Differences ePO / Mvision ePO

[Cdxit]

Hello,

I'm looking for a table or something like that gathering the differences between what we can find in ePO and not in Mvision ePO. I know some product are still not compatible, or not fully.. I know some points like no more DXL/TIE, no more Software Catalog... But difficult to have a full list or even a summary of all these differences...

Hope someone can help me on this !

Regards

[cdinet]

I can't find any feature comparison, though there might be one somewhere.  This has some info: https://kc.mcafee.com/corporate/index?page=content&id=KB90875

I know queries are limited in scope and no software catalog due to being managed by us.

Run client task now is not an option, you would need to schedule a task

wakeups go through dxl, so if dxl is not functioning on the client, it will fail

unable to push agent - most of that is because this is an external site to your clients and your clients would be most likely not routable from internet to the systems.  New deployments are only via smartinstaller, you can't even download the framepkg 

ad sync is done through a ad connector instead of normal sync.  mvision should not have access to your domain controller directly, which is why an ad connector is used.

unable to register a syslog server - all event forwarding is done through api.

This might also help answer some questions.

https://docs.trellix.com/bundle/mvision-epolicy-orchestrator-product-guide/page/GUID-8A57D132-E129-4...

[Cdxit]

Hello,

Thanks for this information.

Isn't there any way to use another installation method than smartinstaller ? That means I cannot install on a machine not connected on internet during the setup, correct ? 

For the syslog, that mean an API connector must exist to extract data to a SIEM. I heard about a script to do that as well.

Rgds

[cdinet · Accepted solution]

I know of no other way to install an agent from mvision.  The fact that being on mvision itself would require it to have internet access since mvision epo is a cloud based solution.  If the agent is on a golden image that you use to image your systems from, that would also work as long as proper procedures are done to prep the image machine.  

https://docs.trellix.com/bundle/agent-5.7.x-installation-guide/page/GUID-2DAB9AFD-A38A-49BF-8268-B6B...

and this kb for using the agent on an image

https://kc.mcafee.com/corporate/index?page=content&id=KB84356

For syslog, it is all via api only.  I am not aware of any api connector, though there may be something. There are basic events through the api url given in the product guide I gave you, but there is also advanced api options that are purchased separately that can have more functionality - see https://kc.mcafee.com/corporate/index?page=content&id=KB93639

[Cdxit]

Thanks for your help on this point.

Regards