Product guide

2
From the ePolicy Orchestrator console, click Menu | Systems | System Tree.
3
Select the system from the list, then select Actions | Agent | Wake Up Agents.
Client events are sent to ePolicy Orchestrator.
4
View the Threat Event Log: click Menu | Reporting | Threat Event Log.
A new event is present, which indicates that malware was detected on the client.
See also
View the Threat Event Log on page 58
How quarantine works
McAfee MOVE AV (Agentless) implements a remote quarantine system, where quarantined files are
stored on an administrator-specified network share.
In McAfee MOVE AV (Agentless) 2.6, the option for enabling Quarantine configuration and Quarantine network
share were present under the Scan policy, however, the latter has now been moved to the SVA policy. This
allows you to enable or disable quarantine for specific virtual machines. For details about assigning the
Scan policy to specific virtual machines, see How VM-based scan configuration works.
The quarantine network share is mounted on the SVA during policy enforcement at /mnt/quarantine
using the Common Internet File System (CIFS) protocol. If mounting fails, the Quarantine Mount Failed
event is generated and mounting is attempted at the next policy enforcement.
A file is quarantined when:
• The Quarantine configuration option, which is present under Scan policy, is enabled.
• The Quarantine network share configuration, which is present under the SVA policy, is mounted.
• A detection occurs.
• Delete files automatically is the primary action.
Quarantined files are automatically deleted after 28 days.
3
Monitoring and managing your environment
How quarantine works
50
McAfee MOVE AntiVirus (Agentless) 3.6.0 Product Guide