McAfee ePO Integration Pack

The McAfee ePO Integration Pack enables Privilege Guard to integrate with McAfee ePolicy Orchestrator (ePO), widely acknowledged as the most advanced and scalable security management software in the industry.

The Privilege Guard Client logs events to the local application event log on each endpoint and these events are also sent to the McAfee Agent, which forwards them to McAfee ePO.

Enlarge screen shots

The Privilege Guard ePO Extension is responsible for adding the Privilege Guard events into the ePO database. It also includes a number of preconfigured dashboards that can be accessed from the ePO Console:

1. Executed Applications – reports on all applications that have been executed in the enterprise.
2. Elevated Applications – reports on all applications that have been executed with elevated rights in the enterprise, including a breakdown of those applications that were elevated automatically and those that were elevated “on-demand” through the shell extension.
3. Blocked Applications – reports on all blocked applications in the enterprise.
4. Monitoring – reports on the applications in the enterprise that require admin rights to run, when privilege monitoring is enabled.

Each dashboard provides information on the top 10 applications, a breakdown of applications by publisher and an activity timeline. You can drilldown on the graphs within each dashboard to view detailed application reports. You may also create your own custom dashboard and reports within ePO.

The Privilege Guard Client can optionally be deployed through ePO, by importing the Privilege Guard Client ePO Package into the ePO software repository. The Privilege Guard Client also exposes a number of properties to the McAfee Agent, which allows you to determine where the Privilege Guard Client has been installed, including its version number and installation directory.