Euh it's the reverse ^^
Push Mode maintains a permanent connection between the SEPM and the clients.
Pull Mode Client will communicate to specified interval ;-)
At least you're right, we recommend to set the communication to Pull Mode and to raise the Heart Beat Interval depending the quantity of managed clients you have.
Push mode is not recommended when you already reach more than 100 clients and it uses network bandwith to maintain a permanent connection between your SEPM server and your SEP Managed clients when finally it's not necessary required as there 3 distributions of definition on daily basis.
1 during the morning
1 during afternoon
1 after the beginning or middle or evening.
So Push mode is not the best setting cause at least the SEPM will not have new definitions every 5 or 30 minutes for his clients. He will have new definitions every 4~8 hours.
But of course you don't need to raise the heart beat interval that high or your clients will always have more or less major delay between the definitions available on the SEPM and their own definitions.
Depending if most of your machines are online during the same period time, you could set the heart beat interval to optimized values.
Example:
If you have between 1 to 99 clients => 5-10 minutes are fine.
100 to 499 => 20-30 minutes are fine.
500 to 1000 => 40-50 minutes are fine.
Over 1000 clients => 1 hour to 2 hours are fine.
Kind Regards,
A. Wesker