Geenrating report in EPO on hash value of Virus

[haaris]

Can we generate a report in MCAfee epo for the virus detected by VSE by its hash value..For eg there is a virus RDN/Generic BackDoor having its hash value 9A5FA5C5F3915B2297A1C379BE9979F0 ..I am able to generate the report by the Threat Name but not by its HASH value..

Can anyone plz suggest.....

RDN/Generic   BackDoor

[haaris]

Can anyone tell me if they have any idea??

[Former Member]

Hi, you can find MD5, it is in a section on it's own... set filter on this value.

Thanks

[haaris]

Thanks for your answer....

I can see MD5 option..What about SHA-1 & SHA-256.There is no option for that..So If I had Hash of these types then how will I generate report..

[cdinet]

Those are not available, so you would not be able to report on those hashes.

[haaris]

Thanks for the confirmation... But it should be available

[cdinet]

That would only be available if VirusScan or ENS has the ability to report on sha hashes vs md5, so that is a point product issue.  I am checking to see if McAfee Active Response reports on that or not, I will let you know.

[cdinet]

MAR won't help either, because it doesn't report on detected items, only potential threats.  So, you would need to submit that capability under the ideas forum.  Please refer to kb60021.

[haaris]

Thanks for your effort..

I checked on the McAfee idea forum there is already an idea raised for the same with the name

Add SHA-256 to event queries

'