cancel
Showing results for 
Search instead for 
Did you mean: 

Epo ENS ODS Reports

Jump to solution

I have created the query report for on demand scan, which when generated shows the Action taken 'Delete' and 'Deleted'.

I would like to understand basic difference between this.

Does 'Delete' means, we have to take action manually ?

And 'Deleted' means, action has been taken automatically?

 

Will Appretiate your reply !!

2 Solutions

Accepted Solutions
Highlighted
McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 5 of 7

Re: Epo ENS ODS Reports

Jump to solution

@Sachin3 I believe that the difference simply comes down to the fact that VSE and ENS were created by different software engineers, and the coded response for VSE and ENS is different based on what was typed as the output field. 
ENS, by using "Delete" instead of "deleted" follows the OS form of the action, i.e. Read, Write, Delete, Execute. It's never referred to a past tense action, despite those actions having the potential to have been in the past.

In short, in terms of the reaction the software is taking, the meaning between "deleted" and "delete" is the same--It was able to take an action to remove the threat at the target file path.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 7 of 7

Re: Epo ENS ODS Reports

Jump to solution

@Sachin3 It is possible as well that the input for the output from the code perspective could have differed based on what the detection source/type is. I would need the full threat event information to confirm how they differ to give you a more detailed hypothesis. 

Either way, you can be assured that both forms mean the files were actioned.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

6 Replies
McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 2 of 7

Re: Epo ENS ODS Reports

Jump to solution

Hi @Sachin3

It's the same action. However in my ePO I see "deleted" for events created by VSE, all events created by ENS are "delete". Do you see a difference within events created by ENS?

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

Re: Epo ENS ODS Reports

Jump to solution

Hi @ chealey Thanks for the reply !!

This what i'm getting in the report.

Please find an pic shared.

Capture_ens.PNG

 

McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 4 of 7

Re: Epo ENS ODS Reports

Jump to solution

Certainly interesting... The product guide states the folllowing actions:

Access Denied - Allowed - Blocked - Cleaned - Contained - Continue Scanning - Deleted - Moved - Would Block - Would Clean - Would Contain

Maybe it's a typo? I'll see what I can find out internally! To answer you're question though, I'm fairly confident in saying they are the same action though.

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
Highlighted
McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 5 of 7

Re: Epo ENS ODS Reports

Jump to solution

@Sachin3 I believe that the difference simply comes down to the fact that VSE and ENS were created by different software engineers, and the coded response for VSE and ENS is different based on what was typed as the output field. 
ENS, by using "Delete" instead of "deleted" follows the OS form of the action, i.e. Read, Write, Delete, Execute. It's never referred to a past tense action, despite those actions having the potential to have been in the past.

In short, in terms of the reaction the software is taking, the meaning between "deleted" and "delete" is the same--It was able to take an action to remove the threat at the target file path.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

Re: Epo ENS ODS Reports

Jump to solution

Hi @jess_arman

Thanks for the reply

I am understood the fact that coded response for VSE and ENS are different. also the meaning between "deleted" and "delete" is the same.

But i would like to mention one thing, we have only ENS in our environment and not VSE.

 still the reports are showing 'Deleted' action. How to justify this thing !!

Capture_ens.PNG

McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 7 of 7

Re: Epo ENS ODS Reports

Jump to solution

@Sachin3 It is possible as well that the input for the output from the code perspective could have differed based on what the detection source/type is. I would need the full threat event information to confirm how they differ to give you a more detailed hypothesis. 

Either way, you can be assured that both forms mean the files were actioned.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator