Do you have siem collector extension checked in? You might want to ask siem team.
Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?
I am pretty sure I checked in an extension but that was from an older version of SIEM. The newer version did not come with a new Extension.
Maybe there was a newer Extension that I missed, i will check again (can only do so next week unfortunately).
It would be nice to know though if the properties can be used in general though.
I don't know if the issue would be resolved faster through the SIEM team. It would be nice to have a support engineer that knows both SIEM and ePO for this case.
I have the extension checked in for SIEM Collector with the version 11.00.4271.1625.
I cannot see the properties for any SIEM related data to use in filters or queries.
lets move this to the SIEM group, they will know if the collector uploads this property to the ePO server
You can create a filter that says "Installed Products" Contain 'SIEM Collector' & then get a list of all SIEM Collector versions installed on all of the endpoints.
We may also need to check whether we can add a filter that filters the version of the SIEM Collector.
Regards,
Prashanth B Pillai
McAfee Technical Support
Customer Success Group
I have such a filter in place already to check which system have SIEM collector installed but the problem lies in updating the SIEM collector. With hundreds of systems using the SIEM collector it is considerable effort to go through each one and check the version on the system page for each.
It is not possible for me to see the installed SIEM collector version at a glance from the table view in the query.
A filter to check the versions would be nice.
You may need to create a Tag or a group for endpoints with SC versions les than a particulaar version.
Then you can do a mass upgrade.
Please check the below URL:
Also, this can be possible via scripts. You may need to contact the McAfee Professional Services team.
Regards,
Prashanth B Pillai
McAfee Technical Support
Customer Success Group
Corporate Headquarters
6220 America Center Drive
San Jose, CA 95002 USA