McAfee ePO SQUID syntax

[Former Member]

Hi,
I have 2 problems using the SQUID and would appriciate your help.

goal - join 2 tables based on a common field and filter the results based on an equal condition.

***http-call*** target="EPOEvents" select="(select EPOEvents.ThreatName EPOEvents.AutoID EPExtendedEvent.EventAutoID EPOEvents.AnalyzerHostName EPExtendedEvent.TargetHash )" where="(where (eq ( EPOEvents.AnalyzerHostName \"ADMIN-PC\")))" order="(order(asc EPOEvents.ThreatName))" joinTables="EPExtendedEvent"

error:
/remote/core.executeQuery?target=EPOEvents&select=(select%20EPOEvents.ThreatName%20EPOEvents.AutoID%20EPExtendedEvent.EventAutoID%20EPOEvents.AnalyzerHostName%0A%20EPExtendedEvent.TargetHash%20)&where=(where%20(eq%20(%20EPOEvents.AnalyzerHostName%20%22ADMIN-PC%22)))&order=(order(asc%20EPOEvents.ThreatName))&:output=json. Body: Error 0 : Invalid S-expression in 'where' clause: EPOEvents.AnalyzerHostName

thought the erorr is very precise, I cannot seem to solve the issue. can you help?

p.s: i've tried the equals clause from the docs and got a similar error:

***http-call*** target="OrionTaskLogTask" select="(select OrionTaskLogTask.UserName)" where="(where (eq ( OrionTaskLogTask.UserName ga)))" order="(order(asc OrionTaskLogTask.StartDate))"
error:
remote/core.executeQuery?select=(select%20OrionTaskLogTask.UserName)&where=(where%20(eq%20(%20OrionTaskLogTask.UserName%20ga)))&order=(order(asc%20OrionTaskLogTask.StartDate))&target=OrionTaskLogTask&:output=json. Body: Error 0 : Invalid S-expression in 'where' clause: OrionTaskLogTask.UserName

 
Thanks, Bar.

[cdinet]

Please look at PD24810, the epo web api scripting guide.  It has some examples for using a where condition and other examples.  

[Former Member]

Hi I was looking at the documentation and had some success with the 'where' caluse.
however, I haven't found documentation regarding left/right.outer/inner join over a field from different tables.
can you assist in giving 1 or 2 examples?

Thanks,

[cdinet]

That would have to come from someone else, I am not good with scripting.