%3Falt%3Dmedia%26token%3D5633c1ec-aecd-49ec-8dd5-a79965cd295b&width=768&dpr=4&quality=100&sign=8c9d4bec&sv=2) 1. Locate the system in the System Tree. 2. Mark the checkbox for the system. 3. Select **Directory Management** \> **Move Systems**. A page displays a list that resembles your tree structure. 4. Select the new group or subgroup for the system. 5. Click **OK**. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/system-tree#customized-option-for-system-tree-groups-expand-and-collapse) **Customized Option for System Tree Groups Expand and Collapse** * Allows Enable/Disable for auto expanding of System Tree groups * New option to support System Tree structure customization (only when moving one system to another system) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FDEqG8dOnsJ0cidkyGxzP%252Fimage.png%3Falt%3Dmedia%26token%3D897888bf-8377-4353-babf-e849ad33fb49&width=768&dpr=4&quality=100&sign=372257e2&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/system-tree#nt-domain-synchronization) **NT Domain Synchronization** This feature lets you populate your System Tree automatically by synchronizing entire NT domains with specified groups. This approach is an easy way to add all systems in your network to the System Tree simultaneously. The systems are imported as a flat list with no system descriptions. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/system-tree#nt-domain-synchronization-overview) **NT Domain Synchronization Overview** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FZOv2QzPeSkDbJHIUy9lP%252Fimage.png%3Falt%3Dmedia%26token%3D0f29f324-25ba-4ace-b5e2-2b1486e26221&width=768&dpr=4&quality=100&sign=4d1d8668&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/system-tree#synchronizing-nt-domains) **Synchronizing NT Domains** If you are using containers within your ePO Directory, that correspond exactly with the name of domains or workgroups with your browse list, you can use the Synchronize Domains task to add and delete systems, manually or automatically, to or from these groups. You can only synchronize the contents of domains or workgroups, within the browse list, with groups of the same name. If the domains or workgroups selected during task creation do not exist in the ePO System Tree, they are automatically added as groups. If there is an existing group with the same name as a domain or workgroups you select, the computers in the domain are added to that group. In addition to placing the system into the ePO Directory, the Synchronize Domains task will install the Trellix Agents. _**Click on the information (i) icons for detailed information on each field.**_ ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FGa7EhN5mXK7gnAj6Ab7V%252Fimage.png%3Falt%3Dmedia%26token%3Dc1ce5e24-28bb-48c5-8b60-37c813a96e4c&width=768&dpr=4&quality=100&sign=1c7a8288&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FayCLIHWljubyzs4TIQ80%252Fimage.png%3Falt%3Dmedia%26token%3D22cb08de-16f3-4302-9ffb-2bbb02f5fe5e&width=300&dpr=4&quality=100&sign=515f5d71&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FXhjSulXOM20Q6l7EBzFd%252Fimage.png%3Falt%3Dmedia%26token%3De1a480ca-0ad3-4e72-89e5-78e32617bcf0&width=300&dpr=4&quality=100&sign=ace3f1e2&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F4jXAwOpbhGkHSpe175MU%252Fimage.png%3Falt%3Dmedia%26token%3D179c10c1-5d96-4f21-86a5-d0cdd6d0d6fd&width=300&dpr=4&quality=100&sign=21a5f820&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FDBtFtsJWRRLMJljgfX2B%252Fimage.png%3Falt%3Dmedia%26token%3Db41c8d36-b417-4225-bbed-eebedfffd1c2&width=300&dpr=4&quality=100&sign=ef07aca3&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FauHrAI8UAP6F05PJATqo%252Fimage.png%3Falt%3Dmedia%26token%3D0fa156c6-27ec-4891-9c60-536505e692c2&width=300&dpr=4&quality=100&sign=3e71f6f7&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FsyVkuGL9gH8nFQ0ExZAo%252Fimage.png%3Falt%3Dmedia%26token%3D9904e6ef-1b82-47d0-96ce-3dc4b77b74d7&width=300&dpr=4&quality=100&sign=7615efa5&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FqoSs4lmhiTGnbKpWMpv8%252Fimage.png%3Falt%3Dmedia%26token%3D9e7fc63b-578b-4869-be37-f944c6b98ed8&width=300&dpr=4&quality=100&sign=c8eb0030&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FpgHNCRkDsUDSGvorCwhP%252Fimage.png%3Falt%3Dmedia%26token%3D210c7b0a-8b20-4a44-a749-c70b1f87f493&width=300&dpr=4&quality=100&sign=d6ce2619&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F3UzrQyDRa845g0gnFA3T%252Fimage.png%3Falt%3Dmedia%26token%3D5bc23dee-afc7-4397-80b4-76006b2867be&width=300&dpr=4&quality=100&sign=aef6b9f&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/system-tree#configuring-agent-pushing-settings-if-selected) **Configuring Agent Pushing Settings (if selected)** If you select **Push agents to new systems when they are discovered**, configure the **Agent Push Settings**. Click the **Configure Settings** button to display the Agent Push Settings page. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FX17EY0cseBycMgnwBNIo%252Fimage.png%3Falt%3Dmedia%26token%3D50b13429-772d-46ed-88e5-a92fb1736f6c&width=768&dpr=4&quality=100&sign=adcc76cc&sv=2) Select the agent version to install, decide which systems to include in the agent push, and determine the path that the agent files will be installed to on the client machine. In addition, you must provide local administrator credentials for installing the agent. Set the number of installation attempts desired, as well as the retry interval. * **Installation options**: Specifies the agent installation options available, including: * **Install only on systems that do not have an agent**: Sends the agent installation package only to systems without an agent installed. When deselected, sends the agent installation package to all selected systems, regardless of whether the agent is already installed on them. * **Force installation over existing version**: Replaces existing agents within the selected group with the selected versions. This option is not available when you select Install only on systems that do not have an agent. * **Push Agent Using**: Select the connection used for the deployment as either: * **Selected Agent Handler**: Select the server from the list. * **All Agent Handlers**: Use all handers. _**This feature applies to the Active Directory and NT Domain Synchronization features.**_ * * * **It is recommended that you do not deploy the agent during the initial import if the domain is large. Deploying the Trellix Agent package to many systems at once may cause network traffic issues. Instead, import the domain, then deploy the agent to smaller groups of systems at a time, rather than all at once. However, once you have deployed agents, consider revisiting this page and selecting this option after the initial agent deployment, so that the agent is installed automatically on any new systems that are added to the group (or its subgroups) through domain synchronization.** #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/system-tree#active-directory-synchronization-overview) **Active Directory Synchronization Overview** This feature is designed for networks with an existing Active Directory. Like NT Domain Synchronization, it lets you import systems only as a flat list; however, it also lets you import systems and the Active Directory container structure to ensure your System Tree mirrors your Active Directory. It also imports system descriptions. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FzX8YTCLOAM8rMBSBDEvR%252Fimage.png%3Falt%3Dmedia%26token%3Dfc6e1ce9-6fe7-4f67-8e05-74acf6b73ed2&width=768&dpr=4&quality=100&sign=75148b16&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/system-tree#registering-ldap-server) **Registering LDAP Server** A registered LDAP server is required. If your server is not registered, complete this step prior to configuring AD Synchronization. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F3BudF08yw5LgbO6kQYcC%252Fimage.png%3Falt%3Dmedia%26token%3Ddbf3b1e2-0f2d-453b-9252-efc8b99b1065&width=768&dpr=4&quality=100&sign=233a304e&sv=2) _**Menu**_ \> _**Configuration**_ \> _**Registered Servers**_ \> _**New Server**_ * * * #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/system-tree#synchronizing-active-directory) **Synchronizing Active Directory** If you are using containers within your ePO Directory that correspond exactly with the name of domains or workgroups in your browse list, you can use the Synchronize Domains task to add and delete systems, manually or automatically, to or from these groups. You can only synchronize the contents of domains or workgroups within the browse list with groups of the same name. If the domains or workgroups selected during task creation do not exist in the ePO System Tree, they are automatically added as groups. If there is an existing group with the same name as a domain or workgroups you select, the computers in the domain are added to that group. In addition to placing the system into the ePO Directory, the Synchronize Domains task will install the agents. _**Click on the information (i) icons for detailed information on each field.**_ ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FB24B1GaCBO6RCH3LCouw%252Fimage.png%3Falt%3Dmedia%26token%3D38ffa511-6e98-4df4-a306-df4bb4d58c74&width=768&dpr=4&quality=100&sign=91c13bf0&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FlF19KK3omSYwUeYbfgJM%252Fimage.png%3Falt%3Dmedia%26token%3Db1033a57-1786-424a-bea2-83231af78fe2&width=768&dpr=4&quality=100&sign=3e7d716d&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/system-tree#maintaining-synchronization) **Maintaining Synchronization** After you specify Active Directory Synchronization or NT Domains at the Group level, you can continually maintain the listing of computers contained in the console tree by running an **Active Directory Synchronization/NT Domain** server task or by manually updating the synchronized group. This task synchronizes selected Windows NT domains and Active Directory containers that are mapped to System Tree groups. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FC7WyFaSyxCyvtngfyV4Q%252Fimage.png%3Falt%3Dmedia%26token%3Ddc59f489-955b-40ab-84d5-e437ca9a3fe2&width=768&dpr=4&quality=100&sign=95c7173d&sv=2) _**Menu**_ \> _**Automation**_ \> _**Server Tasks**_ > _**New Task**_ [PreviousePServer Configuration](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/epserver-configuration) [NextTag Management](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/server-configuration/tag-management) Last updated 1 year ago --- # Creating a New Permission Set Simulation | Trellix ePolicy Orchestrator - On-prem 5.1 ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F4MM9wv4Vv8SeQZkIld8C%252Fimage.png%3Falt%3Dmedia%26token%3Dbd6c9049-62e8-41eb-9973-368d56c6841c&width=768&dpr=4&quality=100&sign=11f0558c&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F1d1CB3oiK7YH2NNIuHZ1%252Fimage.png%3Falt%3Dmedia%26token%3Dc889ba8c-e8f1-4487-a38d-fa48f52688f8&width=768&dpr=4&quality=100&sign=6e5486e&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FbcIvep7bEjMrON4liasS%252Fimage.png%3Falt%3Dmedia%26token%3D62274668-2d36-409f-bcb9-1e4b00b1b5a0&width=768&dpr=4&quality=100&sign=f950a958&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FAqmXJb41i3GJWcGoPmkI%252Fimage.png%3Falt%3Dmedia%26token%3D3877ab35-d34d-426a-8419-f671f8416683&width=768&dpr=4&quality=100&sign=eeb3c155&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FlEcClBVCxUCSk7XqgcUV%252Fimage.png%3Falt%3Dmedia%26token%3D9736b578-35b6-4708-8168-2c74a0a84264&width=768&dpr=4&quality=100&sign=1b166435&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FjkGxRzHoKTknQrWlhWup%252Fimage.png%3Falt%3Dmedia%26token%3D9abd22a3-bdb7-4867-81b1-1ed90263819c&width=768&dpr=4&quality=100&sign=e59053d7&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FP1Y7Wu2U3UbPZCcyRMiE%252Fimage.png%3Falt%3Dmedia%26token%3Dabfd9b26-61cf-4b4c-902e-3b9748078362&width=768&dpr=4&quality=100&sign=abdf7eb&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FfwSQg0R3oiQ2gyjbbuUL%252Fimage.png%3Falt%3Dmedia%26token%3Dfe49f756-2ef3-4d6b-99a2-3c1b05be1e3d&width=768&dpr=4&quality=100&sign=631bb230&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FvO3lI1k2hWJkMmUfYljA%252Fimage.png%3Falt%3Dmedia%26token%3Dc1dfdc73-8fb5-460c-a753-c58821aabfe5&width=768&dpr=4&quality=100&sign=8fc62c51&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FepWCxj9uoOOcn0hndxyt%252Fimage.png%3Falt%3Dmedia%26token%3D8e4cef40-da39-479e-adb4-046a1a40bd09&width=768&dpr=4&quality=100&sign=e5c1eca5&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F0UfK6GUecypWUb8i1DIF%252Fimage.png%3Falt%3Dmedia%26token%3D2202a4e8-4513-426c-8f3d-b994b40849ba&width=768&dpr=4&quality=100&sign=626e90ce&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FoiTJ8xbIEYfJpngT14DX%252Fimage.png%3Falt%3Dmedia%26token%3Dc868c3fc-0199-47cd-a127-e3d713020a2c&width=768&dpr=4&quality=100&sign=82435745&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FUNZ7CD72nTQWqf7qS9qQ%252Fimage.png%3Falt%3Dmedia%26token%3Da27f48ad-d5ed-4f71-a3d1-279b0362d2c9&width=768&dpr=4&quality=100&sign=9fe8023d&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FKpZ11iQ7NxkQR9uMLuMm%252Fimage.png%3Falt%3Dmedia%26token%3Da680df36-a4f0-430c-8f75-43ff22d57cf3&width=768&dpr=4&quality=100&sign=3702ef57&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FvzOHSifdvK7TY69tyuDA%252Fimage.png%3Falt%3Dmedia%26token%3D196467a3-a482-44b5-9a92-60c0467c8b33&width=768&dpr=4&quality=100&sign=9c571586&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F6snHI9kYibOUgbIlRSyy%252Fimage.png%3Falt%3Dmedia%26token%3D75220552-2fa4-4b29-95db-ce707b546c65&width=768&dpr=4&quality=100&sign=b98d3ded&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FdJU3avVb4AljCBY88PMD%252Fimage.png%3Falt%3Dmedia%26token%3D7364b27f-7e94-42eb-bb3d-abb4f8ce0be1&width=768&dpr=4&quality=100&sign=b3b77d&sv=2) [PreviousContacts](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/contacts) [NextModule Summary](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/module-summary) Last updated 1 year ago --- # Permission Sets | Trellix ePolicy Orchestrator - On-prem 5.1 ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/permission-sets#overview) **Overview** A permission set is a group of permissions, divided in sections, that grants a set of rights and access to a user. The following default permission sets are included with ePO, for immediate assignment or for use as a template for customization: * **Executive Reviewer**: Provides view permissions to dashboards, events, contacts, and can view information that relates to the entire System Tree * **Global Reviewer**: Provides view access globally across functionality, products, and the System Tree, except for extensions, multi-server roll-up data, registered servers, and software * **Group Admin**: Provides view and change permissions across ePO features. Users, who are assigned this permission set, each need at least one more permission set that grants access to needed products and groups of the System Tree. * **Group Reviewer**: Provides view permissions across ePO features. Users, who are assigned this permission set, each need at least one more permission set that grants access to needed products and groups of the System Tree. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FkV8ekZkFogD_hku6PzTOAw%2F1694489439%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DTW9uIFNlcCAxMSAxNTozMDozOSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FXz0p3cfE1UhMAEKa_6hWSLGG1xpEQIRZz.png&width=768&dpr=4&quality=100&sign=76823322&sv=2) **The administrator can assign permission sets while creating a user account, when editing an existing user account, and when creating a new permission set. Administrators have permissions to all products and features and can create, edit, or delete permission sets. Users who are not administrators can do only those things permitted by their assigned permission sets.** ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/permission-sets#default-permission-sets) **Default Permission Sets** Each permission set grants a set of rights and access to any user to which the permission set is assigned. Remember, administrators always have the rights and access do everything in ePO. As a best practice, use these default permission sets as templates to create new ones that meet your needs. ![* Note: Users need to be assigned to at least one set, granting them permissions to desired products and groups.](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FkV8ekZkFogD_hku6PzTOAw%2F1694489439%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DTW9uIFNlcCAxMSAxNTozMDozOSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FV9HQyTGPP4nlnYmr_bKFAxX8-jcP1teTw.png&width=768&dpr=4&quality=100&sign=abdb0ea1&sv=2) \* **Note**: Users need to be assigned to at least one set, granting them permissions to desired products and groups. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/permission-sets#configuration-guidelines) **Configuration Guidelines** * Some permissions are exclusive to administrator. * Multiple permission sets aggregate combined rights and privileges. * Use default permission sets as templates. * You can map to Active Directory users using Active Directory groups. * Consider groups to support different access control levels. * New extensions may add new sections that require configuration for access. * Consider which products require users to have data access for queries. * For quick migration, export defined permission sets and import them to other ePO servers. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/permission-sets#duplicating-adding-or-deleting-permission-sets) **Duplicating, Adding, or Deleting Permission Sets** To duplicate, add, or delete a permission set, complete these steps: 1. Select **Menu** \> **User Management** > **Permission Sets** to open the Permission Sets page. 2. Take one of these actions: * **Duplicate**: Select (highlight) the source and then select **Actions** > **Duplicate**. * **Delete**: Select (highlight) the source and then select **Actions** > **Delete**. * **New**: Click **New Permission Set** button. 3. If duplicating or adding, type a meaningful name in the Name box, then click **OK** (if duplicate) or **Save** (if new). ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FkV8ekZkFogD_hku6PzTOAw%2F1694489439%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DTW9uIFNlcCAxMSAxNTozMDozOSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FGHuCEK5Y2qhPCUbR_fc1xa9C0ckOGE6KQ.jpg&width=768&dpr=4&quality=100&sign=e1452a94&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/permission-sets#authentication-types) **Authentication Types** Each authentication type has different configuration requirements. * **ePO Authentication**: ePO authentication uses the ePO account’s credentials. This is the default authentication method. You must enter and confirm a password. * **Windows Authentication**: If you use Windows authentication, enter the user’s Windows NT domain credentials. You can specify whether users authenticate: * Against the domain that your ePO server is joined to and any other domains that have a trust relationship (default) * Against a list of one or more domain controllers for domains that do not have a trust relationship * Using a Windows Internet Name Service (WINS) server to look up the appropriate domain controller **Note**: If you have domain controllers or a WINS server, you must configure the Windows authentication server setting. * **Certificate-based Authentication**: For certificate-based authentication, upload certificate file. This automatically adds the personal certificate subject Distinguished Name (DN). The ePO server must be configured to allow certificate-based authentication. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/permission-sets#permissions-exclusive-to-administrator) **Permissions Exclusive to Administrator** The following are permissions exclusive to the administrator: * Create, edit, or delete source and fallback repositories * Change server settings * Add and delete user accounts * Add, delete and assign permission sets Import events into ePO databases and limit events stored there **Administrators have all permissions to all products and features.** ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/permission-sets#card-title-2) Editing Permission Sets After duplicating or adding a new permission set, you can edit selected sections, as required. ![82MJPK4WOwp_8I_2-Edit%2520Permission%2520Sets_1.png](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FkV8ekZkFogD_hku6PzTOAw%2F1694489439%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DTW9uIFNlcCAxMSAxNTozMDozOSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2F50gruWp9CA2eYzlB_zXYx5CQ5z2tQjI88.png&width=300&dpr=4&quality=100&sign=59f3d8a6&sv=2) In the left pane, make sure the duplicated or new permission set is selected (highlighted). ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FkV8ekZkFogD_hku6PzTOAw%2F1694489439%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DTW9uIFNlcCAxMSAxNTozMDozOSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2F2uBw_MlfRwcS65NJ_9-En8LrkUz8EbqvU.png&width=768&dpr=4&quality=100&sign=5c1ac0ee&sv=2) Click the **Edit** link for a specific section. Example: **System Tree access** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FkV8ekZkFogD_hku6PzTOAw%2F1694489439%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DTW9uIFNlcCAxMSAxNTozMDozOSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FnOVbWW2BXzkLQgMJ_O8szn3F3g2jth8-c.png&width=768&dpr=4&quality=100&sign=f8e8b8a0&sv=2) Modify the permissions, as required, then click **Save**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FkV8ekZkFogD_hku6PzTOAw%2F1694489439%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DTW9uIFNlcCAxMSAxNTozMDozOSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2F0X2_2mzPbJi0IeGe_pTU5grFTqjh24gPn.png&width=768&dpr=4&quality=100&sign=4301ebce&sv=2) Verify your changes display on the **Permission Sets** page. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/permission-sets#exporting-all-or-importing) **Exporting All or Importing** You can also export and import permission sets. * To export all permission sets into an XML file, click **Export All**. * To import permission sets from an XML file exported from this or another ePO server, click **Import**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FkV8ekZkFogD_hku6PzTOAw%2F1694489439%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DTW9uIFNlcCAxMSAxNTozMDozOSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FZ00osTFgMfWiVyY4_hjD1cRk4eikRdeYd.png&width=768&dpr=4&quality=100&sign=73850e6e&sv=2) [PreviousUser Accounts](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/user-accounts) [NextContacts](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/contacts) Last updated 1 year ago --- # Contacts | Trellix ePolicy Orchestrator - On-prem 5.1 ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/contacts#overview) **Overview** Contacts are primarily used as a selection option when creating automatic responses in ePO. Options available for Contacts include: * Creating a new contact * Edit existing contact * Delete an existing contact ![Menu > User Management > Contacts](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FkV8ekZkFogD_hku6PzTOAw%2F1694489439%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DTW9uIFNlcCAxMSAxNTozMDozOSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FDbvTJgDUTwFrUhSH_EgNzwA-vCtWiYih6.png&width=768&dpr=4&quality=100&sign=8a4da14f&sv=2) _**Menu**_ \> _**User Management**_ > _**Contacts**_ ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/contacts#contacts-in-automatic-responses) **Contacts in Automatic Responses** When creating and configuring an Automatic response in ePO, do the following to utilize the Contacts entries. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FkV8ekZkFogD_hku6PzTOAw%2F1694489439%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DTW9uIFNlcCAxMSAxNTozMDozOSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FAQAtRTI76RUxkLWW_yH1iS9bM6IlQVU_O.png&width=768&dpr=4&quality=100&sign=1775220&sv=2) 1. Create/edit the Automatic Response. 2. Click the **Actions** tab and select **Send Email** as the action to be performed. 3. Click the ellipsis next to **Recipients** and select the desired contact(s) entry. 4. Click **OK**. 5. Continue entering the automatic response information and click **Save**. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/contacts#creating-a-new-contact) **Creating a New Contact** To create a new contact in ePO: 1. Click **Menu** \> **User Management** > **Contacts**. 2. Click **New Contact**. 3. Enter in the first name of the contact in the **First name** field. 4. Enter in the last name of the contact in the **Last name** field. 5. Enter the contact email address in the **Email address** field. 6. Click **Save**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FkV8ekZkFogD_hku6PzTOAw%2F1694489439%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DTW9uIFNlcCAxMSAxNTozMDozOSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2Fv97BCkkU1-7wTKes_fct1OryDNuDegqub.png&width=768&dpr=4&quality=100&sign=f7a8dfa8&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/contacts#editing-and-deleting-contacts) **Editing and Deleting Contacts** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FkV8ekZkFogD_hku6PzTOAw%2F1694489439%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DTW9uIFNlcCAxMSAxNTozMDozOSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FgkoLfWB4VT_4QhdS_aPBTrOzJxLPtvLgj.png&width=768&dpr=4&quality=100&sign=a954c070&sv=2) To edit or delete an existing contact in ePO: 1. Click **Menu** \> **User Management** > **Contacts**. 2. Select the contact you want to edit or delete. 3. Click **Actions** \> **Edit** or **Delete**. 4. Enter the desired changes into the appropriate field(s) (if editing). 5. Click **Save**. [PreviousPermission Sets](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/permission-sets) [NextCreating a New Permission Set Simulation](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/user-management/creating-a-new-permission-set-simulation) Last updated 1 year ago --- # Module Summary | Trellix ePolicy Orchestrator - On-prem 5.1 ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/module-summary#key-points) **Key Points** * Plan a disaster recovery strategy. * If using a separate restore sever, its configuration should closely mirror your primary ePO server hardware. * Regularly take a Disaster Recovery Snapshot. * Regularly perform backup and copy backup file, storing them in a safe and secure location. * During an ePO software recovery installation, you must supply the Disaster Recovery Keystore encryption passphrase. * Remember, registered executable files are not backed up. You must replace those executable files when you restore the ePO server. In the next lesson, you will learn some basic techniques for troubleshooting ePO. [PreviousRunning a Disaster Recovery Snapshot Simulation](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/running-a-disaster-recovery-snapshot-simulation) [NextModule Intro](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/module-intro) Last updated 1 year ago --- # Module Summary | Trellix ePolicy Orchestrator - On-prem 5.1 ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/module-summary#key-points) **Key Points** * The Dashboards page displays monitors to help you manage, monitor, and act on the health of ePO-managed systems. * A monitor can be anything from a chart‑based query to a small web application. * ePO provides default dashboards for a quick start, but also lets you create custom dashboard to meet your own needs. * As you install additional extensions or products, additional dashboards are added to the list. * ePO ships with its own querying and reporting capabilities, which are highly customizable, flexible, and easy to use. * Reports combine queries and other elements into PDF documents, enabling focused, offline analysis. * Queries are essentially questions you ask ePO, and answers are returned in various forms of charts and tables. * ePO provides an easy, four-step wizard, called the Query Builder, that you use to create and edit custom queries. * Groups and permission sets control access to queries and reports. In the next lesson, you will learn how to use Disaster Recovery. [PreviousBuilding a Report Simulation](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/building-a-report-simulation) [NextModule Intro](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/module-intro) Last updated 1 year ago --- # Module Intro | Trellix ePolicy Orchestrator - On-prem 5.1 There are two basic ways to prepare your ePO environment for disaster recovery: * Disaster Recovery Snapshot Server task along with backup of the ePO database. * Manually using detailed steps identified in [KB66616(opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content&id=KB66616) . You can use the information in this lesson to help prepare and restore your ePO server back to a previous setting in the event of a disaster in your environment. In this module, you will learn about how to prepare your ePO server for automated and manual disaster recovery. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/module-intro#module-objectives) **Module Objectives** By the end of this module, you should be able to: * Describe the Disaster Recovery feature and how it works * Explain how to use a server task to take a regular Snapshot * Take a Snapshot from the Dashboard [PreviousModule Summary](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/module-summary) [NextDisaster Recovery Overview](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/disaster-recovery-overview) Last updated 1 year ago --- # Module Intro | Trellix ePolicy Orchestrator - On-prem 5.1 There are three basic types of logging files available to help troubleshoot ePO errors: * Agent * Installation * Server You can use the information in this lesson to help troubleshoot various types of ePO issues in your environment. In addition, you will learn about tools available for ePO troubleshooting. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/module-intro#module-objectives) **Module Objectives** By the end of this module, you should be able to: * Identify the three key logging types in ePO * Identify the main types of issues associated with the three main logging types * Troubleshoot basic issues by reviewing the identified log files for the associated issue * Identify the main tools used to troubleshoot ePO issues * Perform basic troubleshooting steps using these main tools [PreviousModule Summary](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/module-summary) [NextTroubleshooting using Log Files](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files) Last updated 1 year ago --- # Building a Report Simulation | Trellix ePolicy Orchestrator - On-prem 5.1 Welcome to the Building a Report simulation. In this simulation, you will build a new ENS: Detection Response and Full Scans report and place it in the ENS Reports private group. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FNsNXRIqagbkdVBszx9Di%252Fimage.png%3Falt%3Dmedia%26token%3D48d842cd-b1f2-4378-a5ff-b2e87ea9b4af&width=768&dpr=4&quality=100&sign=3635ad06&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FeKyeVIYB3ZSApxhvE9A2%252Fimage.png%3Falt%3Dmedia%26token%3De42736af-93ee-4106-b33c-aaafd83c2bab&width=768&dpr=4&quality=100&sign=e3e68c81&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FMuPiuOxJVtjtxk4fxl8r%252Fimage.png%3Falt%3Dmedia%26token%3Dec7fbdb6-b4f8-42cd-9c52-ec1b411adba2&width=768&dpr=4&quality=100&sign=f599abf5&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FbjXzblxF2MUTkgi7f2xd%252Fimage.png%3Falt%3Dmedia%26token%3D6a83fbb3-619c-4337-995f-a3f60eb95733&width=768&dpr=4&quality=100&sign=6bef8b47&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FV2PN8ZbMk1X206DCjFY8%252Fimage.png%3Falt%3Dmedia%26token%3Dd39eb1ab-ded1-47ac-bb52-ac1d90e9aa75&width=768&dpr=4&quality=100&sign=14d343a1&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FeTsrWxnJ6pO7tETboz4G%252Fimage.png%3Falt%3Dmedia%26token%3D28a4f948-c1f0-4f5e-8223-a846e1021903&width=768&dpr=4&quality=100&sign=d4c474a4&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F7RIhYeZ28IbyMWA2KIed%252Fimage.png%3Falt%3Dmedia%26token%3D8bd981cc-6cd7-4b61-81b4-d8f16f25a85c&width=768&dpr=4&quality=100&sign=a5aa5b54&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FpPbjUCC3jkkBwQwpbufc%252Fimage.png%3Falt%3Dmedia%26token%3D422cbf4c-94ba-439d-a9f0-9e56a5c93d56&width=768&dpr=4&quality=100&sign=c5674a33&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FBoFuPNV4hr26zw6rJe8v%252Fimage.png%3Falt%3Dmedia%26token%3D9182ee10-e86b-41dc-a328-5f4eefe27459&width=768&dpr=4&quality=100&sign=b66f16c0&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FDM46xM0bqaYmiWZoKLDE%252Fimage.png%3Falt%3Dmedia%26token%3D61486cab-3124-47ec-9601-18608e5efcd1&width=768&dpr=4&quality=100&sign=6ce5ded8&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F3whjO4bCYJKo92kh2XUC%252Fimage.png%3Falt%3Dmedia%26token%3D4eefcae6-bdf5-49bf-91ae-7b3158c76289&width=768&dpr=4&quality=100&sign=a30280a8&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FzdbsiVC91DVZzKOvFkF5%252Fimage.png%3Falt%3Dmedia%26token%3Dede8329b-9333-4908-bc13-2e85f65737aa&width=768&dpr=4&quality=100&sign=cda71940&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FujdS8nne3MrLKxnkB7Zy%252Fimage.png%3Falt%3Dmedia%26token%3D369bed54-aac5-4afa-bca5-9a0f99c21aca&width=768&dpr=4&quality=100&sign=2929d83a&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FIeixour2nfUttS87YMgj%252Fimage.png%3Falt%3Dmedia%26token%3Dfe1b9589-8923-4cbf-95bf-0cf5ba31adb9&width=768&dpr=4&quality=100&sign=62dc9931&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Fxz0yKNeoAQdBIUYIcZhW%252Fimage.png%3Falt%3Dmedia%26token%3D8254cc7d-57b3-41b4-badc-cc577b422e52&width=768&dpr=4&quality=100&sign=c1fc5d74&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FIghYKMY91Ryap3o6BjnB%252Fimage.png%3Falt%3Dmedia%26token%3D8115f2fa-9518-4a14-adb8-d9668cf007db&width=768&dpr=4&quality=100&sign=e6239f80&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FISNdSwpo1VXgLFfBz0CG%252Fimage.png%3Falt%3Dmedia%26token%3De606d08b-a63a-4b43-b6cb-20a4c6ecba3b&width=768&dpr=4&quality=100&sign=31c6445a&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FTCRfL9DITSW1v2s0KFlz%252Fimage.png%3Falt%3Dmedia%26token%3Dba15b242-af5e-4332-81ac-7e6e57b0cb5e&width=768&dpr=4&quality=100&sign=3597a502&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Fbizp2A8Bza15JsBDl914%252Fimage.png%3Falt%3Dmedia%26token%3De98a6128-0eb8-4cc5-a051-5afa04da1245&width=768&dpr=4&quality=100&sign=f77fde10&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FQuut0kD8YR5ZBNZQSvQL%252Fimage.png%3Falt%3Dmedia%26token%3Dbeb239a7-9d86-4c51-92a2-eab9f6e340ce&width=768&dpr=4&quality=100&sign=ca80387c&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FtIojTosH1L8xcFEcvAQS%252Fimage.png%3Falt%3Dmedia%26token%3Deb0c6c98-eb09-4072-baf0-706b63f4b9cd&width=768&dpr=4&quality=100&sign=79bb9152&sv=2) [PreviousCreating a New Dashboard Simulation](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/creating-a-new-dashboard-simulation) [NextModule Summary](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/module-summary) Last updated 1 year ago --- # Creating a New Dashboard Simulation | Trellix ePolicy Orchestrator - On-prem 5.1 Welcome to the Creating a New Dashboard simulation. In this simulation, you will create a new private product monitoring dashboard and monitors to the newly created dashboard. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Fop98wHKvYK4jZ55oAhXD%252Fimage.png%3Falt%3Dmedia%26token%3D1c632c18-fc56-4c27-a394-0f2d2c980c93&width=768&dpr=4&quality=100&sign=55c57a2c&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FUowX2u7xuaP5OhaokN7I%252Fimage.png%3Falt%3Dmedia%26token%3Defad0062-1ec6-4ef1-8714-f5d6d3f56145&width=768&dpr=4&quality=100&sign=4d9aab45&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FiqvTjQnelmQlB7MjMd9f%252Fimage.png%3Falt%3Dmedia%26token%3D13077814-5e77-4c7f-920e-4e8edc962c75&width=768&dpr=4&quality=100&sign=2762de1d&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FUqIcXMHAuBRJ3Wdp14yY%252Fimage.png%3Falt%3Dmedia%26token%3Dac694fe4-d59e-4c5f-bc1c-95ab30f886d0&width=768&dpr=4&quality=100&sign=5db41a27&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FESfOOUjaSRGfiFl2ZNUv%252Fimage.png%3Falt%3Dmedia%26token%3Da008da92-53b2-401c-a7ac-3007533b2b26&width=768&dpr=4&quality=100&sign=5a42557d&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FVVAe1Jk02WE2q0aOfjoz%252Fimage.png%3Falt%3Dmedia%26token%3D951cf1b7-cf63-4dab-adf4-f29e2fefb04e&width=768&dpr=4&quality=100&sign=295fa71&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FqEw3sI4CSQHH27kOtZ4V%252Fimage.png%3Falt%3Dmedia%26token%3D1321d365-ddff-4837-a166-878e8dcb467b&width=768&dpr=4&quality=100&sign=fa790928&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F1yL92lFgqWwLmQQ66TbP%252Fimage.png%3Falt%3Dmedia%26token%3Dac5cac42-74b7-4669-a105-8c7c3f1164f6&width=768&dpr=4&quality=100&sign=c48f3549&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FOZ6CJZaAig5UYsgm4f0X%252Fimage.png%3Falt%3Dmedia%26token%3D76829efc-ba7b-483b-8d12-74621f0da60c&width=768&dpr=4&quality=100&sign=8aeace97&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F2RW9t6x5HmbeOQyZWzns%252Fimage.png%3Falt%3Dmedia%26token%3D9bf57a7d-caa7-4396-89ce-60caa2393445&width=768&dpr=4&quality=100&sign=e4afe368&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FMX2VnRosrlj1OMjbPy9F%252Fimage.png%3Falt%3Dmedia%26token%3D4501f85d-77d4-4f68-b690-af9ba87b31b3&width=768&dpr=4&quality=100&sign=316e10c&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FScHvTiVxOmdzKNp0zEa3%252Fimage.png%3Falt%3Dmedia%26token%3D4b02c0dd-bb8e-43dd-8b68-536ea221a9aa&width=768&dpr=4&quality=100&sign=d9770914&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F3Sufp9asoZfQA9CLILqN%252Fimage.png%3Falt%3Dmedia%26token%3Dd849d400-cbbf-4656-8c15-6376019ada84&width=768&dpr=4&quality=100&sign=fb9c4dae&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Ff8Jp5Bv3BgILbBclkts6%252Fimage.png%3Falt%3Dmedia%26token%3D71c62420-8c84-4fb7-9306-cd490add10a8&width=768&dpr=4&quality=100&sign=bab4f46a&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FscJH2rEVtayDP3IBA5B7%252Fimage.png%3Falt%3Dmedia%26token%3D038b7076-e00e-4026-9605-eeb85fed310c&width=768&dpr=4&quality=100&sign=e5fd99c9&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FyKepi5ChqdxOCu8nhHSK%252Fimage.png%3Falt%3Dmedia%26token%3D99183877-36b2-4b72-b7ac-9b3cdfb00c5d&width=768&dpr=4&quality=100&sign=c9e506bd&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F0ViBomdzItU2CgvVvz1K%252Fimage.png%3Falt%3Dmedia%26token%3D49930c58-2d39-4365-bcec-65062deb79d6&width=768&dpr=4&quality=100&sign=96c6aed8&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Fd6ifPt0PEAfdXNMY6Zby%252Fimage.png%3Falt%3Dmedia%26token%3D31517a32-a438-47be-9785-f795a954d6e9&width=768&dpr=4&quality=100&sign=fd5d7b6d&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FEX3TNAeQLzwIxobzmEKE%252Fimage.png%3Falt%3Dmedia%26token%3Dc9df174f-f08d-44b2-8309-f73c91937e0b&width=768&dpr=4&quality=100&sign=d2ec7360&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FVsSH6tb7Feu9UbOSkLQh%252Fimage.png%3Falt%3Dmedia%26token%3D6207ad6a-1225-47d3-abf0-26f64e424c8e&width=768&dpr=4&quality=100&sign=c46fef7b&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Fun3m8mHRyMYxQVqUcD97%252Fimage.png%3Falt%3Dmedia%26token%3D45055f4d-3086-4f49-89e5-6d08846e5d88&width=768&dpr=4&quality=100&sign=387eaef8&sv=2) [PreviousReports](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/reports) [NextBuilding a Report Simulation](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/building-a-report-simulation) Last updated 1 year ago --- # Reports | Trellix ePolicy Orchestrator - On-prem 5.1 ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/reports#reports) **Reports** Generate reports to share information about your network environment with security administrators and other stakeholders. Reports are configurable documents that display data from one or more queries, drawing data from one or more databases. The most recently run result for every report is stored in the system and is readily available for viewing. You can restrict access to reports by using groups and permission sets in the same way you restrict access to queries. Reports and queries can use the same groups, and because reports primarily consist of queries, this configuration allows for consistent access control. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/reports#reports-page) **Reports Page** The Reports page specifies the actions you can perform on the selected reports. _**Click on the information (i) icons for detailed information.**_ ![Reports Page.png](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FyTfrVhuIHNPnmO1M_6WAEXxYYPciN3p7R.png&width=768&dpr=4&quality=100&sign=7e95d38f&sv=2) 1. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FHYC8EGBCiDBOgdl8IJrj%252Fimage.png%3Falt%3Dmedia%26token%3Dc352f4fa-b560-4358-9f5a-49ba5d067297&width=300&dpr=4&quality=100&sign=eb7632be&sv=2) 2. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FuuUNJPScv0ZHDKAkbmS9%252Fimage.png%3Falt%3Dmedia%26token%3Dd9ff3c31-39ac-4a9d-bd19-953d5cb5bde8&width=300&dpr=4&quality=100&sign=52b5a4ea&sv=2) 3. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FeEwEBinIq29nveSpEuLf%252Fimage.png%3Falt%3Dmedia%26token%3Dfb5a2c67-3f16-455a-8467-98fd0d7c5605&width=300&dpr=4&quality=100&sign=115db000&sv=2) 4. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FIZzRMvbV28R1esEgFeUy%252Fimage.png%3Falt%3Dmedia%26token%3Ddb07a673-d97c-4504-a5eb-4c15dae41679&width=300&dpr=4&quality=100&sign=38c446ee&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/reports#create-new-report-from-selection) **Create New Report from Selection** From the Query page, you can launch the Report Layout with the details of a selected query. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FzmTUrf1TzIYEUuA8_Q5rwancIzs3x_LjK.png&width=768&dpr=4&quality=100&sign=c57cced8&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/reports#report-structure) **Report Structure** Reports contain several elements held within a basic format. While reports are highly customizable, they have a basic structure that contains all the varying elements. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FyD2_XInReXic6UFo_fW4xhpIqHxSkFIWR.png&width=768&dpr=4&quality=100&sign=77015282&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/reports#page-elements) **Page Elements** Page elements provide the content of the report. They can be combined in any order and may be duplicated as needed. * Elements that ePO provides: * Images * Page breaks * Query Charts * Text * Query Tables * Dragged and dropped into report layout, then positioned * Can be combined in any order * Can be duplicated as needed ![Page elements.png](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FfOC5bHi6Bx5N5Hr9_zvPXxCB-ZaTt51R6.png&width=300&dpr=4&quality=100&sign=b3a284e3&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/reports#header-and-footer) **Header and Footer** There are six fixed locations within the header and footer that can contain different data fields: three are in the header, three in the footer. The header contains a left-aligned logo and two right-aligned fields, one above the other. These fields can contain one of four values: * Nothing * Date/Time * Page Number * User name of the user running the report The footer contains three fields. One left-aligned, one centered, and one right-aligned. These three fields contain the same values listed above, as well as custom text. ![By default, reports use the system setting for headers and footers. If you do not want this, deselect Use Default Server Setting.](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2Fol9Rxtquv3lV0Nuh_uyxJ7A3yhc1wwmhG.png&width=768&dpr=4&quality=100&sign=c7319459&sv=2) By default, reports use the system setting for headers and footers. If you do not want this, deselect **Use Default Server Setting**. To change the system settings for headers and footers, click **Menu** > **Configuration** \> **Server Settings**, then select **Printing and Exporting** and click **Edit**. ![Setting the Printing and Exporting settings in Server Settings will change the header/footer information globally for ePO. The settings for print and export are:Headers and footers for exported documents: Specifies the information and logo displayed on the headers and footers of the PDF or html reportEdit Logo: Takes you to the Edit Logo page, where you configure the logo used in the PDF or html with the exported dataDefault page size: Specifies the size of paper on which the PDF reports are printedDefault page orientation: Specifies whether information is displayed and printed as portrait or landscapeDirectory for scheduled exports: Specifies the location in the file system to which the file is saved](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FnTArClKV_hy7D7vo_jI0KSqFq86epjyNd.png&width=768&dpr=4&quality=100&sign=b0878f2c&sv=2) Setting the Printing and Exporting settings in Server Settings will change the header/footer information globally for ePO. The settings for print and export are: Setting the Printing and Exporting settings in Server Settings will change the header/footer information globally for ePO. The settings for print and export are: * **Headers and footers for exported documents**: Specifies the information and logo displayed on the headers and footers of the PDF or html report * **Edit Logo**: Takes you to the Edit Logo page, where you configure the logo used in the PDF or html with the exported data * **Default page siz**e: Specifies the size of paper on which the PDF reports are printed * **Default page orientation**: Specifies whether information is displayed and printed as portrait or landscape * **Directory for scheduled exports**: Specifies the location in the file system to which the file is saved ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FIVqSAuu26NAMeuv8zZco%252Fimage.png%3Falt%3Dmedia%26token%3De3d98486-98b6-4286-a678-a6811b22f833&width=768&dpr=4&quality=100&sign=59d26bb6&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FdrGG08KKTZ5vA0aV0Ljs%252Fimage.png%3Falt%3Dmedia%26token%3Dc066a976-d9e9-4f20-8b7b-c1f29536cee2&width=768&dpr=4&quality=100&sign=5d5bf94b&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FjIBgeZXA8jMhNzh241U5%252Fimage.png%3Falt%3Dmedia%26token%3D38194b42-decf-438f-a9ed-dc9e8e92ea31&width=768&dpr=4&quality=100&sign=d0dc2219&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F1O6qSB9f0qsafgmu33yF%252Fimage.png%3Falt%3Dmedia%26token%3Df5ac64ac-8cd1-4fdf-934f-d76a23e7beb2&width=768&dpr=4&quality=100&sign=7bc28510&sv=2) [PreviousQueries and Reports](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports) [NextCreating a New Dashboard Simulation](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/creating-a-new-dashboard-simulation) Last updated 1 year ago --- # Module Summary | Trellix ePolicy Orchestrator - On-prem 5.1 ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/module-summary#key-points) **Key Points** * There are three main logging types in ePO – Agent, Installer, Server. * Each of these logging types provide helpful details to assist in troubleshooting issues, such as agent connectivity, policy enforcement, installation & upgrade, Event Parser, and SQL issues. * There are various “free” external tools that can assist in troubleshooting basic ePO issues. [PreviousTroubleshooting Tools](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-tools) [NextCourse Summary](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/summary/course-summary) Last updated 1 year ago --- # Running a Disaster Recovery Snapshot Simulation | Trellix ePolicy Orchestrator - On-prem 5.1 Welcome to the Running a Disaster Recovery Snapshot simulation. In this simulation, you will run a disaster recovery snapshot from the ePO Dashboard, Trellix ePO Server Snapshot. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Fc8BMrFSW3nYvYddw4MfX%252Fimage.png%3Falt%3Dmedia%26token%3Dcdac7aa2-dc98-4bbb-8c36-880073372c1d&width=768&dpr=4&quality=100&sign=cd13a370&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FQUE8036d41kE0uuvds0H%252Fimage.png%3Falt%3Dmedia%26token%3D6209b126-fed1-4bfc-948a-1e143eb9ad6c&width=768&dpr=4&quality=100&sign=bea0b06c&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F64QQOPmfwHmnQgIQDlaM%252Fimage.png%3Falt%3Dmedia%26token%3D89556ce2-7e1e-450b-a420-133d83177efd&width=768&dpr=4&quality=100&sign=da5ee87a&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FG9toWCSXWAFhnYnYKdQe%252Fimage.png%3Falt%3Dmedia%26token%3D70e62bff-67c4-403d-822e-a806dbc37e9e&width=768&dpr=4&quality=100&sign=5385207d&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FpeEyiolMO44zq52nF4MM%252Fimage.png%3Falt%3Dmedia%26token%3Dfa6da02c-d7b2-4865-90f7-a8dd7cd99568&width=768&dpr=4&quality=100&sign=4e495f8d&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FiGFXRVhapdzWtZCWHzSS%252Fimage.png%3Falt%3Dmedia%26token%3D3d6c08e0-acc9-42e5-92d7-56af30302c51&width=768&dpr=4&quality=100&sign=2a589a43&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FnSKGjFpKVKaofMO3oX4b%252Fimage.png%3Falt%3Dmedia%26token%3Db5cd9ef2-c414-4f14-8659-bcb5aab1363a&width=768&dpr=4&quality=100&sign=885393dd&sv=2) [PreviousDisaster Recovery Overview](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/disaster-recovery-overview) [NextModule Summary](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/module-summary) Last updated 1 year ago --- # Course Summary | Trellix ePolicy Orchestrator - On-prem 5.1 ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/summary/course-summary#key-takeaways) **Key Takeaways** ePO is a key component of the Security Management framework, providing unified management of endpoint, network, and data security products. The Trellix Agent is the client-side component of ePO. You must install it on each system in your network that you want ePO to manage. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/summary/course-summary#key-features) **Key Features** * **Flexible automation** * **Unified view of security** * **Simplified security operations** * **Integration** ![Click on the Resources for an additional product information](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2Fg1cI3xH_8r47B7Oa_mOlqU5IWp1FDEBV4.jpg&width=768&dpr=4&quality=100&sign=80bfec79&sv=2) Click on the Resources for an additional product information **Resources** * [Service Portal(opens in a new tab)](https://www.trellix.com/en-us/support.html) * [Product Documentation(opens in a new tab)](https://docs.trellix.com/search?labelkey=prod-epo&labelkey=prod-epo-v5-10-x&labelkey=prod-epo-v5-10-0&q=ePO&rpp=10&sort.field=score&sort.value=dec) Thank you for completing this course! Please complete the end of the course exam to get the credit for the course! [PreviousModule Summary](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/module-summary) Last updated 1 year ago --- # Client Task Management | Trellix ePolicy Orchestrator - On-prem 5.1 **Client Task Overview** Client tasks automate system management activities, such as product deployment, upgrades, and updates. 1. **Client Task Catalog** Applies the concept of logical objects to ePO client tasks. You can create client task objects for a variety of purposes without the need to assign them immediately. You can treat these objects as reusable components, when assigning and scheduling client tasks. 2. **Client Tasks** Can be assigned at any level in the System Tree and are inherited by groups and systems lower in the tree. As with policies and policy assignments, you can break the inheritance for an assigned client task. 3. **Client Task Objects** Can be shared across multiple registered ePO servers in your environment. When client task objects are set to be shared, each registered server receives a copy after your Share Client Task server task runs. Any changes made to the task are updated each time it runs. When a client task object is shared, only the owner of the object can modify its settings. An administrator, on the target server that receives a shared task, is not the owner for that shared task. None of the users on the target server is the owner for any shared task objects that the target receives. If modifications are necessary, the administrator can duplicate the task, and then make modifications on the duplicated task. You can export and import client tasks for use with other ePO servers. **Note**: The product extensions installed on ePO server determine which client tasks are available for a specific application. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/client-task-management#client-tasks) **Client Tasks** ![Menu > Client Tasks](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2Fn6a40KbCJgNjhQr4_0LgfF6UJ7ILiraZz.png&width=768&dpr=4&quality=100&sign=d912110a&sv=2) _**Menu**_ \> _**Client Tasks**_ * **Client Task Catalog**: View and create client tasks * **Client Task Assignments**: Assign and manage client tasks from the System Tree group/subgroup levels * **Client Task Comparison**: Compare client tasks with similar characteristics #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/client-task-management#client-task-catalog) **Client Task Catalog** Use the Client Task Catalog to add and manage client tasks. A client task must be enabled and assigned to your managed systems to be available to be used in the ePO environment. Some commonly used client tasks for Trellix Agent include: * **Trellix Agent Statistics**: Collects network bandwidth saved by the RelayServer, Peer to Peer, and SuperAgent hierarchical features * **Trellix Agent Wakeup**: Triggers an immediate Agent-Server Communication; this applies to Windows operating systems only * **Mirror Repositories**: Specifies a location on the managed system to replicate contents from the repository; this applies to Windows operating systems only * **Product Deployment**: Install a product on managed systems * **Product Update**: Update a product on managed systems ![Menu > Client Task Catalog](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FjRS3N7EXH-cjtx0l_oP-XZXNNkHrRhX2Q.png&width=768&dpr=4&quality=100&sign=453b6c1b&sv=2) _**Menu**_ \> _**Client Task Catalog**_ As additional products are checked into ePO, client tasks for those products will be added. **Example**: Endpoint Security Threat Prevention will add the On-Demand Scans and Restore from Quarantine client tasks. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/client-task-management#client-task-assignments) **Client Task Assignments** From the Client Task Assignments page, you can view and manage client task assignments. You can also get to this page from the **System Tree** > **Assigned Client Tasks** tab. ![Menu > Client Task Assignments or System Tree > Assigned Client Tasks tab](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2Fa6Xks6vzDD6P6SEt_5n_-HttN63yI-Kxv.png&width=768&dpr=4&quality=100&sign=def5c3ea&sv=2) _**Menu**_ \> _**Client Task Assignments**_ or _**System Tree**_ \> _**Assigned Client Tasks**_ tab ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/client-task-management#client-task-comparison) **Client Task Comparison** The Client Task Comparison tool is used to compare client tasks that are similar. This allows you to determine which settings are different and which are the same. ![Menu > Client Tasks > Client Task Comparison](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FWjUW0_9aIKCMKSoR_k3CyxVItdGF5lfEf.png&width=768&dpr=4&quality=100&sign=fc4c6c0a&sv=2) _**Menu**_ \> _**Client Tasks**_ > _**Client Task Comparison**_ ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/client-task-management#client-task-approvals) **Client Task Approvals** With ePO - On-prem, the administrator has the option to require an approval process before a new or updated client task is pushed out, reducing the risk of an error and assuring quality control. As an administrator you can create permission sets for different policy user levels. You can choose client task management users need approval to make task changes The Permission Sets allow some client task users not only to create and modify client tasks, but also to approve or reject client tasks created by other users. To manage client task creation, you can create permission sets for users who can create and modify specific client tasks. For example, you can create permission sets that allow one user to change tasks and another user permission to approve or reject those changes. > ### > > [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/client-task-management#card-title-21) > > Client Task Approvals: Server Settings > > As an administrator, you can lock down creation access for client tasks by configuring user accounts to require approval first when attempting to create client tasks. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F3VZM5bK0YXdTVEpDrJPo%252Fimage.png%3Falt%3Dmedia%26token%3Dbc505e6f-13e1-4328-9395-454c302c488f&width=768&dpr=4&quality=100&sign=bab6c90b&sv=2) Select **Menu** \> **Configuration** \> **Server Settings**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FRee5nCfHv5X0sPQCsniV%252Fimage.png%3Falt%3Dmedia%26token%3Df8f2e4af-f619-44f5-832e-bbf870645a7a&width=768&dpr=4&quality=100&sign=780b1287&sv=2) Navigate to and select **Approvals** under the Setting Categories column and click **Edit**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FqNINKwwSZlpgALRLhCCx%252Fimage.png%3Falt%3Dmedia%26token%3D58394146-1c69-46fb-a709-45aa906cbce0&width=768&dpr=4&quality=100&sign=4f50212e&sv=2) Select the _Users need approval for client task changes_ option and click **Save**. > ### > > [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/client-task-management#card-title-25) > > Summary > > The client task approval step is now completed. Next, we need to create a permission set that forces user accounts to have an administrator review the client task creation. > ### > > [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/client-task-management#card-title-27) > > Client Task Approvals: Permission Sets > > Now you can create and assign the newly created permission set rules for the user account. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F5gtSQTO0YDa147a8meaJ%252Fimage.png%3Falt%3Dmedia%26token%3D2d2952fa-e0b1-4da9-b5f4-1030810f6788&width=768&dpr=4&quality=100&sign=39dc4a5c&sv=2) Select **Menu** \> **User Management** > **Permission Sets**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Fe974g5VBIIfv2I5wFdCV%252Fimage.png%3Falt%3Dmedia%26token%3Dc654c2ed-1fd9-4645-8586-cf9dc5502a83&width=768&dpr=4&quality=100&sign=6d751ee3&sv=2) Click **New Permission Set** to create a new default entry. For this example, we are creating the permission set named _Client Task Approver_. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FpoOKuXxJ4AOa9Lz7eGTx%252Fimage.png%3Falt%3Dmedia%26token%3Db925e7f9-cfc2-4225-89f5-9303addb5e39&width=768&dpr=4&quality=100&sign=c43f14b2&sv=2) On the Permissions Set page, navigate to **Client Task Management** and click **Edit**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Fpl78dGYInrWLAk7ze0C0%252Fimage.png%3Falt%3Dmedia%26token%3D9fdc4c49-c7e3-4d3a-8081-c2f5d30136c2&width=768&dpr=4&quality=100&sign=d38f527c&sv=2) Select the _No Permission – Users cannot approve or decline task change requests_ option and click **Save**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FmMNtoeut8FNjeK2I9eQI%252Fimage.png%3Falt%3Dmedia%26token%3D77cbcb62-500e-4885-833e-45925477f7e4&width=768&dpr=4&quality=100&sign=1de40f36&sv=2) Navigate to a product entry in the list and click **Edit**. For this example, we will use **Trellix Agent**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FiHDDsFWCMGQI5hwvAN7P%252Fimage.png%3Falt%3Dmedia%26token%3D9acaa95a-653c-4e11-ad07-ac80cae3c404&width=768&dpr=4&quality=100&sign=120c1e28&sv=2) Select the _**View and change settings**_ option for the _Trellix Agent: Tasks_ entry and click **Save**. > ### > > [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/client-task-management#card-title-34) > > Summary > > Once you have created the permission set, you can edit it to either assign it to an existing user or create a new user and assign it to that user. * * * ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/client-task-management#sharing-client-task-objects) **Sharing Client Task Objects** Client task objects can be shared across multiple registered ePO servers in your environment. When client task objects are set to be shared, each registered server receives a copy after your Share Client Tasks server task runs. Any changes made to the task are updated each time it runs. When a client task object is shared, only the owner of the object can modify its settings. Administrators on the target server that receives a shared task are not owners for that shared task. None of the users on the target server are owners for any shared task objects the target receives. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2F9bNknPy3qLEsMk-C_WiCKHpVGFBsOmHeq.png&width=768&dpr=4&quality=100&sign=b8a58f4&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/client-task-management#deleting-client-tasks) **Deleting Client Tasks** To delete client tasks: 1. In the left pane of the Client Tasks Catalog, select a **Client Task Type**. **Example**: **McAfee (Trellix) Agent** > **Product Update**. 2. In the right pane, select a client task. 3. Click the **Delete** link for the selected task. 4. When prompted, ensure you understand how this will affect other systems and click **OK**. **Note**: This also removes the task from where it was assigned in the System Tree. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FqEXsWthipla7o0Ps_QUYXnUt_e3rFQaFu.png&width=768&dpr=4&quality=100&sign=77d3322e&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/client-task-management#managing-client-tasks-from-the-system-tree) **Managing Client Tasks from the System Tree** You can also manage client tasks from the System Tree. From the **Assigned Client Tasks** tab, you can: * **Reset Inheritance**: The Broken Inheritance shows which systems or groups do not inherit task. From this column, you can also reset the inheritance for a specific System Tree object. To do this, click the blue hyperlink from the **Broken Inheritance** column, select an entry in the **Node Name** column, then click **Reset Inheritance**. * **Edit Assignment**: Click the **Edit Assignment** link to launch Client Task Assignment Builder within the Client Task Catalog. * **New Client Task Assignment**: Select **Actions** \> **Edit Assignment** to launch Client Task Assignment Builder within the Client Task Catalog or click the default link to the right of the **Actions** drop-down. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FuZ9ldOTG-1Xf_ihO_aMPBLtPxAaMEXLje.png&width=768&dpr=4&quality=100&sign=22c52d47&sv=2) From the **Systems** tab, you can: * **Modify Tasks on a Single System**: Edit tasks for selected system * **Run Client Task Now**: Run a client task for a selected system ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FaVlCVqSGFYZ4QtK0_hcTQhjjYR8CHB8d0.png&width=768&dpr=4&quality=100&sign=883a022d&sv=2) [PreviousProduct Deployment](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/product-deployment) [NextCreating a Custom Properties Client Task Simulation](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/product-management/creating-a-custom-properties-client-task-simulation) Last updated 1 year ago --- # Queries and Reports | Trellix ePolicy Orchestrator - On-prem 5.1 ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#queries-and-reports-overview) **Queries and Reports Overview** ePO ships with its own querying and reporting capabilities, which are highly customizable, flexible, and easy to use. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FW3kpxYQWf5XfbDsa_s246pdYFnavnOOIc.png&width=768&dpr=4&quality=100&sign=f034be67&sv=2) **The data for queries and reports come from any registered internal or external database in your ePO system. The most recently run result, for every report, is stored in the system and readily available for viewing.** #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#queries-and-reports-page) **Queries & Reports Page** The Queries and Reports page gives you access to ePO’s robust reporting features. Use it to create, edit, and run queries and reports. You can access the Queries & Reports page from the Reporting category on the main menu page or from the Queries & Reports icon on the Navigation bar as shown below. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FPoRH4njx2UeBdWLE_GG0tsHCbwgrU0mQ4.png&width=768&dpr=4&quality=100&sign=db0f2849&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#query-builder-and-report-builder) **Query Builder and Report Builder** ePO provides an easy, four-step wizard, called the Query Builder, that you use to create and edit custom queries. The wizard allows you can configure which data is retrieved and displayed and how it is displayed. ePO also provides a Report Builder, which is used to create and edit your report, including name, contents, and layout or structure. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FAEstW34zHc-o3LQy_6wzH--ePtTH1hB4F.png&width=768&dpr=4&quality=100&sign=c84f2ff&sv=2) **Groups and permission sets control access to queries and reports. All queries and reports must belong to a group: access to that query or report is controlled by the permission level of the group.** #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#logs) **Logs** In addition to queries and reports, you can use these logs to gather information about activities that occur on your ePO server and throughout your network: * Audit log * Server Task log * Threat Event log * Exploit Prevention Events ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FsfBq6RdK4XlBkKqQ_HDHUoyI3mPCUpXsU.png&width=768&dpr=4&quality=100&sign=4baaa0b8&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#query-and-report-permissions) **Query and Report Permissions** Use query and report permissions to assign specific levels of query functionality to permission sets, which are assigned to individual users. Available permissions include: No permissions+Use public queries and the shared groups+Use public groups, and the shared groups; create and edit private queries/reports+Edit public groups and the shared groups; create and edit private queries/reports; make private queries/reports public+ No permissions[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#no-permissions) The Query tab is unavailable to a user with no permissions. Use public queries and the shared groups[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#use-public-queries-and-the-shared-groups) Grants permission to use any queries that have been created and made public by users with the same permissions Use public groups, and the shared groups; create and edit private queries/reports[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#use-public-groups-and-the-shared-groups-create-and-edit-private-queries-reports) Grants permission to use any queries that have been created and made public by users with the same permissions, as well as the ability to use the Query Builder wizard to create and edit personal queries Edit public groups and the shared groups; create and edit private queries/reports; make private queries/reports public[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#edit-public-groups-and-the-shared-groups-create-and-edit-private-queries-reports-make-private-querie) Grants permission to use and edit any public queries, create and edit any personal queries, as well as the ability to make any personal query available to anyone with access to public queries **To run some queries, you also need permissions to the feature sets associated with their result types. Also, in a query’s results pages, the available actions to take on the resulting items depend on the feature sets a user has permission to.** ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#queries) **Queries** Queries are configurable objects that retrieve and display data from the database. * Displayed in charts/tables * Actionable * Exportable to four formats: * **CSV**: Use with spreadsheets * **XML**: Transform data * **HTML**: View as a web page * **PDF**: Obtain printable results * Can use as dashboard monitors * Can run manually or on schedule * Can share between servers using import/export #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#basic-query-page-controls) **Basic Query Page Controls** The figure below highlights the basic controls used to create and manage queries. _**Click on the information (i) icons for additional information.**_ ![Query Page Controls.png](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FBO_KxL7nKa4pXT_a_5aJyd8JkZbqugoyE.png&width=768&dpr=4&quality=100&sign=2f9fe8ab&sv=2) 1. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FuHtP9ArRx97WGWb0RwMj%252Fimage.png%3Falt%3Dmedia%26token%3De6e7a0f3-e851-4bac-8605-ee60295cd4fc&width=300&dpr=4&quality=100&sign=ea511564&sv=2) 2. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FsvjjqgwYSsztSpyrC1bH%252Fimage.png%3Falt%3Dmedia%26token%3D6d34c28e-5b38-4d47-85a6-01eead8d9b84&width=300&dpr=4&quality=100&sign=10d7fc87&sv=2) 3. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FhOgETPYtpTRw6YS6HcBY%252Fimage.png%3Falt%3Dmedia%26token%3D17c67f82-efee-4639-8da2-8e36eeb8fbaf&width=300&dpr=4&quality=100&sign=9c2912d9&sv=2) 4. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FSo1xA5yqLlYFvxaXMf83%252Fimage.png%3Falt%3Dmedia%26token%3Da2b33915-e05f-4670-b45a-db0f5ad3b913&width=300&dpr=4&quality=100&sign=d356534f&sv=2) 5. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FR9KDKJplJXGqDDCCHc4d%252Fimage.png%3Falt%3Dmedia%26token%3Da8aab7f8-a244-421c-9703-eedef834417a&width=300&dpr=4&quality=100&sign=a078cd76&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#using-queries-as-dashboard-monitors) **Using Queries as Dashboard Monitors** You can use almost any query (except those using a table to display the initial results) as a dashboard monitor. For example, you can use a chart-based query as a dashboard that refreshes at a user-configured frequency. Use your most useful queries on a live dashboard. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FLp_cNpE_WTbOg5Vf_lXpVj0zVVvFX0U_H.png&width=768&dpr=4&quality=100&sign=195383ff&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#public-and-private-queries) **Public and Private Queries** Queries can be private or public. * Private queries exist in the user’s Private Group list and are only available to the creator. * Public queries exist in the Shared Groups list and are available to everyone who has permissions to use public queries. Administrators and users with appropriate permissions can make their private queries public. Use query permissions to assign specific levels of query functionality to permission sets, which are assigned to individual users. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#using-the-query-builder) **Using the Query Builder** * ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#step-1) Step 1 #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#choose-feature-group-result-type) Choose Feature Group/Result Type What do you want to query? ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2Ffc_RQtjzvK13BNsb_2yLBTZVYE0l1uKi9.png&width=768&dpr=4&quality=100&sign=b11649e4&sv=2) * ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#step-2) Step 2 #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#choose-chart-or-table-type) Choose Chart or Table Type How do you want your data to display? ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FbpdBFnxztIngejpl_DCsFgmac7LAQJNQj.png&width=768&dpr=4&quality=100&sign=583dfd2e&sv=2) * ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#step-3) Step 3 #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#add-additional-table-columns-for-drill-down) Add Additional Table Columns for Drill Down What do you want to see in your query? ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FeKWXHcS26Ttkd3Zz__TgMB93VBCwXiWdT.png&width=768&dpr=4&quality=100&sign=f61117d&sv=2) * ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#step-4) Step 4 #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#apply-filters) Apply Filters Narrow the results. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FfzqjPHFbLYXvWElA_60oHdtFXk0Oek8kk.png&width=768&dpr=4&quality=100&sign=87734a9b&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#unsaved-query) **Unsaved Query** After you have made all of your query selections, click the **Run** button to view the results. At this point, your query has not been saved. * If you are satisfied with the results, then click the **Save** button and name your new query. * If you have the appropriate permissions, you can make this query public at this time by saving it to the Public Group (Shared Groups). After you create the reports and display the output, you can fine-tune your report without starting from the beginning again. To do this, click **Edit**. Clicking Edit allows you to go back and adjust your report and run it again in seconds. When you have made all changes to your report, click **Save** on the Unsaved Query page, then click **Save** again on the Save Query page to save it permanently. Now, this query is included with your dashboards, and you can run it any time. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FcjTlkdrdQBfCrHmS_CZ1nRz69aHhmzlR4.png&width=768&dpr=4&quality=100&sign=5a1fae08&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#default-queries) **Default Queries** ePO provides over 50 pre-defined queries. All are read-only. As product extensions are added to ePO, the default available queries increase. To view available queries, click the Queries tab on the Queries & Reports page. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FxGTJnEqX9l7K1tzP_q9rUo_NmpOOBoRrm.png&width=768&dpr=4&quality=100&sign=23e4192a&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#actionable-queries) **Actionable Queries** Clicking the results of any query will access the additional details of the data. This drill-down data has available actions, based on the type of query that was run. For example, deploy agents to systems in a table of results. To view available actions for a query, select the **Actions** button from the column view. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FMSFMNDQpW2lXu02y_-nUMB9B3Vz_dq2d8.png&width=768&dpr=4&quality=100&sign=bb5dfcd7&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#preconfigured-queries-examples) **Preconfigured Queries: Examples** ePO includes preconfigured queries you can use to report on and manage your network, including these types of information: * Managed products deployed throughout your network Example: the Trellix Agent or Trellix Endpoint Security * User actions on your ePO server Example: how many failed login attempts have occurred on your server in the last 30 days * Policy assignment Example: which policies are assigned to each system in your network The preconfigured queries available to you depend on which managed products you have installed. They use a variety of chart types to display query results and can be modified to suit your needs. **Create a duplicate of a preconfigured query before modifying it, so you can retain the original functionality of each query.** #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#query-groups) **Query Groups** There are three pre-defined query groups in ePO, which contain all queries: * Private Groups * Shared Groups * Trellix Groups The queries in these groups are further organized into subgroups. All preconfigured queries appear in the Trellix Groups category on the Queries page. By default, queries in the Shared Groups category are accessible to any user with the appropriate permissions. Users without the appropriate permissions can see the query, but are not able to run the query. Queries in Private Groups are available only to the user who creates them (the query owner). **Example**: If a user has full permissions to use queries but has no permissions for Endpoint Security, the user cannot run any ENS queries. All preconfigured queries are included in the Shared Groups category. Preconfigured queries that appear in the Shared Groups category by default are organized into subgroups by functionality and managed product dependencies. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FprRzwgD-LaNck7wt_Ev7_MD67Hcl7rcBT.png&width=768&dpr=4&quality=100&sign=aafb27dd&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports#automatic-query-actions) **Automatic Query Actions** A server task is used to run a query regularly. Queries can have sub-actions that allow you to perform various tasks, such as emailing the query results or working with tags. The sub-action configuration is dependent upon the Sub-Action selected from the pull-down. The page updates automatically when a new Sub-Action is chosen. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2Fgo2WF24r_2BYZ7V9_mZkqfqMXf-mFswjv.png&width=768&dpr=4&quality=100&sign=3ca83afd&sv=2) * Automatically act based upon the results of a query * Select from the Sub-Actions menu when creating a **Run Query Server Task** [PreviousePO Dashboards](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/epo-dashboards) [NextReports](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/reports) Last updated 1 year ago --- # ePO Dashboards | Trellix ePolicy Orchestrator - On-prem 5.1 ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/epo-dashboards#dashboards-overview) **Dashboards Overview** The Dashboards page displays monitors to help you manage, monitor, and act on the health of ePO-managed systems. A monitor can be anything from a chart‑based query to a small web application. You can access the page two ways: * Click the **Dashboards** icon on the navigation bar or * Select **Menu** \> **Reporting** \> **Dashboards** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FS3jc9K8z90LKxrP__imNpjPm9u6FT0kfw.png&width=768&dpr=4&quality=100&sign=b9d76778&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/epo-dashboards#default-dashboards) **Default Dashboards** ePO provides default dashboards for a quick start but also lets you create custom dashboards to meet your own needs. **Example**: Monitor and control deployments, support specific audiences (help desk, IT, auditors, and so on), and drill-down and take action. As you install additional extensions or products, additional dashboards are added to the list. Below are the default dashboards included with ePO. ePO Summary[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/epo-dashboards#epo-summary) Provides high-level information and links to additional information Executive Dashboard[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/epo-dashboards#executive-dashboard) Provides high-level reports on security threats and compliance, with links to additional product-specific information Getting Started with ePolicy Orchestrator[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/epo-dashboards#getting-started-with-epolicy-orchestrator) Walks you through some of the common concepts used throughout ePO and provides access to the Product Deployment page for a quick startup Product Deployment[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/epo-dashboards#product-deployment) Provides an overview of network deployment and update activities Product Deployment Incompatibility[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/epo-dashboards#product-deployment-incompatibility) Provides an overview of compatibility status of deployed and updated products Product Reboot Pending[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/epo-dashboards#product-reboot-pending) Displays products requiring a reboot Threat Events[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/epo-dashboards#threat-events) Provides threat event descriptions in the database, as well as filtered views Threat Events+Trellix ePO Server Snapshot[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/epo-dashboards#threat-eventstrellix-epo-server-snapshot) Uses a Snapshot process to save specific ePO server database records to the ePO Microsoft SQL database Trends[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/epo-dashboards#trends) Provides historical information about trends, such as new agents added per week compliance history, and successful/failed updates and replcations **Default dashboards are read-only. If you want to make changes, you must duplicate the dashboard and edit the duplicate.** ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/epo-dashboards#dashboard-actions) **Dashboard Actions** use the Dashboard drop-down list to select the dashboard you want to view. After you create your own dashboards, they also appear in the list. These actions are available for Trellix and custom dashboards: * **New**: Opens the New Dashboard page where you can create and save a dashboard layout * **Duplicate**: Opens the Duplicate Dashboard page where you can create a duplicate of a selected dashboard * **Import**: Imports an XML file exported from any ePO server * **Export**: Exports the selected dashboard as an XML file * **Delete** and **Edit** actions apply only to custom dashboards and not the default dashboards ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FUfVRWoA3CM_ErM8R_ffPAWhhoDKwZmUhL.png&width=768&dpr=4&quality=100&sign=b1b032a&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FHwv05W8cJ8sNZFpcNgJz%252Fimage.png%3Falt%3Dmedia%26token%3D69025655-7a5a-44de-bd4e-f5432da8031f&width=768&dpr=4&quality=100&sign=bf590717&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/epo-dashboards#assigning-dashboard-permissions) **Assigning Dashboard Permissions** Dashboards are only visible to users with proper permissions and can be private, public, or shared with specified permission sets. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FNjWveolEXoo4Gjzg_0Ja6cQsdapFDclwt.png&width=768&dpr=4&quality=100&sign=cfc7b444&sv=2) Dashboard visibility options: * **Private**: Do not share this dashboard (default) * **Public**: Share this dashboard with everyone * **Share this dashboard with the following permission sets**: Share with permission sets selected from among the choices below this option. Choose one or more permission sets. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/epo-dashboards#dashboard-guidelines) **Dashboard Guidelines** * You must have the appropriate permissions to view, use, edit, and delete dashboards. * Users with permission to view more than one dashboard see the most recently viewed dashboard the next time they access the Dashboards page. * Default dashboards are read-only. You can duplicate but not modify them or delete them. * A duplicate dashboard is an exact copy of the original dashboard, including all permissions. Only the name is change * You can create a dashboard with more expansive permissions than one or more queries contained on the dashboard. * If the query is private to the dashboard creator, only the dashboard creator can modify the query or remove it from the dashboard. * You can change the default dashboard’s settings for permission sets and monitor refresh interval on the Server Settings page to meet your needs. This includes changing the Default Dashboards for permission sets and the Default dashboard monitor refresh interval. When changing the refresh interval, ensure the new setting is frequent enough to display accurate and timely information, without consuming undue network resources. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/epo-dashboards#adding-editing-and-removing-monitors) **Adding, Editing, and Removing Monitors** #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/epo-dashboards#adding-a-monitor) **Adding a Monitor** The figure below shows the workflow for adding a monitor to a dashboard. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FWyzQhRa--1jP5eTg_D5vpF-wb3EI0t8EA.png&width=768&dpr=4&quality=100&sign=19a9fb39&sv=2) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FFSia1mjHr3MfSCwWysll%252Fimage.png%3Falt%3Dmedia%26token%3Df5918e5e-0359-42a9-900c-c8ea3a747bee&width=768&dpr=4&quality=100&sign=949be0fc&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/epo-dashboards#monitor-overview) **Monitor Overview** Dashboards display information through a collection of monitors to give you a customizable, at-a-glance view of your environment. ePO includes default monitors, which you can add to custom dashboards. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FFBGtH8Gbiwvf8XKG_Ho8QTdk0FLnA6u_p.png&width=768&dpr=4&quality=100&sign=769cada1&sv=2) **ALERT**: If you add a Custom URL Viewer monitor, that contains Adobe Flash content or ActiveX, the content might make portions of the ePO menus inaccessible. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/epo-dashboards#monitor-guidelines) **Monitor Guidelines** * You can assign default monitors to custom dashboards, as well as create custom monitors to meet your needs and then assign them. * Use the Category drop-down list to filter the monitors shown on the menu bar. * You can create custom monitors and assign them to custom dashboards. * If you add a Custom URL Viewer monitor, that contains Adobe Flash content or ActiveX, the content might make portions of the ePO menus inaccessible. \*\*\*Do not enter the URL of the ePO server\*\*\* * You can change the default refresh interval, if necessary, on custom dashboard monitors. * You can resize and move monitors to use screen space more efficiently. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/epo-dashboards#editing-or-removing-a-monitor) **Editing or Removing a Monitor** To make changes to custom monitors: 1. Click the arrow in the upper-left corner of the monitor and select the preferred option. * **Full Screen**: Expands the size of the monitor to that of the entire dashboard. To return to the dashboard, in the lower right corner, click **Close**. * **Edit Monitor**: You can change the Monitor Content and the Refresh Interval. * **Refresh**: The monitor content will be updated with the latest information, based upon the content’s query. * **Remove Monitor**: Deletes the selected monitor. 2. Click **Save** to save any changes made. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FSYl-h8t6Iy9N2lA4_It_j8-wuBjlk7FrN.png&width=768&dpr=4&quality=100&sign=4cf0c88b&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/epo-dashboards#dashboards-server-settings) **Dashboards Server Settings** The Dashboards Server Settings page specifies the default dashboard that a user sees when logging in to the server, as well as the refresh rate for all dashboards. ![Menu > Configuration > Server Settings > Dashboards > Edit](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FUPD1VGIFdxksS7w6_wp7odoC8B8WmR2RJ.png&width=768&dpr=4&quality=100&sign=36ada819&sv=2) _**Menu**_ \> _**Configuration**_ \> _**Server Settings**_ \> _**Dashboards**_ \> _**Edit**_ Use the **Edit Dashboard** page to specify these Server Settings for dashboards: * **Default dashboard for specific permission sets**: Specifies the default dashboard for the various permission sets * **Default dashboard for all other permission sets**: Specifies the default dashboard * **Default dashboard monitor refresh interval**: Specifies the refresh interval of the default dashboard. Enter the number of minutes or hours when the interval should refresh. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/epo-dashboards#specifying-default-dashboards) **Specifying Default Dashboards** Mapping dashboards to permission sets ensures that users assigned a particular role automatically see the information they need. Users with permission to view dashboards, other than their default, see the most recent dashboard they viewed each time they go to the Dashboards page. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FBJCcOR8wY3fskT_nF8zFfg%2F1694632483%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAwNzoxNDo0MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FXEqeaLQG7yKZzAWd_Z8XSP_c1UWocqhJx.png&width=768&dpr=4&quality=100&sign=609320a3&sv=2) 1. Click the **plus sign** (**+**) or **minus sign** (**\-**) to add or remove existing permission set/dashboard mappings. If a user is assigned multiple permission sets, their default dashboard is the first one added to the mapping list. 2. To select a default dashboard for all other permission sets not explicitly mapped above, choose one from the Default dashboard for all other permission sets drop-down list. 3. Click **Save** in the bottom right corner. [PreviousModule Intro](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/module-intro) [NextQueries and Reports](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/dashboerds-queries-reports/queries-and-reports) Last updated 1 year ago --- # Disaster Recovery Overview | Trellix ePolicy Orchestrator - On-prem 5.1 The ePO Disaster Recovery feature uses a Snapshot process to save specific ePO server database records to the ePO Microsoft SQL database. * Manually from the Server Snapshot page (**Dashboard** \> **Trellix ePO Server Snapshot**) * Automatically using the Disaster Recovery Server task (**Menu** \> **Automation** \> **Server Tasks**) The snapshot takes a copy of these folders and files: * C:\\Program Files (x86)\\McAfee\\ePolicy Orchestrator\\Server\\ * C:\\Program Files (x86)\\McAfee\\ePolicy Orchestrator\\DB\\ The records contain the entire ePO configuration at the specific time the Snapshot is taken and are specific to the time the Snapshot is taken. * You can only run one Disaster Recovery Snapshot at a time. * When you run a new Snapshot, it overwrites the previous Snapshot. Disaster Recovery Snapshot is enabled by default on all Microsoft SQL Servers, except the Express Edition. **Recommendation**: Trellix does not recommend enabling Disaster Recovery Snapshot scheduling with the Microsoft SQL Server Express Editions because of the data file size limitations. **Maximum data file size**: * For Microsoft SQL Server 2005 Express Edition is only 4 GB * For Microsoft SQL Server 2008, 2012, 2014 and 2016 Express Editions is 10 GB Registered executable files are not backed up. You must replace those executable files when you restore the ePO server. After the restore, any registered executables with broken paths are shown in red font on the Registered Executables page (**Menu** \> **Configuration** > **Registered Executables**). Review [**KB87976**(opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content&id=KB87976) for details on the ePO 5.x Disaster Recovery Snapshot feature. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/disaster-recovery-overview#disaster-recovery-process) **Disaster Recovery Process** ![Disaster Recovery Snapshot and Backup](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2F5kO_itJPuc4gPyG4__qWOzPRNzr3teR9S.png&width=768&dpr=4&quality=100&sign=411b2f0c&sv=2) **Disaster Recovery Snapshot and Backup** 1. Snapshot is taken by a server task, manually or automatically. 2. Snapshot records are zipped and saved to the SQL database **OrionSnapshot** table. * You can use the Microsoft SQL Server Management Studio or BACKUP (Transact‑SQL) database feature to save the entire ePO database. (Must be **DBCreator** and **DBOwner**). 3. Database is backed up and the backup file is copied to another location (not on the ePO server). ![ePO Server Simple Restore](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FNUx2JjY5zv0rp2na_pnduebLQTQxHGPuh.png&width=768&dpr=4&quality=100&sign=346a2be8&sv=2) **ePO Server Simple Restore** 1. Restore the backup file using either the SQL Server Management Studio for your SQL Server edition or the RESTORE (Transact-SQL) command line process. 2. Run the ePO Install program (**Restore ePO from an existing Disaster Recovery database Snapshot** option). * Select Microsoft SQL Server to link the ePO software to the restore SQL database that had the primary ePO configuration restored in step 1. 3. Snapshot records are used, instead of creating new ones. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/disaster-recovery-overview#basic-requirements) **Basic Requirements** The table below highlights basic requirements for the Disaster Recovery feature. Your deployment may include a separate restore server configured to closely match your ePO server. Component Requirement Primary ePO server Should be up and running correctly, with a recent Snapshot saved in the SQL database Restore ePO server If you have a restore ePO server, it should closely mirror your primary ePO server hardware. Disaster Recovery Keystore encryption passphrase You must know the passphrase added during the initial installation of the ePO software. The passphrase is required to decrypt sensitive information stored in the **Disaster Recovery Snapshot**. **IMPORTANT**: * If forgotten, this passphrase cannot be recovered, and you would be unable to restore ePO from the database containing the snapshot. * However, if the original ePO server is still accessible and functional, then the passphrase can be reset under **Server Settings** > **Disaster Recovery**. Once reset, you can run another Snapshot task and backup the database again. Administrator privileges Access to the primary and restore servers and SQL database is required. **Example**: DBCreator and DBOwner. **Disaster Recovery Snapshot** ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/disaster-recovery-overview#card-title-2) Disaster Recovery Snapshot: Server Task Use the Disaster Recovery Snapshot Server Task to modify the scheduled automatic Snapshots of your ePO server configuration saved to the SQL database. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2F11Vr7KTY_hirjczg_dFITdXpPXBAHo3qn.png&width=768&dpr=4&quality=100&sign=c5abf6b0&sv=2) Select **Menu** \> **Configuration** \> **Server Tasks**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2F7VQ_VbKmTjbCW2Av_U6RlemdvkFxPibQ4.png&width=768&dpr=4&quality=100&sign=23daf6c4&sv=2) From the Server Tasks list, locate the **Disaster Recovery Snapshot Server** task in the Name column. **Note**: The task is enabled by default. It has a default configuration you can change to meet your needs. You can **View**, **Edit**, or **Run** the task from this page. The only editable aspect of the server task is to Enable or Disable the task itself and set the schedule to run the task. The action itself cannot be altered. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FxxHG_2VKmTcn7HpI_dK54XXfWG6njOtNR.png&width=768&dpr=4&quality=100&sign=e376898&sv=2) Click **View** to see the default configuration, as shown in the figure. **Note**: The task is scheduled to run daily at 1:59 A.M. the following day, after the ePO software is installed. Click **Cancel** to exit this page. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/disaster-recovery-overview#disaster-recovery-snapshot-dashboard) **Disaster Recovery Snapshot: Dashboard** Use the Server Snapshot page to take a Snapshot manually. The Server Snapshot page is accessed from a drop-down list on the main Dashboards page (**Navigation bar** > **Dashboard** or **Menu** \> **Reporting** > **Dashboards**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FGeganxt_6LZKz3jZ_69zaWYa-Qxbsohrr.png&width=768&dpr=4&quality=100&sign=85899220&sv=2) 1. From the drop-down list at the top of the page, select **Trellix ePO Server Snapshot**. 2. From the Trellix ePO Server Snapshot dashboard monitor, click the **Take Snapshot** button. Other options here are: * **Last Run At**: Displays the last date and time a Disaster Recovery Snapshot was taken. * **View information about Disaster Recovery**: Click link for help/instructions. 3. While the Snapshot is being saved to the database, click the **See details of current run** link to go to a corresponding Server Task Log Details page. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2F2xyKkJSbM156ilQf_3dteeN2f5RoX8R0I.png&width=768&dpr=4&quality=100&sign=ee3a6207&sv=2) 4\. After the Snapshot is saved to the database, click the **See details of last run** link. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FimmkhVLKP4k2AHJG_tT7gmYFa_ekdLAf2.png&width=768&dpr=4&quality=100&sign=22f986c9&sv=2) Again, you are directed to a corresponding Server Task Log Details page. The Server Task Log Details page displays information and log messages about the most recent Snapshot. **Note**: The Snapshot is specific to the time period it is taken, and is overridden when a new one is taken. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FIRSqsACbIusc87hD_66NybR_AGlfpDaHz.png&width=768&dpr=4&quality=100&sign=2bddc4ac&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/disaster-recovery-overview#disaster-recovery-snapshot-status) **Disaster Recovery Snapshot: Status** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FqOGpl55F1ZFWLi-V_YXeT891wCxn7iCKJ.png&width=768&dpr=4&quality=100&sign=44765bb9&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/disaster-recovery-overview#restore) **Restore** #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/disaster-recovery-overview#restore-overview) **Restore Overview** In event of failure, you can restore the ePO database using a backup file. Tools used include: * SQL Server Management Studio * Command line (Transact-SQL) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/disaster-recovery-overview#restore-guidelines) Restore Guidelines * You may need to stop the ePO services and close any open connections to the ePO database before a restore. * You can overwrite the existing ePO database or retain your existing ePO database by restoring the backup with a new name. **Example**: For comparison purposes * Typically, the most recent backup file is restored; however, you can choose a different backup set. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/disaster-recovery-overview#database-restore-sql) Database Restore: SQL As previously reviewed, the **Restore Task** within SQL Management Studio gives you the ability to select which backup to restore from after a disaster. Follow these steps to restore a backup using SQL Server. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FPVs1685EuvRy3pvL_Wa_wX1So-MCQ4S71.png&width=768&dpr=4&quality=100&sign=f3bfdac1&sv=2) Launch SQL Server Management Studio and connect to the ePO database, if necessary. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FsnjDKjj6sw7ITi9X_Ywh6gR_s_lUJ4w06.png&width=768&dpr=4&quality=100&sign=ea2a8668&sv=2) In the left pane of the menu tree, expand the ePO server, if not already expanded. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FaBswX5BLcviHd9Vn_3rGRGlAkGVDxaK7R.png&width=768&dpr=4&quality=100&sign=bd4c07ca&sv=2) Right-click on the ePO database object (**EPO\_**), then select **Tasks** \> **Restore** \> **Database**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FvY8Eubtyjb2R9aQM_Iunz4e2pwgRJ_3Yw.png&width=768&dpr=4&quality=100&sign=3e116a27&sv=2) * Make sure you are on the _General_ tab. **Note**: The _Options_ tab is used for advanced configurations. For more information, refer to the Microsoft SQL documentation. * In the **Destination Database** field, select the ePO database. * By default, the Restore to is set to **The last backup taken**. Optionally, click the ellipses (...) and specify a specific date and time. * In the **Source for restore** section, select **From device**. * Click the ellipses (...) to specify the backup media and its location. **Recovery Installation Workflow** > * ### > > [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/disaster-recovery-overview#before-recovery-installation) > > Before Recovery Installation > > #### > > [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/disaster-recovery-overview#undefined) > > In the SQL Server Configuration Manger: > > * Under SQL Server Services: > > * Make sure SQL Browser Service is running. > > > * Under the SQL Network Configuration > Protocols for the EPO SERVER: > > * Make sure that the TCP/IP Protocol is enabled. > > > * Update the ePO server hosts with the latest Microsoft security updates, then turn off Windows updates during the installation process. > > * Stop remote Agent Handler services on all systems. > > * If restoring to same server, make sure ePO is uninstalled and there is no ePO folder in the install path. > > > **Note**: This procedure is intended for use by network and ePO administrators only. Trellix does not assume responsibility for any damage incurred because this procedure is intended as a guideline for disaster recovery. All liability for use of the following information remains with the user. > > * ### > > [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/disaster-recovery-overview#before-recovery-installation-1) > > Before Recovery Installation > > #### > > [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/disaster-recovery-overview#undefined-1) > > In the SQL Server Configuration Manger: > > * Under SQL Server Services: > > * Make sure SQL Browser Service is running. > > > * Under the SQL Network Configuration > Protocols for the EPO SERVER: > > * Make sure that the TCP/IP Protocol is enabled. > > > * Update the ePO server hosts with the latest Microsoft security updates, then turn off Windows updates during the installation process. > > * Stop remote Agent Handler services on all systems. > > * If restoring to same server, make sure ePO is uninstalled and there is no ePO folder in the install path. > > > **Note**: This procedure is intended for use by network and ePO administrators only. Trellix does not assume responsibility for any damage incurred because this procedure is intended as a guideline for disaster recovery. All liability for use of the following information remains with the user. > > * ### > > [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/disaster-recovery-overview#after-recovery-installation) > > After Recovery Installation > > #### > > [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/disaster-recovery-overview#undefined-2) > > * Restart the ePO server, then verify the ePO console is accessible. > > * Verify the appropriate services have started. > > * Verify the environment contains all expected items, as captured in the Snapshot used for the recovery. > > * If you restored ePO to a server with a different IP address or DNS name from your previously existing server: > > * Configure a way to allow your managed systems to connect to your new ePO server. > > * Recommended: Create a CNAME record in DNS that points requests from the old IP address, DNS name, or NetBIOS name of the previously existing ePO server to the new information for the restored ePO server. > > > **Restore Using Snapshot** ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/disaster-recovery-overview#card-title-13) Restore ePO from an existing database snapshot option When restoring from an existing database snapshot, you will see many of the steps are the same as a first-time install. This section highlights the key differences. **Note**: Many of the steps are similar to those of a new install. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FEDklI2_13WhmYAPj_-SD-qws6wOuoRntj.png&width=768&dpr=4&quality=100&sign=a7aa082e&sv=2) One of the first noticeable differences is that you will select the **Restore ePO from an existing database snapshot** option in the Installation Wizard. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FF2IaR61G-YVYhCHQ_IqiNrD6BLiWPTeRi.png&width=768&dpr=4&quality=100&sign=9b272c84&sv=2) In the **Administrator Information** step, enter the Username and Password you used for your previously existing server administrator account. Also, enter the Keystore encryption passphrase you saved during the initial installation of the previously existing ePO server, or changed in the Server Settings. The Keystore encryption passphrase decrypts the sensitive files stored in the Disaster Recovery Snapshot. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FgkgBaMwt9aMiqxaZ_vQFHxTImouruTFgr.png&width=768&dpr=4&quality=100&sign=2ebada75&sv=2) Click **Install** to continue installation. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FS9g4S_K41Jzq5Ieb_ssyUCD1CXRAZeDPg.png&width=768&dpr=4&quality=100&sign=914d7763&sv=2) Once the installation completes and you log back into ePO with the same account info as previous, the ePO Server Snapshot page initially displays showing “**Snapshot is Out of Date**”. You will notice the restored look and feel of the console, settings, and all captured from the previous ePO Server Snapshot. [PreviousModule Intro](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/module-intro) [NextRunning a Disaster Recovery Snapshot Simulation](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/disaster-recovery/running-a-disaster-recovery-snapshot-simulation) Last updated 1 year ago --- # Troubleshooting Tools | Trellix ePolicy Orchestrator - On-prem 5.1 ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-tools#ommon-troubleshooting-tools-overview) **ommon Troubleshooting Tools Overview** The most common tools used to help troubleshoot ePO issues are: * Notepad++ * Jconsole.bat * WebMER * Performance Monitor (Perfmon) * Process Monitor (Procmon) * SQL Server Configuration Manager * Test.UDL * Wireshark ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-tools#notepad) **Notepad++** Notepad++ is a free source code editor that can be used on systems running Microsoft Windows to easily parse out text into columns as well as provide syntax highlighting for desired keywords to troubleshoot log files easier. Some of the features include tabbed document interface, drag-and-drop, multiple clipboards, split screen, spell checker, find and replace functionality, data comparison, and zooming. You can download this utility from **http://notepad-plus-plus.org**. Once installed, click **Start**, **Run**, type **notepad++**, and click **OK**. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-tools#tabbed-editing) **Tabbed Editing** The tabbed editing feature in Notepad++ allows you to have multiple troubleshooting log files open at once, parsing each of the columns neatly for better readability. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2F1XNrcidlB8n9Crga_9lnnLYVSw2jNcoxK.png&width=768&dpr=4&quality=100&sign=8e9fecc6&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-tools#syntax-highlighting) **Syntax Highlighting** Syntax Highlighting is another helpful feature when troubleshooting large log files as it easily identifies keywords from the log files. Below is an example of how you can configure syntax highlighting when using Notepad++ to review a log file. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FEGop624qiUYve4H2_qglCBR0NHCdb0M__.gif&width=768&dpr=4&quality=100&sign=51dd25d2&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-tools#jconsole.bat) **Jconsole.bat** Jconsole.bat is a graphical tool to monitor Java Virtual Machine (JVM) and Java applications on local or remote systems. Use Jconsole to configure Tomcat dumps for troubleshooting. This tool is included with the ePO 5.x installation. \\JRE\\bin See [KB81848 (opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content&id=KB81848) for details on using the Jconsole.bat utility. ![Once Jconsole loads, simply enter “localhost:9004” or whichever port was specified in the earlier steps. For the username and password, use a global administrator ePO login, such as admin.](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FUhHnM8XDTlv8jINV_ysQDftlCGx2XMPk9.png&width=768&dpr=4&quality=100&sign=de0b46d7&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-tools#jconsole.bat-example) **Jconsole.bat Example** ![After the connection is established (it may warn that it is not a secure connection – dismiss the warning and continue) select the Mbeans tab. Expand com.sun.management, HotSpotDiagnostic, Operations, and select the dumpHeap section.From this page, simply enter the filename and path (Example: C:\Dumps\dump1.hprof) in the p0 field and press “dumpHeap” when ready to create the heap dump.](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FKwik_aid73W4jt-o_RDECpGenun8OLPnE.png&width=768&dpr=4&quality=100&sign=a2cde1b9&sv=2) After the connection is established (it may warn that it is not a secure connection – dismiss the warning and continue) select the **Mbeans** tab. Expand **com.sun.management**, **HotSpotDiagnostic**, **Operations**, and select the **dumpHeap** section. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-tools#webmer) **WebMER** WebMER is a tool that collects product data from systems so Technical Support can analyze data more efficiently to help resolve issues. As previously mentioned, the results from WebMER are best viewed when using MER Analyzer to parse those into a readable format. [KB59385 (opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content&id=KB59385) outlines the basic steps for obtaining and using the WebMER tool, as well as providing a list of supported products it can be used with. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-tools#performance-monitor-perfmon) **Performance Monitor (Perfmon)** Performance Monitor (better known as Perfmon) is a 3rd-party utility that is often used in diagnosing issues surrounding ePO. Perfmon is a Microsoft tool that is distributed with the standard installation of many Microsoft Operating Systems. Like its name, its purpose is to monitor the performance of the operating system. It does this by monitoring specific system information called Performance Counters. These performance counters can range from CPU % to handle counts by processes. The flexibility and amount of content available with this tool makes it a good choice when collecting data for troubleshooting. See the KB article below for additional information pertaining to Perfmon. [**(opens in a new tab)**](https://kcm.trellix.com/corporate/index?page=content&id=KB75494) * [**KB78237(opens in a new tab)**](https://kcm.trellix.com/corporate/index?page=content&id=KB78237) – Provides details on how to use Perfmon to collect the necessary data for issues with “max connections” #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-tools#perfmon-activity-screen) **Perfmon: Activity Screen** The image below shows the initial Perfmon activity screen, where you can begin to configure performance activities to meet your needs. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FALqjuvCn6tw1VKS__FCTA_3xNE46yLXrh.png&width=768&dpr=4&quality=100&sign=2aa2f7e5&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-tools#perfmon-adding-counters) **Perfmon: Adding Counters** Perfmon can be used as a tool to better understand the resources being used along with its logging capabilities to help analyze saved data. Perfmon has many useful counters for troubleshooting possible issues with ePO. Once you have identified the appropriate counters to log, click the **Add** button to move those counters under the **Added Counters** column. Once you have all your items, the counter becomes added to your counter log, where you can continue to add more available counters at any time. Now that the counters are setup and displayed, you can view the graph for any anomalies. Note that you need to know what you are looking for, so you can properly filter out unnecessary data. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FOTotI8YeBnx4zqMY_KywihlZkelfbOK9j.png&width=768&dpr=4&quality=100&sign=d4942f7d&sv=2) ![This view displays the list of Added Counters, if any were selected. Once you have selected the counters you are looking for, click OK to accept this action.](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FAJ-_CyLd2ePhXb3-_Sl483gC8xyi_8shx.png&width=768&dpr=4&quality=100&sign=b629e568&sv=2) This view displays the list of Added Counters, if any were selected. Once you have selected the counters you are looking for, click **OK** to accept this action. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-tools#process-monitor-procmon) **Process Monitor (Procmon)** Process Monitor (Procmon) is another useful third-party application for troubleshooting possible ePO issues. As defined by Microsoft, Procmon is: “.. an advanced monitoring tool for Windows that shows real-time file system, Registry, and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon and adds an extensive list of enhancements including rich and nondestructive filtering, comprehensive event properties such session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit.” Procmon can be used to locate system level information to help troubleshoot various issues. It can help you determine the process and root cause of performance and stability issues. The information is collected at the system level, which can help determine if the issue is truly a Trellix or other third-party issue. See [KB72766 (opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content&id=KB72766) for additional details on using Procmon. For more information on Procmon and how to download it, see documentation on the Microsoft TechNet site [http://technet.microsoft.com/en-us/sysinternals/bb896645(opens in a new tab)](https://docs.microsoft.com/en-us/sysinternals/downloads/procmon) . #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-tools#percmon-details) **Percmon Details** When viewing the process monitor, you will see a log screen split into 7 specifically defined columns: * Time of Day * Process Name * Process Identification (PID) * Operation * Path * Result * Detail Each of these columns can be used for different types of solutions. The most obvious columns to pay attention to would include _**Time of Day**_, _**Process Name**_, and _**Operation**_. When you have found a problem, you should always attempt to recreate that problem. Once you successfully recreate that problem, make note of the time when it occurs as this can help you locate the processes and operations involved in the error. Another valuable function of Procmon is the ability to find and log registry edits. The _**Detail**_ column can show what registry activity is occurring. Procmon can be used to observe things such as: * How applications use the registry * What registry values they read * What registry values get changed when you modify a setting and click **Apply** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2Fc3pvhANj2sMKg1FN_CMD7JmzWOWKZfm1l.png&width=768&dpr=4&quality=100&sign=d0055f38&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-tools#sql-server-configuration-manager) **SQL Server Configuration Manager** SQL Server Configuration Manager is a Microsoft Management Console (MMC) snap-in that: * Manages the services associated with SQL Server * Configures the network protocols used by SQL Server * Manages the network connectivity configuration from SQL Server client computers Additionally, SQL Server Configuration Manager allows you to configure server and client network protocols, as well as connectivity options. After the correct protocols are enabled, you usually do not need to change the server network connections; however, SQL Server Configuration Manager can be used to reconfigure the server connections if needed, so that SQL Server listens on a particular network protocol, port, or pipe. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-tools#sql-server-configuration-manager-display) **SQL Server Configuration Manager Display** SQL Server Configuration Manager is a great place to start when reviewing the default SQL server connectivity settings. A possible scenario here can occur where TCP/IP could be set as Disabled. This is commonly seen if a customer attempts to move databases after the initial installation and forgets to enable this option on the new SQL server. Once this happens, database connectivity issues could occur and would need to be resolved before continuing. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FUqFNdr87DdXqXfNQ_z6nhvHzzf81oTMTm.png&width=768&dpr=4&quality=100&sign=36d1237f&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-tools#test.udl) **Test.UDL** Test.UDL is a Microsoft utility that is used to test database credential connectivity from a system back to SQL. This is commonly used when you are dealing with database connection issues. You can get the test.udl tool by simply creating a text file on your desktop, then renaming it to Test.UDL. Once completed, you can open the tool and start testing system connectivity back to SQL. This should be the first tool you use when troubleshooting database connectivity issues. [KB70929 (opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content&id=KB70929) outlines the basic steps on creating a Test.UDL file for testing system and database connectivity back to SQL. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-tools#test.udl-details) **Test.UDL Details** The image below displays an example of what the Test.UDL looks like before anything is entered into the connection properties. Then, we see the results afterwards once generic connection information is entered and **Test Connection** is clicked. It’s important to note that if you select the option to use the **Windows NT Integrated security**, this will attempt to authenticate to SQL using the account you are logged on with. Therefore, if that account has not been added or authenticated to the SQL Server previously, it’s likely that the **Test Connection** option will fail. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FIOIPSBSs7iK4Aod4_TmnFQcB8bzPIsWwN.png&width=768&dpr=4&quality=100&sign=fed70086&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-tools#wireshark) **Wireshark** Wireshark is a network protocol analyzer and is considered the de facto standard across many industries and educational institutions. You can download Wireshark from [https://www.wireshark.org(opens in a new tab)](https://www.wireshark.org/) . Wireshark allows you to collect data and analyze network traffic to let you see what’s happening on the network at a microscopic level. It can be very helpful in troubleshooting ePO server performance issues. Wireshark is an open source network traffic capture and analysis tool that is a very popular choice in Technical Support circles because it's free and has high platform compatibility. Wireshark can be used to capture network traffic to obtain a snapshot of the issue from the network level and to view and analyze that capture. If you are not reproducing the issue while the capture is running, anything captured will not be useful, so always confirm the issue was reproduced while the capture was running. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-tools#wireshark-common-filter-options) **Wireshark: Common Filter Options** Wireshark typically captures enough data to fill a warehouse by just running for only a few minutes. Therefore, we’ve identified some filters along with some associated operators here that may help to pinpoint the traffic you are looking for when reviewing a Wireshark trace. ![Examples:eth.addr==D4-BE-D9-25-2C-13ip.addr==172.17.8.8 && ip.addr==172.17.2.3](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2F2d8V-5381SSWh63K_X_C46tsz2hSHQDsp.png&width=768&dpr=4&quality=100&sign=38351d51&sv=2) **Examples**: #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-tools#wireshark-example-capture) **Wireshark: Example Capture** For example, Wireshark can help determine if update issues are being caused by connectivity problems, repository problems or problems on the host. From an ePO perspective, Wireshark can also be used to validate that hosts are receiving new policies and tasks. CONTINUE ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FtJzQFAmw-m7oqhtN_f-kDbkSUHSpxaVhG.png&width=768&dpr=4&quality=100&sign=4a5b9703&sv=2) [PreviousTroubleshooting using Log Files](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files) [NextModule Summary](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/module-summary) Last updated 1 year ago --- # Policies Overview | Trellix ePolicy Orchestrator - On-prem 5.1 ![Page cover](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Fstatic-2c.gitbook.com%2F_next%2Fstatic%2Fmedia%2Fdefault-page-cover.a2ccd7e9.svg&width=1248&dpr=4&quality=100&sign=e8817b65&sv=2) Policies are a collection of rules or settings that make sure a product's features are configured correctly on your managed systems. ePO policy management features or functions include: Policy Catalog[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#policy-catalog) Provides a central location for the creation and management of default and custom policies Policy Assignments[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#policy-assignments) The policy settings are defined in the policy object, which is done in the Policy Catalog. The assignments then determine where in the tree that particular object is assigned. For example, if you want a particular setting applied to a machine, you would first create a policy object with the desired setting in the policy catalog, and then assign it to the relevant machine. Policy Assignment Rules[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#policy-assignment-rules) Reduce the overhead of managing numerous policies for individual users or systems that meet specific criteria while maintaining more generic policies across your System Tree Policy History[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#policy-history) Lets you view and compare policy history entries or revert to a previous version of a policy Policy Comparison[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#policy-comparison) Lets you compare like policies (all settings, matches, differences). Many of the values and variables are specific to each product. Optionally, you can open a printer-friendly view of the comparison. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#permission-sets) **Permission Sets** To view, or to view and edit policies, you must have the appropriate permissions. Administrators always have permission to view and change policy settings, but other ePO users may need permissions through their respective permission set. As you add new extensions to the ePO server by installing new point-products, you have new permission sets that control the access to the policies for those products. By default, the extensions install with no permissions for users other than the Administrator. ![Menu > User Management > Permission Sets](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FTB50mXYQGp4uo4La_Nau4oNW2hUjendHq.png&width=768&dpr=4&quality=100&sign=bc313f4e&sv=2) _**Menu**_ \> _**User Management**_ > _**Permission Sets**_ * * * #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#assignment-and-inheritance) **Assignment and Inheritance** It is likely that most systems within any environment will require an identical or very similar configuration. A small minority of systems may require radically different settings from the majority. * The purpose of policy objects and inheritance is to allow the described scenario (or any given scenario) to be implemented with the minimal effort possible. * Policy assignment is the allocation of a specific named policy object at a specific node within the ePO System Tree to achieve this. * Policy inheritance is the concept of a higher-level policy assignment being applied to a lower-level node. Creating and configuring a policy object assigned at the System Tree level gives all systems identical settings. For any systems that do not require these settings, create, configure, and assign a different policy object with the new values. Inheritance will ensure that these new values are enforced from the chosen level down, until another policy is assigned. ePO provides two policy objects (one is named Trellix Default and the other is My Default) for each product or product configuration category. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FBR62Scs_v6XUYgZk_fo1vmv-x7if13wlW.png&width=768&dpr=4&quality=100&sign=215af65f&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#user-interface) **User Interface** To access the Policy Catalog entries, click **Menu** \> **Policy** \> **Policy Catalog** or select **Policy Catalog** from the top Menu bar in the ePO console. The Policy Catalog has been divided into three sections: * Products * Policy Category * Policy Details _**Click the information (i) icon in each section in the figure below to see additional details.**_ ![Policy Catalog UI.png](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FpL_wZG7fBeiattYs_ug9XMgngI52h0l21.png&width=768&dpr=4&quality=100&sign=41e3021d&sv=2) 1. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FZnaBLZEyb4AmMU5wNVic%252Fimage.png%3Falt%3Dmedia%26token%3D1dae819a-1397-4b2e-bd1f-ce7132fa6222&width=300&dpr=4&quality=100&sign=86b786f4&sv=2) 2. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FyMehGc4uKBKyqIcc5vKU%252Fimage.png%3Falt%3Dmedia%26token%3D7a0a65fd-398e-43a6-8047-f24afb67f245&width=300&dpr=4&quality=100&sign=e568854e&sv=2) 3. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FaEz72iobCNhIqL9gRukQ%252Fimage.png%3Falt%3Dmedia%26token%3De4755441-db67-461d-8667-9fe6a68182f6&width=300&dpr=4&quality=100&sign=a5e0a49e&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#policy-approval-management) **Policy Approval Management** As an administrator, you can choose whether policy and task management users need approval to make policy or task changes The Permission Sets allow some policy users not only to create and modify policies, but also to approve or reject policies created by other users. To manage policy creation, you can create permission sets for users who can create and modify specific product policies. For example, you can create permission sets that allow one user to change policies and another user permission to approve or reject those changes. ![Menu > Configuration > Server Settings](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2F15AqY1AvPy7_H5xu_ay2kbv9M94lI66-j.png&width=768&dpr=4&quality=100&sign=c57ebc99&sv=2) _**Menu**_ \> _**Configuration**_ \> _**Server Settings**_ * * * To configure the Server Settings to allow users to submit policies for approval: 1. Open **Menu** \> **Configuration** \> **Server Settings**. 2. Click **Approvals** on the Setting Categories pane. 3. Click **Edit**. 1. Select **Users need approval for policy changes** if policy users need to seek approval to make changes. 2. Select **Administrators and Approvers need approval for policy changes** if the administrators and approvers also need to seek approval to make changes. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#policy-catalog-1) **Policy Catalog** You use the Product menu to view the available policies for a specific product. Policies are further filtered by Policy Category. The categories vary for each product. Example: Trellix Agent policies are organized by these categories: * General * Repository * Troubleshooting * Custom Properties * Product Improvement Program ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2Fef3XyxGFtXk_jf_r_QjaURySiD1_FfBIZ.png&width=768&dpr=4&quality=100&sign=bc22d037&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#policy-category) **Policy Category** The figure below highlights some key controls for a selected product's available product categories. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2F05hF0dFjLx2eW_eE_e3EobgDInQB_QCkN.png&width=768&dpr=4&quality=100&sign=6424cb9e&sv=2) 1. **Search**: Provides ability to search policy categories based on search string 2. **New policy**: Launches the Create a New Policy dialog box, where you can create a new policy for a selected product and category - **Import**: Imports previously exported policies to the selected product - **Export**: Downloads or displays the policies of the selected product in .xml format. 3. Policy Categories: Name: Lists the name of existing policies. To open a policy, click the link for its name. Rule Assignments: Shows the number of rule assignments for the policy Assigned To: Shows the number of assignments for the policy. Assigned policies are linked to a corresponding Policy Assignment page. Actions: Provides links to the actions available for a selected policy. Some policies are read-only and can only be duplicated. - **View**: Opens a viewable version of the policy details page for the selected product - **Edit**: Opens an editable version of the policy details page for the selected product #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#policy-details) **Policy Details** The figure below highlights some key controls for the policy details of a selected product category. ![Policy Details.png](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FayasN9wPnS65dHJ1_nKHmtrkJ8RWLb1ft.png&width=300&dpr=4&quality=100&sign=d6b60ba7&sv=2) 1. **Policy Actions**: **Duplicate**: Make a copy of policy to edit **Delete**: Delete policy **Export**: Download policy in .xml format Share: Designate policy to be shared to another ePO server 2. **Policy Information**: **Policy Name**: Shows policy name for selected policy category **Notes**: Allows adding notes to the policy **Owner**: Shows policy owner (click link to manage ownership) 3. **Assignments**: **Affected Systems**: Lists name of existing policies (Click link to open) **Assigned To**: Shows group or system policy is assigned to **Rule Assignments**: Shows number of rule assignments for the policy 4. **History**: **View Full Policy History**: Opens Policy History page directly for selected product and product category The Policy Catalog includes two types of default polices for managed products: Read-only and editable. * You cannot rename, edit, or delete read-only policies. However, you can duplicate and then customize them, as required. * You can change, rename, duplicate, delete, and export custom policies. This includes custom policies that you create by duplicating an existing policy or by clicking the New Policy button. When you open an existing policy or create a new policy, the policy settings are organized by tabs, which you click to view and define the settings on that tab. The blue checkmarks indicate enabled policy options. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FkXWHhFvw5zdzKoxW_MfOv5N9_A9MH9J-q.png&width=768&dpr=4&quality=100&sign=56c2dad1&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#policy-management) **Policy Management** #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#duplicating-a-policy) **Duplicating a Policy** When you duplicate a policy, you create an exact copy but with a different name. After duplicating the policy, open and edit it as required. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FuSZxQ25OjquOqPRn_mgZ4ZmzYKk9EwYKH.png&width=768&dpr=4&quality=100&sign=6784937d&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#adding-a-policy) **Adding a Policy** Like a duplicated policy, a new policy is based on an existing policy and can be created by clicking the **New Policy** button. Again, after creating the policy, open and edit it as required. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2F1wr1j85WYCnv2F62_B4VmZoSj6KdFwy41.png&width=768&dpr=4&quality=100&sign=272b0e41&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#editing-a-policy) **Editing a Policy** You can edit policies in two locations: Policy Catalog and System Tree. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FLMyxZSOZjE899AL5_R8dAkyDjkB04G3Pq.png&width=768&dpr=4&quality=100&sign=36910569&sv=2) **Some policies are read-only and cannot be edited. The** _**Actions**_ **column indicates if the policy you are viewing is read-only.** #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#changing-policy-ownership) **Changing Policy Ownership** No one can modify or delete a policy except the policy’s owner or an Administrator. Any user with appropriate permissions can assign any policy in the Policy Catalog page, but only the owner or a global administrator can edit the policy. All policies, for products and features to which you have permissions, are available from the Policy Catalog page. To prevent any user from editing other users’ policies, each policy is assigned an owner: the user who created it. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FonAvh_kEJ6HdWWIC_vlqnodRhYTm-a14C.png&width=768&dpr=4&quality=100&sign=c0c72566&sv=2) Guidelines for policy ownership: * Only _Owner_ and _Administrator_ can change ownership * Only users with appropriate permissions can be assigned ownership * You can specify multiple non-administrative users as owners of a single policy #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#exporting-and-importing-policies) **Exporting and Importing Policies** You can use the Export and Import tasks to move policies between servers. To do this, you must export the policy to an XML file, from the Policy Catalog page of the source server, then import it to the Policy Catalog page on the target server. You can export and import all policies for a product or a single policy. ![Exporting all Product PoliciesTo export all product policies, select the product under the Products column, select Export in the New Policy drop-down, right click the Download file link and select Save link as...You can then use this file to import to another ePO server.Importing PoliciesTo import policies, select the product under the Products column, select Import in the New Policy drop-down, click the Choose File entry and double-click the policy XML file you want to import.](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FiUy7Ap4X85roAolk_2YbytQxdjkciu_Hl.png&width=768&dpr=4&quality=100&sign=53c37bad&sv=2) **Exporting all Product Policies** To export all product policies, select the product under the _Products_ column, select **Export** in the _New Policy_ drop-down, right click the **Download file** link and select **Save link as...** You can then use this file to import to another ePO server. **Importing Policies** To import policies, select the product under the _Products_ column, select **Import** in the _New Policy_ drop-down, click the **Choose File** entry and double-click the policy XML file you want to import. * * * ![Exporting a Single PolicyTo export a single policy, select the Product under the Products column, select the policy, click Export under the Edit drop-down in Policy Details, right click the Download file link and select Save link as...You can use this file to import to another ePO server or to keep as a backup of the policy.](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FMmC6OawAyWbng9PB_6ldr-zPAL_3pMguH.png&width=768&dpr=4&quality=100&sign=5f3d2287&sv=2) **Exporting a Single Policy** To export a single policy, select the Product under the _Products_ column, select the policy, click **Export** under the Edit drop-down in _Policy Details_, right click the **Download file** link and select **Save link as...** You can use this file to import to another ePO server or to keep as a backup of the policy. * * * #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#renaming-or-deleting-a-policy) **Renaming or Deleting a Policy** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FAhnSgBAy7j7hIT_7H3aY2w%2F1693969305%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DVHVlIFNlcCAwNSAxNTowMTo0NSBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2F3DaC3i_KS-2ymW04_lYbVXfGRvpBmHvbP.png&width=768&dpr=4&quality=100&sign=f3e1a6ae&sv=2) After selecting (highlighting) the policy (ABC Company above), do one of the following: **RENAME**: 1. Click the policy name field and enter in a new name 2. Click **Save Name**. **DELETE:** 1. Expand the Edit drop-down under Policy Details and select **Delete**. 2. Confirm you want to delete the policy entry and click **OK**. When you delete a policy, all groups and systems inherit the policy of their parent group, where applied. Before deleting a policy, review the groups and systems where it is assigned. If you don’t want the group or system to inherit the policy from the parent group, assign a different policy. If you delete a policy that is applied to the My Organization group, the McAfee Default policy of this category is assigned. **Policy Assignment Management** Assigning a Policy is the allocation of a specific named policy at a specific node within the ePO System Tree. A policy may be assigned to any node within the ePO System Tree, from the System Tree object itself, to a group or an individual system. > ### > > [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#card-title-54) > > Assigning Policy to the Subgroup > > Use this task to assign a policy to a specific group of the System Tree. You can assign policies before or after a product is deployed. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FZenTF7QyamPhmPt1r24d%252Fimage.png%3Falt%3Dmedia%26token%3De23aa231-3971-482d-b941-d3afddbbf36b&width=768&dpr=4&quality=100&sign=11081ea&sv=2) From the **System Tree** > **Assigned Policies** tab, in the left pane, select a subgroup. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FA2gukLy09LwX1quVm4Cb%252Fimage.png%3Falt%3Dmedia%26token%3Dd97fd697-5816-46eb-a186-14829a36be89&width=768&dpr=4&quality=100&sign=6dfa716&sv=2) At the top of the right pane, select the product from the **Product** drop-down list. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Fplv7fbjGYeO54S4LCSq2%252Fimage.png%3Falt%3Dmedia%26token%3D2dc21e37-282f-4ba3-b31e-a68a86bbebf5&width=768&dpr=4&quality=100&sign=9ee94925&sv=2) In the right pane, select (highlight) a row and then on the far right, click the **Edit Assignment** link. a Policy Assignment page opens. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FU9roYdRbu8njfGn90mV9%252Fimage.png%3Falt%3Dmedia%26token%3Db6252f83-7e00-4a8f-a14f-56ac7683a3fd&width=768&dpr=4&quality=100&sign=94a6a8a2&sv=2) 1. To break inheritance from the parent group, click the radio button by **Break inheritance**. 2. From the **Assigned policy** drop-down list, select the policy you want to assign to this subgroup. 3. Choose whether to lock policy inheritance. This prevents any systems, that inherit this policy, from having another one assigned in its place. 4. Click **Save**. > ### > > [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#card-title-60) > > Assigning Policy to a Single System > > Use this task to assign a policy to a single or system. You can assign policies before or after a product is deployed. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FEx9WLOWsSPa5KPqIfuTV%252Fimage.png%3Falt%3Dmedia%26token%3Dba7d3a32-8172-4ffd-b228-1201d69b899f&width=768&dpr=4&quality=100&sign=325a2b3c&sv=2) From the **System Tree** > **Assigned Policies** tab, in the left pane, select a subgroup. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FMJcxu9LtWxPs3OUnnGPH%252Fimage.png%3Falt%3Dmedia%26token%3Dc42d8fd9-5767-4d47-ae4d-b8d833d82964&width=768&dpr=4&quality=100&sign=53de1c5a&sv=2) At the top of the right pane, select the product from the **Product** drop-down list. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Fjw21lE8okGSKJyTEy28p%252Fimage.png%3Falt%3Dmedia%26token%3D70a4d5d4-ed41-4767-9c16-0fb24cb169ec&width=768&dpr=4&quality=100&sign=e44dc4ef&sv=2) In the right pane, select (highlight) a row and then on the far right, click the **Edit Assignment** link. a Policy Assignment page opens. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FWFjkrgZXDQscfo4nD4ro%252Fimage.png%3Falt%3Dmedia%26token%3D2ee33fd9-7b8e-442c-b2ab-a3860677d7f5&width=768&dpr=4&quality=100&sign=502fdfb0&sv=2) 1. To break inheritance from the parent group, click the radio button by **Break inheritance**. 2. From the **Assigned policy** drop-down list, select the policy you want to assign to this subgroup. 3. Choose whether to lock policy inheritance. This prevents any systems, that inherit this policy, from having another one assigned in its place. 4. Click **Save**. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#card-title-40) Assigning Policy to a Single System Use this task to assign a policy to a single or system. You can assign policies before or after a product is deployed. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FMnBQiHbdxObGyCA1tLJQ%252Fimage.png%3Falt%3Dmedia%26token%3D9c184776-7275-4ea2-b1c1-656b896aad3f&width=768&dpr=4&quality=100&sign=7f5fbc19&sv=2) From the **System Tree** \> **Systems** tab, in the left pane, select the group to which the system belongs. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FKD3emsa0B5iEeRIX7s7m%252Fimage.png%3Falt%3Dmedia%26token%3D971c346c-8b48-4266-aabe-72cb8823d5d8&width=768&dpr=4&quality=100&sign=4ad1d3d5&sv=2) In the right pane, mark the checkbox by the system. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F5vq6OQ8olqthw7KoOYWQ%252Fimage.png%3Falt%3Dmedia%26token%3D4012653a-269d-4d33-a6df-fcd3ab67ec6c&width=768&dpr=4&quality=100&sign=66eb1a52&sv=2) At the bottom of the page, select **Actions** \> **Agent** \> **Edit Policies on a Single System**. A Policy Assignment page opens. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FjADDw8Ub3qYg40aPBGkl%252Fimage.png%3Falt%3Dmedia%26token%3D06b552a4-84ad-48f1-a327-e89373a19d57&width=768&dpr=4&quality=100&sign=ece4e961&sv=2) Select (highlight) the desired policy category, then click **Edit Assignment**. (Do not click the policy name.) ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FqrxhzRuvPn6YQ1bujZCe%252Fimage.png%3Falt%3Dmedia%26token%3D74c5ebb3-8908-4f1a-9e2d-f11f17a19782&width=768&dpr=4&quality=100&sign=f10d844f&sv=2) If the policy is inherited, select **Break inheritance and assign the policy and settings below**, next to _Inherit from_. Select the desired policy from the **Assigned policy** drop-down list, then click the **Save** button. **Note**: From this location, you can also edit the settings of the selected policy or create a new policy. **Assigning Policy to Multiple Managed Systems** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FsHU7ueuELIB8Ck8BjrP2%252Fimage.png%3Falt%3Dmedia%26token%3Da6acdece-cc9a-4fbd-b935-96b0019e72e1&width=768&dpr=4&quality=100&sign=e68cf633&sv=2) 1. From the **System Tree** > **Systems** tab, in the left pane, select the group. 2. In the right pane, mark the checkbox by each system. 3. Click **Actions** \> **Agent** \> **Set Policy & Inheritance**. The Assign Policy page displays. 4. Complete the Assign Policy page and click **Save**. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#card-title-47) Copying and Pasting Assignments Use these tasks to copy and paste policy assignments from one group or system to another. This is an easy way to share multiple assignments between groups and systems from different areas of the System Tree. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FSAiRhNhJC0z3b0JTwJbC%252Fimage.png%3Falt%3Dmedia%26token%3Dfdc616f2-1d35-4356-afc7-803f686b9571&width=768&dpr=4&quality=100&sign=102b77a7&sv=2) From the **System Tree** > **Assigned Policies** tab, select the desired group in the System Tree and select the product from the **Product** drop-down list. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FosjqYjxM3oiRJ2TrkvDM%252Fimage.png%3Falt%3Dmedia%26token%3D9b6d4ad0-6c5b-4c66-bd54-e37d9d77e424&width=768&dpr=4&quality=100&sign=75c73a5a&sv=2) Select **Actions** \> **Copy Assignments**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FwrxQqUnjT9bJbr5ZouRk%252Fimage.png%3Falt%3Dmedia%26token%3D5fb38690-ff6c-4e91-aa1d-e335c5a0dfbb&width=768&dpr=4&quality=100&sign=43217273&sv=2) Click in the **Products and Features** box to unselect all the products and click next the desired product, then click **OK**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FwHc3fYNzTypagwm8TDLC%252Fimage.png%3Falt%3Dmedia%26token%3D84c16b1f-75e6-490d-aa65-aa61197a3cf2&width=768&dpr=4&quality=100&sign=aabdabe8&sv=2) On the **System Tree** > **Assigned Policies** tab, selected the desired group, then click **Actions** \> **Paste Assignments**. Note: If the group already has policies assigned for some categories, the Override Policy Assignments page displays. If this page appears, select the policy category to paste and click **OK**. **Exporting and Importing Policy Assignments** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F9RlNZS60tgbYXcFXLzzW%252Fimage.png%3Falt%3Dmedia%26token%3Deece1172-4b5a-4268-83ef-2e89bdbfe2aa&width=768&dpr=4&quality=100&sign=8b5f7b6b&sv=2) * **Export All Assignments**: Exports all displayed assignments to an XML file * **Export Group Policies**: Exports policies assigned to a specific group * **Export Table**: Displays the Export page, allowing you to choose the way the table is exported * **Import Assignments**: Imports previously exported policy assignments #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#locking-policy-assignment) **Locking Policy Assignment** Policy enforcement locking prevents other users from changing policy assignment settings: in the group where locking took place and in any subgroups. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FOWSu43XC84w3llGJm96z%252Fimage.png%3Falt%3Dmedia%26token%3D07cc510d-5643-4d4c-bbaf-d9c4b5f77d72&width=768&dpr=4&quality=100&sign=7ea2bf05&sv=2) * Can be locked at any group within the System Tree * Does not prevent a policy from being modified * Prevents breaking inheritance below the point of assignment ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#policy-assignment-approval) **Policy Assignment Approval** With the Policy Assignment Approval feature, if the user or administrator tries to assign the policy on systems or groups, then the administrator or the user with appropriate permissions can verify and approve the changes before it gets assigned and pushed to systems or groups. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FzMLrDhuUCJVP6vPJWtpm%252Fimage.png%3Falt%3Dmedia%26token%3D697d824d-a403-4799-95e9-1a25cddc5ef9&width=768&dpr=4&quality=100&sign=d72014e4&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#policy-assignment-rules-1) **Policy Assignment Rules** Policy assignment rules reduce the overhead of managing numerous policies for individual users or systems that meet specific criteria, while maintaining more generic policies across your System Tree. This level of granularity in policy assignment limits the instances of broken inheritance in the System Tree needed to accommodate the policy settings that specific users or systems require. Policy assignments are based on user-specific or system-specific criteria. * System-based rules: * Assigned to managed systems * Assigned priority, which can be changed * Cannot include user-based criteria * User-based rules: * Assigned to groups, organizational units, or user names * Can include system-based criteria * Enforced when users log into the network ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#card-title-53) Creating Policy Assignment Rules ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F3AevLR3P38LAGcTIuE75%252Fimage.png%3Falt%3Dmedia%26token%3Dc968be3e-8f1e-4ace-818f-c056cb2c05f6&width=768&dpr=4&quality=100&sign=ae6bedbc&sv=2) Complete these steps from the Policy Assignment rules page. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FiTGAdfkTADmeLK4ah785%252Fimage.png%3Falt%3Dmedia%26token%3D2c318909-8b5f-4b85-8782-fe5265d54d61&width=768&dpr=4&quality=100&sign=4494f257&sv=2) Click the **New Assignment Rule** button at the top of the page to launch the Policy Assignment Builder. Your first step is to enter rule details (Name and Description), then click **Next**. **Note**: By default, the priority for new policy assignment rules is assigned sequentially based on the number of existing rules. You can edit the priority of this and any rule by clicking **Edit Priority** on the Policy Assignment Rules page. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FaizmV8SCbAXD2F2FaiJ1%252Fimage.png%3Falt%3Dmedia%26token%3De2d6dade-b487-43a9-94e0-6a9a86f97d99&width=768&dpr=4&quality=100&sign=27e9064c&sv=2) From the Assigned Policies page, click **Add Policy** and select the policies to be applied. Click the plus sign (**+**) to add another policy. Click the minus sign (**\-**) to remove a policy. Click **Next** to continue. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F72VExyV6NivxVzuRgIK8%252Fimage.png%3Falt%3Dmedia%26token%3D9265237b-f4ee-4291-a545-6370bf6e0c34&width=768&dpr=4&quality=100&sign=9403e5c7&sv=2) From the Selection Criteria page, choose the criteria for this assignment (**Comparison** and **Value**). Apply any additional **Available Properties** from the left pane, then click **Next**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Fc9BoXpp1NESdVwnTNogM%252Fimage.png%3Falt%3Dmedia%26token%3D6d9f41d0-d23c-4736-bece-8cf201fd78e0&width=768&dpr=4&quality=100&sign=9f0099e6&sv=2) From the Summary page, review the rule configuration. Click **Back** to make changes to prior screens. When satisfied with the configuration, click the **Save** button in the bottom right corner of the page. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#policy-assignment-rules-priority) **Policy Assignment Rules Priority** Policy assignment rules can be prioritized to simplify maintenance of policy assignment management. When you set priority to a rule, it is enforced before other assignments that have a lower priority. By default, the priority for new policy assignment rules is assigned sequentially, based on the number of existing rules. You can edit the priority of this, or any, rule by clicking **Edit Priority** on the Policy Assignment Rules page. In some cases, the outcome can be that some rule settings are overridden; for example, consider a user or system that is included in two policy assignment rules, Rules A and B. Rule A has priority level 1 and allows included users unrestricted access to internet content. Rule B has priority level 2 and heavily restricts the same user's access to internet content. In this scenario, Rule A is enforced because it has higher priority. As a result, the user has unrestricted access to internet content. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F7o6ZLEbVhIZYxLo1Chkm%252Fimage.png%3Falt%3Dmedia%26token%3D34b78999-b0ab-4225-bbe5-057fa687e83b&width=768&dpr=4&quality=100&sign=c3b52ad6&sv=2) #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#resetting-broken-inheritance) **Resetting Broken Inheritance** ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2F3LFlnPIoN1Ptoj2jNrEF-g%2F1694487374%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DTW9uIFNlcCAxMSAxNDo1NjoxNCBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FGmPVJu2Mt1kBIFqq_g4HsbncZ-_5gyzbu.png&width=768&dpr=4&quality=100&sign=fefeba13&sv=2) 1. From the **System Tree** > **Assigned Policies** tab: Locate the **Broken Inheritance** column on the right. This column displays the number of groups and systems where this policy's inheritance is broken. **Example**: If only one group does not inherit the policy, this is represented by _1 doesn't inherit_, regardless of the number of systems within the group. 2. Click the link indicating the number of child groups or systems that have broken inheritance. The Broken Inheritance page displays a list of the names of these groups and systems. 3. To reset the inheritance of any of these, mark the checkbox next to the name, then click **Actions** \> **Reset Inheritance**. You can also click the **Edit Assignment** link, the **Broken Inheritance** link, then **Actions** \> **Reset Inheritance**. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#policy-enforcement) **Policy Enforcement** Policy enforcement is an inherited property that is independent from policy assignment. It is inherited from the System Tree root (My Organization) unless inheritance is turned off. By default, when assigned, all policies have an Enforcement status of **Enforcing**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2F3LFlnPIoN1Ptoj2jNrEF-g%2F1694487374%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DTW9uIFNlcCAxMSAxNDo1NjoxNCBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FSpn9diIOuT7JBHNU_CUtxs38UGaaGAe_z.png&width=768&dpr=4&quality=100&sign=b3b1004d&sv=2) **If a policy is not enforced, it will not be implemented by the Trellix Agent. This means that, although the managed system has received the policy assigned to it, that policy will not be applied on the system.** Policies are enforced when: * The agent communicates with the ePO server or the Agent Handler at the configured agent-to-server communications interval (ASCI) * You send an Agent Wake Up call from the ePO server (updates and enforces policies on the client) * In addition, if the client end user has access to the Trellix Agent Status Monitor (set by the policy), the user can click the Check New Policies button to initiate communication and enforce policy changes. When you reconfigure policy settings, the new settings are delivered to and enforced on the managed systems at the next agent-server communication. The frequency of this communication is determined by the Agent-to-server-communication interval (ASCI) settings on the General tab of the Trellix Agent policy pages or the Trellix Agent Wakeup client task schedule (depending on how you implement agent-server communication). By default, this interval is set to occur once every 60 minutes. Once the policy settings are in effect on the managed system, the agent continues to enforce local policy settings at a regular interval. This enforcement interval is determined by the Policy enforcement interval setting on the General tab of the Trellix Agent policy pages. By default, this interval is set to occur every 60 minutes. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2F3LFlnPIoN1Ptoj2jNrEF-g%2F1694487374%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DTW9uIFNlcCAxMSAxNDo1NjoxNCBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FyD26rcEQBLYfxYYP_XdZFyIudAEb2DNVG.png&width=768&dpr=4&quality=100&sign=18ed852e&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#policy-comparison-1) **Policy Comparison** ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#card-title-59) Introduction The Policy Comparison feature lets you compare similar policies. This helps to determine which settings are different and which settings are the same. Many of the values and variables included in Policy Comparison are specific to each product. For product policies not included in the table, see the documentation for the product that provides the policy that you want to compare. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FcDf0l7zdZLrByY6DwMWM%252Fimage.png%3Falt%3Dmedia%26token%3D0c7df60a-a466-4886-9570-802d17179ef9&width=768&dpr=4&quality=100&sign=515237a9&sv=2) Click **Menu** \> **Policy** \> **Policy Comparison**, then select a product and category from the lists. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252F67KU2746adjmWb92NXUW%252Fimage.png%3Falt%3Dmedia%26token%3D2a7ae7ad-afd7-4cf3-b5b9-965a56b14078&width=768&dpr=4&quality=100&sign=a05c8349&sv=2) Select **Show Only Differences** or **Show All Settings**. These settings populate the policies to compare in the **Policy 1** and **Policy 2** lists. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252Fpc2JD2OzmBRpXv3azXFV%252Fimage.png%3Falt%3Dmedia%26token%3D65df8a15-c3ee-4a49-8804-2fa8109644b8&width=768&dpr=4&quality=100&sign=a865b7b9&sv=2) Select the policies to compare in the row from the **Policy 1** and the **Policy 2** column lists. The top two rows of the table display the number of settings that are different and identical. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2F3241386954-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FjmsGhOHPrgQSX87jFLLt%252Fuploads%252FWYFiyrQVnlDLenBSSvt0%252Fimage.png%3Falt%3Dmedia%26token%3D3f766190-bec9-4d43-beed-341fb0b4604c&width=768&dpr=4&quality=100&sign=e1e5d69a&sv=2) Click **Print** in the bottom right corner of the screen to open a printer-friendly view of this comparison. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/policies-overview#card-title-64) Summary ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2F3LFlnPIoN1Ptoj2jNrEF-g%2F1694487374%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DTW9uIFNlcCAxMSAxNDo1NjoxNCBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FlAyGybGvZutGqD5b_Q2pRTWwl-Hyk6_jz.png&width=768&dpr=4&quality=100&sign=7465ed15&sv=2) The **Show All Settings** / **Show Only Differences** options populate the policies to compare in the Policy 1 and Policy 2 lists. The Show Only Differences option, when selected, shows only the policy changes between the two policies being compared, providing a quick look at what’s different between the two policies. **Policy History** When you change a policy from the Policy Catalog, a Policy History entry is created where you can describe the change for future reference. Policy History entries display in three places: * Policy History * Server Task Log Details * Audit Log Details Only polices you create in the Policy Catalog have Policy History entries. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2F3LFlnPIoN1Ptoj2jNrEF-g%2F1694487374%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DTW9uIFNlcCAxMSAxNDo1NjoxNCBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2F99RZ7i6eNMxI0oaI_rXaMFVQyid_zUKye.png&width=768&dpr=4&quality=100&sign=f4b73a87&sv=2) 1. To view the Policy History, select **Menu** \> **Policy** \> **Policy History**. **Note**: No Policy History entries display for McAfee Default policies. You might need to use the page filter to select a created or duplicated McAfee Default policy. 2. Use the **Product**, **Category**, and **Name** filters to select Policy History entries. 3. To manage a policy or Policy History entry, click **Actions**, then select an action. * **Choose Columns:** Opens a dialog box that allows you to select which columns to display. * **Compare Policy:** Opens the Policy Comparison page, where you can compare two selected policies. The current version of a policy has the latest date. To compare the current revision of a policy and a previous policy revision, select the latest revision and a previous revision. * **Export Table**: Opens the Export page, where you can specify the package and format of Policy History entry files to export, then email the file. * **Revert Policy**: Reverts the policy to the selected policy version. You can select only one target policy. Make sure that you leave a comment when you revise a policy. Consistent commenting creates a strong history of your changes. To record policy revisions, enter a comment in the text field next to **Duplicate** in the footer of the **Policy Catalog** page. [PreviousModule Intro](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/module-intro) [NextDuplicating and Editing a Policy Simulation](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/policy-management/duplicating-and-editing-a-policy-simulation) Last updated 1 year ago --- # Troubleshooting using Log Files | Trellix ePolicy Orchestrator - On-prem 5.1 Below are some common issues associated with ePO and their related log files. Click on the plus sign (+) next to each issue to see its related log files. Agent: in general; client communication tasks[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#agent-in-general-client-communication-tasks) Masvc\_.LOG Macompatsvc\_.LOG Agent: installation; uninstallation[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#agent-installation-uninstallation) FRMINST\_.LOG MFEagent.msi..LOG Agent: push[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#agent-push) server\_.LOG Agent: updating client, managed products[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#agent-updating-client-managed-products) MCSCRIPT.LOG -- (for managed tasks) UPDATERUI\_.LOG -- (for local tasks) Agent: wake-up[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#agent-wake-up) SERVER\_.LOG Agent-server communication[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#agent-server-communication) SERVER\_.LOG, SERVER\_BACKUP.LOG Masvc\_.LOG Client tasks: communication[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#client-tasks-communication) Agent\_.LOG Agent\_\_BACKUP.LOG Client tasks: scripts[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#client-tasks-scripts) MCSCRIPT.LOG Distributed Repositories[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#distributed-repositories) REPLICATION.LOG ePOAPSVR\_.LOG ORION.LOG Error: Apache web server[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#error-apache-web-server) ERRORLOG. Error: Tomcat servlet container[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#error-tomcat-servlet-container) STDERR.LOG, JAKARTA\_SERVICE\_, LOCALHOST\_ACCESS\_LOG., ORION.LOG Events, event update[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#events-event-update) EVENTPARSER\_.LOG, EVENTPARSER\_\_BACKUP.LOG Installation: ePO calls to background, foundation, or other platforms and technologies[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#installation-epo-calls-to-background-foundation-or-other-platforms-and-technologies) CORE-INSTALL.LOG, CORE-UPGRADE.LOG, CORE-RESTORE.LOG ePO-INSTALL.LOG, Installation: ePolicy Orchestrator custom actions[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#installation-epolicy-orchestrator-custom-actions) ePO5XXCOMMONSETUP.LOG Installation: ePolicy Orchestrator[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#installation-epolicy-orchestrator) ePO5XX-INSTALL-MSI.LOG Migration: from earlier version[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#migration-from-earlier-version) MIGRATION.LOG ePO5XX-INSTALL-MSI.LOG Notifications[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#notifications) ORION.LOG Policies[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#policies) SERVER.LOG Masvc\_.LOG Policy Update[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#policy-update) Macompatsvc\_.LOG Product Property Update[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#product-property-update) SERVER.LOG Pull[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#pull) ePOAPSVR\_.LOG ORION.LOG Push Agent[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#push-agent) SERVER.LOG Replicate[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#replicate) ePOAPSVR\_.LOG ORION.LOG REPLICATION.LOG Script: Client Tasks[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#script-client-tasks) Masvc\_.LOG Script: engine; messages[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#script-engine-messages) MCSCRIPT.LOG Server: in general[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#server-in-general) SERVER.LOG SERVER\_BACKUP.LOG ORION.LOG Server: installation[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#server-installation) ePO5XXCOMMONSETUP.LOG ePO5XX-INSTALL-MSI.LOG Updating[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#updating) UPDATERUI\_.LOG -.XML (if registry value has been set) Mcscript.LOG Masvc\_.LOG (shows when task invoked) Upgrading: from earlier version[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#upgrading-from-earlier-version) MIGRATION.LOG ePO5XX-INSTALL-MSI.LOG User Interface / Console HKLM\\SOFTWARE\\Network Associates\\ePolicy Orchestrator –> (issues arising after changes to…)[](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#user-interface-console-hklm-software-network-associates-epolicy-orchestrator-greater-than-issues-ari) ORION.LOG ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#agent-log-files-overview) **Agent Log Files Overview** There are four common types of issues seen when troubleshooting various agent issues and failures: * Agent Installation * Agent-to-Server Communication * Policy Enforcement * Policy Updating Review the appropriate log files for the version of Trellix Agent running in the customer environment, as shown in the chart below. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FIaosITVuN6DszDqc_isIrzhVZElMNd4vN.png&width=768&dpr=4&quality=100&sign=75c36b42&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#agent-troubleshooting-log-files) **Agent Troubleshooting Log Files** The following tables provide troubleshooting details on how to read log files related to basic agent installation issues and failures. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#agent-installation-issues-failures) **Agent Installation Issues / Failures** Required Log Files Default Location Description How to read this log **MfeAgent.MSI.log** _%temp%\\McAfeeLogs_ Contains details about the MSI installation of the agent. Search from the top down for the phrase **value 2** or **value 3**. _**If found, a failure message will be just above this location.**_ **FrmInst\_.log** _%temp%\\McAfeeLogs_ Generated when the FrmInst.exe is used to install the Trellix Agent. This file contains: * Informational messages * Progress messages * Failure messages if installation fails Scroll to the bottom of the log and work up for any instance of **failed** or **error**. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#agent-to-server-communication-issues-failures) **Agent-to-Server Communication Issues / Failures** For information on troubleshooting agent-server communication failures in Trellix Agent 5.x, see [KB90603(opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content&id=KB90603) . Required Log Files Default Location Description How to read this log **Masvc\_.log** _ProgramData\\McAfee\\Agent\\log_ Primary agent log for MA 5.x Generated on client systems when the server deploys an agent to them. This file contains details related to: * Agent-to-server communication * Policy enforcement * Other agent tasks Start from the bottom and search upward for the phrase: **Agent started performing ASCI**. Then follow the log activity downward to review details of the agent to server communication attempt or any failures. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#policy-enforcement-policy-updating-issues-failures) **Policy Enforcement / Policy Updating Issues / Failures** Required Log Files Default Location Description How to read this log **Masvc\_.log** _ProgramData\\McAfee\\Agent\\_ _log_ Primary agent log for TA 5.x Generated on client systems when the server deploys an agent to them. This file contains details related to: * Agent-to-server communication * Policy enforcement * Other agent tasks Start from the bottom and search upward for the phrase: **Agent started performing ASCI**. Then follow the log activity downward to review details of the policy enforcement attempt or any failures. **Macompatsvc** **\_.log** _ProgramData\\McAfee\\Agent\\_ _log_ Primary log on local system for TA 5.x Contains details about policy updating, enforcement, and task information. Detailed logging can be enabled in the TA \\ General policy under the Logging tab in ePO. **Note**: Detailed logging information for policy updating and product deployment can be found in McScript.log in the same folder location here. Scroll to the bottom and look upward for any of the following for general details on policy and/or task enforcement on the local system: * Task * Policy * Enforcement ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#installer-log-files-overview) **Installer Log Files Overview** The next main type of logs collected to help troubleshoot issues are associated to the ePO Installer. The following chart provides an overview of the various types of Installer specific log files needed for troubleshooting issues and failures with: * ePO Installations and Upgrades * Agent Handler Installations and Upgrades ![Notes:While the installer is running, the <InstallLogs> location is: %temp%\McAfeeLogs.Once the installer has completed (whether successfully or not), the logs are copied to: C:\ProgramData\McAfee\ePolicy Orchestrator\InstallLogs. In a default Windows installation, C:\ProgramData is a hidden folder.](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FpcEMTfu8ISfMpKub_QeEXfQ_ZDXGVm7iv.png&width=768&dpr=4&quality=100&sign=16f5564&sv=2) **Notes**: ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#troubleshooting-installation-upgrade-issues) **Troubleshooting Installation / Upgrade Issues** For installer issues, a MER or zip containing the entire McAfeeLogs folder is required to troubleshoot these types of issues #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#steps-for-troubleshooting-installation-upgrade-failures) **Steps for Troubleshooting Installation/Upgrade Failures** 1. For detailed installer logging, run the installer in debug mode using DEBUGOUTPUT =2 (highest output level needed for troubleshooting). 2. At the time of failure, the installer will pause. 3. Grab all logs at this point of time. **IMPORTANT**: During an installation failure, the installer will copy all necessary files/folders to the user’s EPO5XX-TROUBLESHOOT folder, which is located in the %temp%\\McAfeeLogs folder by default. This is so that the MERTool can find them properly. If the MERTool is not run under the same user account that the failed installation was run under, it will not get the install logs. 4. Examine the install logs at the time of installation failure to locate probable causes. 5. Once the time is established for error, locate the orion.log, then examine it to gather additional failure information. **Notes**: * Log Level 8 debug logging settings ([KB56207(opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content&id=KB56207) ) are applicable to the **Server.log**, **ePOApSvr.log**, and **Eventparser.log** files. * See [KB52369 (opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content&id=KB52369) for details on enabling debug logging for the **Orion.log**. #### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#epo-5.x-installer-log-files-and-locations) **ePO 5.x Installer Log Files and Locations** The installer log files contain details about the ePO installation process including: * Actions taken by specific components * Administrator services used by the server * Success and failure of critical processes The ePO installer logs can be found on the logged-on user’s temp directory, under a folder called McAfeeLogs. Click **Start**, **Run**, type in **%temp%\\ McAfeeLogs** into the blank field, and click **OK**. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FFdfvhF-FQw-6WpTq_fNMcrqAJ27QOJmlg.png&width=768&dpr=4&quality=100&sign=c72cbc87&sv=2) In the _McAfeeLogs_ folder: * ePO5xx-CommonSetup.Log * ePO5xx-Install-MSI.log§ePO5xx-Debug.Ini * ePO5xx-Error.Ini All files in the following folders: * _McAfeeLogs_\\EPO5XX-Troubleshoot\\MFS * _McAfeeLogs_\\EPO5XX-Troubleshoot\\Mercury Framework * _McAfeeLogs_\\EPO5XX-Troubleshoot\\OutputFiles ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#installation-upgrade-troubleshooting-log-files) **Installation / Upgrade Troubleshooting Log Files** The following files are used to help troubleshoot ePO installation & upgrade issues: * EPO5xx-Install-MSI.log * epo-install.log * epoST.err * core-install.log * core-upgrade.log * EPO5xx-Checkin-Failure.log * <_ExtensionFileName_\>.err * EPO5xx-CommonSetup.log * <_ExtensionFileName_\>.cmd Required Log Files Default Location Description How to read this log **EPO5xx-** **Install-MSI.log** _%temp%\\McAfeeLogs_ Example: _**EPO5xx-Install-MSI.log**_ The primary ePO installation log. Contains installation details such as installer actions and installation failures. **TIP:** Start from the top and search downward for the phrase **value 3** or **value 2**: _**The failure message should display above the value message.**_ If**value** entry does not display, no error has been recorded. **epo-** **install.log** _%temp%\\McAfeeLogs\\ePO5xx-Troubleshoot\\_ _MercuryFramework_ Example: _**epo-install.log**_ Created when the ePO installer calls the ePO ANT installer, which copies and updates the Apache .conf files with the correct paths and ports. **TIP 1**: Look for '_**BUILD SUCCESSFUL**_ at the end; This task rarely fails and is not generally useful. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ **TIP 2**: Scroll to the bottom of the log and search upward for the first instance of _**error**_ or _**failed**__._ **Any failure message should indicate why the installation failed.** **epoST.err** _\\EPO5xx-Troubleshoot\\OutputFiles_ This is the error output from the ext.install remote command that installs or upgrades the bulk of the ePO extensions. **Note**: If this file exists, then there were error(s), which will be logged to it. This is probably the first place to look for errors, as this is the step that seems to fail most frequently (from case escalation reviews). Generally, errors here require changes in the extensions themselves for resolution. **Core-install.log** _%temp%\\McAfeeLogs\\_ _ePO5xx-Troubleshoot\\MFS_ Generated when ePO installer calls the MFS ANT installer. Provides information on: * Creation of server database tables * Installation of server components **Note**: This file is deleted if the installation succeeds. **TIP 1**: Look for _**BUILD SUCCESFUL**_ at the end. If it isn't there, then there was a failure executing the MFS install ANT task. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ **TIP 2**: Look for _**BUILD FAILED**_, the failure message will be listed just below that. **Core-upgrade.log** (UPGRADE only) _%temp%\\McAfeeLogs\\_ _EPO5xx-Troubleshoot\\MFS_ Example: _**core-upgrade.log**_ Generated when ePO installer calls the MFS ANT installer. Provides information on: * Creation of server database tables * of server components **Note**: This file is deleted if the installation succeeds. **TIP 1**: Look for _**BUILD SUCCESSFUL**_ at the end. If it isn't there, then there was a failure executing the MFS install ANT task. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ **TIP 2**: Look for _**BUILD FAILED.**_ The failure message will be listed just below that. **<**_**ExtensionFileName**_**\>** **.err** _%temp%\\McAfeeLogs\\_ _EPO5xx-Troubleshoot\\OutputFiles_ This is the output file of the **ext.migrate** remote command used to check in <_extension_\>.zip. **TIP**: If the check-in was successful, this file will be empty. Otherwise, error details will be contained. **EPO5xx-CommonSetup.log** _%temp%\\McAfeeLogs_ Example: _**EPO5xx-CommonSetup.log**_ Contains ePO installer details such as: * Custom Action logging * SQL, DTS (Microsoft Data Transformation Services), and service‑related calls * Registering and unregistering DLLs * Files and folders selected for deletion at restart **TIP**: Scroll to the bottom of the log and search upward for the first instance of _**error**_ or _**failed**__._ **<**_**ExtensionFileName**_**\>** **.cmd** _%temp%\\McAfeeLogs\\ePO5xx-Troubleshoot\\OutputFiles_ Created by the ePO installer. Contains the command (sent to Remote‑Client) to check in extensions. **Note**: These files are deleted if the installation succeeds. **TIP**: These files contain http commands that are run as part of the installation. Typically, you can attempt to manually execute these commands outside of the installation or upgrade. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#agent-handler-installation-issues-failures) **Agent Handler Installation Issues / Failures** When troubleshooting Agent Handler installations, you will want to start with gathering and reviewing the **AH5xx-ahsetupdll.log** and **AH5xx-Install-MSI.log** file. These files contains all of the information about the install, including what the installer is doing and any failure information. These are the main files needed for troubleshooting Agent Handler installation failures. Required Log Files Default Location Description How to read this log **AH5xx-Install-MSI.log** _%temp%\\McAfeeLogs_ Logs all Agent Handler installation details, such as: * Installer actions * Installation failures **TIP 1**: Start from the top and search downward for the phrase _**value 3**_ or _**value 2**_. _**The failure message should display above the value message.**_ \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ **TIP 2**: Search from the bottom of the file for _**aborted**_. **EPO5xx-Checkin-Failure.log** _%temp%\\McAfeeLogs_ Only generated when ePO installer fails to check in any of these package types: * Extensions * Plug‑ins * Deployment packages * Agent packages **Note**: Failure to check in the extensions is not considered fatal and will not trigger the installer to rollback. **TIP 1**: Check the error log files (_**.err**_) for the individual extensions for further details. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ **TIP 2**: Scroll to the bottom of the log and search upward for the first instance of _**error**_ or _**failed**_. **AH5xx-ahsetupdll.log** _%temp%\\McAfeeLogs_ This file is used to log information and errors that occur when using the helper functions. _**Example helper functions**_: * Create Certificates * Replace Apache tokens * Check database credentials **TIP**: This log is pretty short. Look for any instance of _**error**_ or _**failed**_. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#message-types-and-descriptions) **Message Types and Descriptions** Message Type Description Logging Level e (error) User error message 1 w (warning) User warning message 2 i (information) User information message 3 x (extended data) User extended information message) 4 E (error) Debug error message 5 W (warning) Debug warning message 6 I (information) Debug information message 7 X (extended data) Debug extended information message 8 ![Example: Server_<SystemName>.logNotes:Log Level 8 debug logging settings (KB56207) are applicable to the Server.log, ePOApSvr.log, and Eventparser.log files. See KB52369 for details on enabling debug logging for the Orion.log.](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FfXH49mSXHLV4To5-_10u20phOTvlr_fWn.png&width=768&dpr=4&quality=100&sign=3ec16c47&sv=2) **Example**: Server\_<_SystemName_\>.log ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#server-log-files-overview) **Server Log Files Overview** The next main type of logs collected for ePO are log files specific to Server functionality. The following is an overview of the various types of server specific log files needed for troubleshooting issues & failures with: * Server Tasks (like Software Catalog, AD Synchronization & Key Management) * Repository Actions (like Pulls & Replications) * Console Logins (like password management) * Event Parser (like events not being processed) * SQL Connections (like TCP/IP connectivity) It goes without saying that the associated Server logging files contains the most details pertaining to ePO server functionality. Issues seen here with the associated Server functions need to be addressed quickly so server and product performance is not affected. ![](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2FMdSRoQzC4WuPjJV-_ZvA_JaGdwwEseNWM.png&width=768&dpr=4&quality=100&sign=bccafc6f&sv=2) ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#server-tasks-issues-failures) **Server Tasks Issues / Failures** The **Orion.log** file is one of the most commonly used log files. It is mainly used to troubleshoot console, browser, Tomcat, MFS, and Java type issues. The second log file to use when troubleshooting Server Task type issues is the epoApSvr.log log. This file logs details for Server Task issues such as: * Repository Pulls * Repository Replications * Software Catalog actions * Key Management * LDAP functions * AD Synchronization Required Log Files Default Location Description How to read this log **Orion.log** <_Install\_Dir_\>\\Server\\Logs Example: _**Orion.log**_ The main application server log: * TOMCAT * MF * Console * Browser * JAVA Four levels of Severity: _**Ex**_: \[2015-01-30 19:25:00, 230 ERROR…\] * ERROR * INFO * DEBUG * WARN **TIP1**: When reading the log, the date/timestamp along with the severity code and thread # are very important. This is so you can correlate / compare messages back & forth from the orion.log and epoApSvr.log. Issue troubleshooting flow would be: 1. Review _orion.log_. 2. Gather info (date/time stamp, severity code, thread #) 3. Review _epoApSvr.log_ following the info gathered in Step 2. 4. Go back to _orion.log_ and continue reviewing. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ **TIP2**: Server Tasks will have “scheduler” as prefix _**Ex**_: \[scheduler-TaskQueueEngine-thread-1\] \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ **TIP3**: Thread name is very important. All UI traffic starts with HTTP. _**Ex**_: \[http-bio-8444-exec-8\] **epoApSvr.log** <_Install\_Dir_\>\\DB\\Logs Example: _**epoApSvr.log**_ This is the log for the C++ code that is called from Java (console). Provides details for: * Repository Pull * Repository Replication * Software Catalog * Key Management * LDAP * AD Synchronization **Note**: When in doubt, always check this log. **TIP**: When reading the log, the **date/timestamp** along with the associated code and thread # are very important. You would use the date/timestamp and thread # to follow specific interactions for that threat. See _**Message Types**_ for message description details. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#repository-action-issues-failures-pull-replications) **Repository Action Issues / Failures (Pull/Replications)** The main log file used when troubleshooting _**Repository Action**_ type issues and failures is the **epoApSvr.log** file. The **Replication.log** file is the main log where specific ePO server replication information is logged. However, this file is only generated when all of the following are true: * Distributed Repositories are present * Replication task has been configured and ran (either successfully or not) Required Log Files Default Location Description How to read this log **epoApSvr.log** <_Install\_Dir_\>\\DB\\Logs Example: _**epoApSvr.log**_ This is the main log for the C++ code that is called from Java (console). Provides details for: * Repository Pull * Repository Replication * Software Catalog * Key Management * LDAP * AD Synchronization **Note**: When in doubt, always check this log. **TIP**: When reading the log, the **date/timestamp** along with the associated code and thread # are very important. You would use the date/timestamp and thread # to follow specific interactions for that threat. See _**Message Types**_ for message description details. **Replication.log** <_Install\_Dir_\>\\DB\\Logs Example: _**Replication.log**_ This is the main ePO server replication log file. This file is only generated when all of the following are true: * There are Distributed Repositories * A Replication task has been configured. * A Replication task has run. **TIP**: When reading this log, identify any errors and correct as requested. Task completions for Repository replications and other replication related details are logged here. **Orion.log** <_Install\_Dir_\>\\Server\\Logs Example: _**Orion.log**_ The main application server log: * TOMCAT * MF * Console * Browser * JAVA Four levels of Severity: _**Ex**_: \[2015-01-30 19:25:00, 230 ERROR…\] * ERROR * INFO * DEBUG * WARN **TIP1**: When reading the log, the date/timestamp along with the severity code and thread # are very important. This is so you can correlate / compare messages back and forth from the _**orion.log**_ and _**epoApSvr.log**_. Issue troubleshooting flow would be: 1. Review _orion.log_. 2. Gather info (date/time stamp, severity code, thread #) 3. Review _epoApSvr.log_ following the info gathered in Step 2. 4. Go back to _orion.log_ and continue reviewing. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ **TIP2**: Server Tasks will have “scheduler” as prefix – _**Ex**_: \[scheduler-TaskQueueEngine-thread-1\] \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ **TIP3**: Thread name is very important. All UI traffic starts with HTTP. _**Ex**_: \[http-bio-8444-exec-8\] ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#console-login-issues-failures) **Console Login Issues / Failures** The **Orion.log** file is the main log to review when initially troubleshooting _**ePO console login**_ issues and failures. Required Log Files Default Location Description How to read this log **Orion.log** <_Install\_Dir_\>\\Server\\Logs Example: _**Orion.log**_ The main application server log: * TOMCAT * MF * Console * Browser * JAVA Four levels of Severity: _**Ex**_: \[2015-01-30 19:25:00, 230 ERROR…\] * ERROR * INFO * DEBUG * WARN **TIP1**: When reading the log, the most recent information is logged at the bottom of the file. Issue troubleshooting flow would be: 1. Review _orion.log_. 2. Scroll to the bottom of the file. 3. Search for **Failed to login** entries. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#event-parser-issues-failures) **Event Parser Issues / Failures** The main log to use for troubleshooting issues and failures with the _**Event Parse**_r is aptly called **Eventparser.log**. This file logs successes as well as failures when attempting to process events, once those are sent from the agents to the ePO server. Once the handler has received the event, an entry for that event is logged into the Server.log file, which then writes these to the file system. Required Log Files Default Location Description How to read this log **Eventparser.log** <_Install\_Dir_\>\\DB\\Logs Example: _**Eventparser.log**_ Contains ePO event parser services details, such as product event parsing success or failure. Events are sent by the agent, then received in the Agent Handler by the Apache process, which makes a note in the Server.log, and writes them to the file system. The EventParser (a separate process in the Agent Handler) then picks up the events from the disk and writes them to the database. Displayed event entries contain: * Date * Message Type * Success/Failure * Message w/ action detail Event processing type messages will also display in Server.log as: “**Received \[Event\] from <**_**SystemName**_**\>**” **TIP**: Start from the top and search downward for **Succeeded** or **Failed**. _If_ _**Failed**_ _found, a failure message will be just below this location. Search the KB for this error._ Basic types of Events: <_**UpdateEvents**_\> - Product events <_**EPOEvent**_\> \- Threat events ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#sql-connection-issues-failures) **SQL Connection Issues / Failures** The log files used when troubleshooting _**SQL Connection**_ issues and failures are: * **Orion.log** * **epoAvSvr.log** * **Server.log** Required Log Files Default Location Description How to read this log **Orion.log** <_Install\_Dir_\>\\Server\\Logs Example: _**Orion.log**_ The main application server log: * TOMCAT * MF * Console * Browser * JAVA Four levels of Severity: _**Ex**_: \[2015-01-30 19:25:00, 230 ERROR…\] * ERROR * INFO * DEBUG * WARN **TIP1**: When reading the log, the date/timestamp along with the severity code and thread # are very important. This is so you can correlate / compare messages back and forth from the orion.log and epoApSvr.log. Issue troubleshooting flow would be: 1. Review _orion.log_. 2. Gather info (date/time stamp, severity code, thread #) 3. Review _epoApSvr.log_ following the info gathered in Step 2. 4. Go back to _orion.log_ and continue reviewing. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ **TIP2**: Server Tasks will have “scheduler” as prefix – _**Ex**_: \[scheduler-TaskQueueEngine-thread-1\] \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ **TIP3**: Thread name is very important. All UI traffic starts with HTTP. _**Ex**_: \[http-bio-8444-exec-8\] **epoApSvr.log** <_Install\_Dir_\>\\DB\\Logs Example: _**Server.log**_ This is the log for the C++ code that is called from Java (console). Provides details for: * Repository Pull * Repository Replication * Software Catalog * Key Management * LDAP * AD Synchronization **Note**: When in doubt, always check this log. **TIP**: When reading the log, the **date/timestamp** along with the associated code and thread # are very important. You would use the date/timestamp and thread # to follow specific interactions for that threat. See _**Message Types**_ for message description details. **Server.log** <_Install\_Dir_\>\\DB\\Logs Example: _**Server.log**_ Contains details related to and is the main log for the following: * Agent-server communications * Agent deployment * Agent Wake-Up * Policy Compilation * Tasks * Manifest request * Event receiving * ePO Server Agent Handler Provides the following: * **Date and Time** * **Message Type** – See Message Types for details * **Thread number** - Very important to 'pull out' all related messages to one ASCI (Agent to Server Communication)\\ * **Module** \- The module name can give a hint of what part of the code maybe having issues * **Message** \- X messages will contain the exact line number and .cpp file Review any errors related to initialization. ![In the example here, we see that both the Database and Policy Manager “initializations” were successful. If those had failed to initialize successfully, they would be logged accordingly.](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/~gitbook/image?url=https%3A%2F%2Ftraining.trellix.com%2Fcontent%2Felearningngx%2FLhiXYmoW7rSen-QGkLHgYQ%2F1694647973%2F0088YmZiUEJFNUlneVVCNnVIVG9rc3ZsOUtjbnk2Yk5iN1AvYUNTQWlxV0NxUVIvbzFnKzYwdnFDczFXSmY3TEk0Rw%3D%3DV2VkIFNlcCAxMyAxMTozMjo1MyBFRFQgMjAyMw%3D%3D%2Feot%2Fscormcontent%2Fassets%2Ffo7XN5qM9cdAzUM5_WIKZoQ3y9qBmenbL.jpg&width=768&dpr=4&quality=100&sign=580a7f3a&sv=2) In the example here, we see that both the Database and Policy Manager “initializations” were successful. If those had failed to initialize successfully, they would be logged accordingly. ### [](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-using-log-files#policy-updating-issues-failures) **Policy Updating Issues / Failures** The following table provides troubleshooting details on how to read basic policy updating issues and failures. Required Log Files Default Location Description How to read this log **<**_**AgentGUID**_**\>\_<**_**Timestamp**_**\>** **\_Server.xml** _\\DB\\_ _Debug_ Contains details about policy updating issues. To enable this file: 1. Click **Start**, **Run**, type **regedit** and click **OK**. 2. Navigate to: **HKLM\\Software\\Network Associates\\ePolicy Orchestrator\\** 3. Create the DWORD **SaveAgentPolicy** and set the Value to **1**. 4. Restart the **ePolicy Orchestrator 5.x.x Server** service. In the DB\\Debug folder, an XML file is created named _**\_manifest**_ for each client that retrieves a new policy. This is then used to determine what policy settings are being sent from the ePO server. **Note**: This setting should **NEVER** be left on as this will generate a file for each client communication where policies are sent down. [PreviousModule Intro](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/module-intro) [NextTroubleshooting Tools](https://sirogy.gitbook.io/trellix-epolicy-orchestrator-on-prem-5.1/troubleshootings-basics/troubleshooting-tools) Last updated 1 year ago ---