TR-C key terms

Central management component that stores policy, agent handler settings, and event data in a database, and distributes configuration to managed endpoints through registered agents.

Optional ePO component placed on a separate server to distribute agent traffic and database load; agents can be assigned to a handler so remote sites do not route through the main server.

Signal sent from the ePO server to a managed endpoint that prompts the agent to check in immediately rather than waiting for its scheduled interval.

Hierarchical container structure in ePO that organizes managed systems into groups and subgroups so that policies can be applied at the right scope.

Behavior in which a child group or system receives policy settings from a parent group unless a lower level breaks inheritance or defines an override.

Act of attaching a policy object to a system tree node or group so that the settings are enforced on the agents beneath that point.

Label applied to systems automatically by criteria or manually by an administrator, used to scope policy assignment and reporting to a subset of endpoints.

Saved database search in ePO that returns server or agent event data, such as detected threats or compliance status, and can feed dashboards and scheduled reports.

Configurable ePO view that displays monitors built from queries, giving operators a live summary of threat, compliance, and product health status.

Recorded occurrence sent by an agent or product to the ePO server, such as a detection, policy enforcement action, or client task result, stored for query and reporting.

Server-defined action assigned to agents, such as an on-demand scan, product deployment, or update task, which runs on a schedule or on demand.

Source location from which agents and products pull signature files, engines, and product packages; it can be the ePO server, a distributed repository, or an external source.

Feature that lets the ePO server pull content into its master repository on a schedule so agents can retrieve current signatures without direct internet access.

Signed bundle of detection signatures, engines, or product updates distributed through the repository hierarchy and applied by agents on managed systems.

Real-time scanning that inspects files when they are read, written, or executed, blocking or cleaning threats before the operation completes.

Scan started manually or by a client task that walks specified file system areas looking for malware without waiting for file access events.

Configured rule that removes specified files, folders, processes, or file types from scanning to prevent performance problems or false positives on trusted software.

Detection in which legitimate software is flagged as malicious; handling it requires verification, exclusion or restore, and often a signature correction from the vendor.

Isolated storage location where detected malicious files are held so they cannot execute while administrators review, restore, or delete them.

Action that removes malicious code from an infected file and restores the file to a usable state, as opposed to deleting or quarantining it.

Rule set that blocks unauthorized modification of protected files, registry keys, and processes, helping prevent malware from disabling security software or persisting.

Behavior-based protection that blocks techniques commonly used by exploits, such as process injection or return-oriented programming, regardless of whether a signature exists.

Detection method that observes runtime actions of processes and flags suspicious sequences, catching unknown or modified threats that signature matching would miss.

Record generated when a detection or enforcement action occurs on an endpoint, carrying details such as threat name, action taken, and affected file or process.

ePO permission model that grants users only the actions and scopes tied to their assigned role, separating help desk, analyst, and administrator duties.

Collection of granted rights in ePO that defines which product features and system tree areas a user account or group may act upon.

Record of administrative and user actions in the management console, used to trace configuration changes and support compliance investigations.

Scheduled job that runs on the ePO server itself, such as repository pulls, database purges, or report generation, independent of endpoint agents.

Scheduled removal of old events and audit records from the ePO database to control size and keep server performance within supported limits.

Setting that controls how often a managed agent contacts its assigned handler or server to send events and collect policy and task updates.

Agent behavior of contacting an alternate handler or the main server when its primary handler is unreachable, preserving management continuity.

Practice of backing up the database and server configuration and restoring them to a rebuilt host so management, policy, and event history survive a failure.

Use of queries and scheduled reports to demonstrate that endpoints meet required protection settings, patch levels, and policy states for auditors or regulators.

Rules defining how long event, audit, and threat data are kept before purge, balancing investigation needs against storage cost and privacy obligations.

Client task that installs, upgrades, or removes a managed product on endpoints, often delivered with a wake-up call to start installation promptly.

Diagnostic process of verifying network reachability, certificate trust, handler assignment, and agent service state when a system stops reporting to the server.