ENS 10.7 July Update ODS

[vnaidu]

Dear All,

We have scheduled a monthly on demand scan for all the work stations and servers, however we are unable to get the accurate number of machines where the scan is successfully completed. Our requirement is to get the accurate number of machines which completed the ODS successfully.

The event IDS 1202 nd 1203 are not giving the accurate numbers, and also the KB69428 is not much help.

Kindly help us to meet our requirement. We would like to receive a report with accurate number of machines that completed the scan.

TIA

[ryadav1]

Hello @vnaidu ,

Let us make sure that below things are in place and then we can create a query from ePO .

> Check in the ePO whether event filtering 1202/1203 was already checked. [Menu>Configuration>Server Settings.]

> Check the ENS common policy and ensure that Event Logging  [Under Client Logging section] for ODS is set to "ALL".

Configure a report for ENS 1203 events:

1. Click Menu, Queries & Reports.
2. Click New Query.
3. Under Feature Group click Events.
4. Click Threat Events and click Next.
5. Click Table in the Display Results As table and click Next.
6. Remove both selected columns by clicking the X in the top right of the boxes.
7. Add the following Available Columns:
   • System Name
   • Event Generated Time
8. Click Next.
9. Add the following Available Properties: Event ID Equals 1203
   Product Version (Endpoint Security Threat Prevention) Greater than or equals 10
   On-Demand Full Scan Date Is within the last 1 Weeks (or select On-Demand Quick Scan Date if desired)
10. Click Save.
11. For Query Name type a name such as ENSTP On-Demand Full/Quick Scan Completed.
12. Add the query to any Query Group and click Save.

Hope this helps .

Thank you ,

Rajesh

McAfee Support 

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

[vnaidu]

Dear @ryadav1 ,

We already tried this way, but the results are not accurate and hence I thought of posting it here. Do we have any alternate way of achieving this task?

May be script or a commandline, that could help us track the ODS completion?

TIA

[AdithyanT · Accepted solution]

Hi @vnaidu,

edit: corrected typos.

To improve accuracy (1203 event can be generated by a right click scan or an unscheduled On demand scan performed on the machines), you can add your task name as one of the filters! This, should improve the accuracy of your report!

[Former Member]

Oh, that is nice!