EPO, Search hash file of an infected host

[Former Member]

Goodmorning, 

is it possible to search into EPO, via api or direct db query,  what is the hash file of an infected ip/hostname ? 

thanks

regards

[Former Member]

Or to be more specific, is it able to get the ATD Event Log Information.

(details in the image)

[cdinet]

In epo, go to new query, events, and you will see an option for adaptive threat events.  Choose that, then when you get to the columns selection tab, you can choose hashes there - there are md5, sha1 and certificate hash options. 

[Former Member]

There is no such option as adaptive threat events (options available: Aggregated Exploit Prevention Events, Client Events, Endpoint Security Threat Events, Threat Events, Web Control Events)

But the thing that we need as info (if possible) is how to do it through the API:

URL: https://servername:port/remote/core.executeQuery?target=EPOEvents&select=(select
EPOEvents.AnalyzerHostName EPOEvents.HASH5)

OR

Python: mc.core.executeQuery(target="EPOEvents", select="(select EPOEvents.AnalyzerHostName
EPOEvents.HASH5)");

(I know that HASH5 column doesn't exist in the EPOEvents table, it was just an example)

Thanks in advance

[cdinet]

If you don't see that option, then it would seem you are missing an extension.  This is what I have.

[Former Member]

We do have the ATD extension up and running:

But the ATP is not in the options:

Thanks in advance.

[cdinet]

Under endpoint security extensions, do you have Endpoint Security Adaptive Threat Protection?  In the meantime, I will test to see what exact extension adds that to the queries.

[cdinet]

 Endpoint Security Adaptive Threat Protection extension adds that to the queries.

[Former Member]

First of all, thank you so much for your support, very helpful.

I will just kindly ask you, if you can let me know which package do we need, for the query:

McAfee Endpoint Security (bundle)
Adaptive Threat Protection - full install (package)
Endpoint Security Adaptive Threat Protection 10.6.1 February Update (package)
Adaptive Threat Protection (extension)
Endpoint Security Adaptive Threat Protection 10.6.1 February Update Extension (extension)
Endpoint Security Adaptive Threat Protection Extension 10.6.1 Update (extension)

Thanks again for the quick and helpful replies

[cdinet]

If you are running the Feb update version of ens, then that is the extension to add:

Endpoint Security Adaptive Threat Protection 10.6.1 February Update Extension (extension)

Otherwise, click on the bundle in software manager and check what is in the packages.  If you are missing any extensions, you can check those in.

To clarify difference between packages and extensions, the packages go into master repository and are the installers to be pushed to the clients.  They do not add any functionality in epo.

The extensions add the backend management capabilities for a point product to be managed via epo.  They add queries, tasks, policies and other back end supportability info for that product.