Unable to filter threat events using Analyzer rule ID in Query

[YvesK]

In the query module of MVision ePO, there is no possibility to filter on Analyzer Rule ID. The option is really missing and we do use this a lot.. e.g. for following-up newly generated ENSTP rules. In our migration from on-prem to MVision ePO, this is a real show stopper.

[Pravas]

Hi @YvesK ,

Thank you for your post. I checked it as well, Analyzer Rule ID is missing under Filters for Threat Events query.

I would suggest to log a ticket with McAfee technical support for deeper investigation. Perhaps the feature is missing.

Thanks

[YvesK]

Hi @Pravas 

The first action for me was logging a support ticket. They asked me to raise the question in this community.

[Pravas · Accepted solution]

Hi @YvesK ,

Thanks for the update. I believe you can raise a Product Enhancement Request by following the instructions in the link below.

How to submit product idea - https://kc.mcafee.com/corporate/index?page=content&id=KB60021

Mvision Ideas Page - https://community.mcafee.com/t5/MVISION-ePO-Ideas/idb-p/MVISION-ePO-Ideas/tab/most-recent

Hope it helps.