You can create a custom query in ePO based on AMCORE Content version. There are a lot of options in the query section so it's up to you which type of query you want to set up and what you want to filter on.
I tried the custom query as below, however, I have two concerns
a) AMCore Content version value is 'blank' for Linux clients (Screen shot A)
b) Below query provides list of clients with latest "AMCore Content version" (which is part of "Threat prevention"). Is there a similar way to get list of clients with latest "McAfee agent version" (Screen shot B)
For the Linux machines, you'd need to look at DAT version as they use the V2 Content files (DAT) instead of the V3 Content files (AMCORE).
If you want to query for McAfee Agent version, you'll want to query for "product version" and select the one which is in the category McAfee Agent, see screenshot:
I need to use either of the two options ( 1 and 2 from above) to get the list of clients which received latest update. Please advise. Thanks.
There is no definition for "latest", this is something you'd have to define yourself. For example you'd need to set a filter for version = 5.6.1 ....
In regards to the AMCORE/ DAT - you have selected AMCORE date and DAT version. Version won't give you the option of within the last day, only a date field will do this.
Thank you for the update.
However, before we migrated to “McAfee End point protection”, we were on “McAfee Virus scan enterprise”. As you can see from the screen shot, by selecting the filter “Is within x versions of repository - 0”, we got the list of Linux machines that got the latest update for that day. This is not a date filter, but still pulled the desired results.
If we have to automate the report on a daily basis, its not possible to provide version value every time. Is there a way, to pull the list of linux machines that have received the updates for that day? Thanks