Query: Malware

[cheetah]

Hello everybody,
I am a bit helpless.
Is there really no query in the ePO for:

Malware detected and edited
Malware detected and NOT edited.

Can you help me with the creation of such a query.
Thanks in advance.

[cdinet · Accepted solution]

Not sure what you mean specifically by edited, but your options are "threat handled" set to either yes or no.  You can also include "action taken" as a column if desired.  You would go to new query, events, and either threat events or ens threat events if running ens, then choose your query type, add desired columns and then use threat handled in the filter.