ePolicy Orchestrator settings

You can add an ePolicy Orchestrator device to the ESM, with its applications listed as children on the system navigation tree. Once authenticated, you can access functions from the ESM, and assign ePolicy Orchestrator tags to source or destination IP addresses directly and to events generated by alarms.

You must associate the ePolicy Orchestrator with a Receiver because the events are pulled from the Receiver, not ePolicy Orchestrator.

Note: You must have read permissions on the master database and ePolicy Orchestrator database to use ePolicy Orchestrator.

If the McAfee ePO device has a McAfee® Threat Intelligence Exchange (TIE) server, it is added automatically when you add the McAfee ePO device to the ESM (see Threat Intelligence Exchange integration).