ePO Reporting: Top 10 Threats

[User14289348]

Hi, I am trying to do the following comprehensive report, but I can't seem to get the data I want. Period: • Last three months Data: • Top 10 threats + actions taken against threats. • Top 10 infected PCs/Users + breakdown of threats and handling action Your help is greatly appreciated. BR, Radko

[Hawkmoon]

Hi User14289348 (Radko),

What you are trying to do is possible, if a little heavy on the data return from such a data pull/report.

What is it you 'cannot get' in your custom query?

In ePO if you have ENS or VSE there are a set of default queries that can be used to collect that data for you!

If you run through each of these in turn do they return what you seek (in there own specific focus) then if they do, I'd suggest you use each as a source for you 'larger' more involved creation to give what you seek.

[User14289348]

Hello Hawkmoon,

Thank you very much for your reply.

The data I am trying to access is from VirusScan Enterprise 8.8.

The issue is, I need to build a report based on several custom queries and cannot find a proper approach at all.

Basically I am asking for general advise, since I really see no good way to tackle this.

BR,

Radko

[cdinet]

Reports have the ability to combine several queries.  Have you tried a report vs query? 

[User14289348]

Hi cdinet,

That's exactly what I am doing, however, I can't seem to pick the proper queries to report the data I need.

If only there was a way to build the query using some query language, rather than just picking from a list...

BR,
Radko

[cdinet · Accepted solution]

Are you using pre-created queries?  If you go to new query, choose threat events, you should be able to come up with some of the things you are looking for.  If you create it as a chart type, you can set the top 10 in the chart config page where you choose what items are the parts of the graph, and you can limit them to display only top 10. 

[User14289348 · Accepted solution]

Hi,

After actually using my brain, I noticed the reports I wanted are already available as premade queries on the VSE Dashboard.

I only needed to duplicate the queries and alter them (to include Handling Action) and I was done.

Thank you for all your help, anyway.

BR,

Radko