How to get notified when Protection Workspace assign the tag "Escalated"

[Yannick_Hache]

Hello,

      The title says it all, i want to get notified when a system gets assigned the tag "Escalated" from the Protection Workspace. I've been trying to find a way but couldnt.

I can't see a "tag" filter in the automatic response.

If i make a report, it will send me an empty file every X min.

Is there a way to do what i'm trying to achieve ?

Thanks!

[cdinet]

When it sends you an empty report, are there actual systems that do have the tag applied?  How specifically is your report or query set up?

[Yannick_Hache]

So, the thing is, my report works fine if there is actual system with the tag. but i would like the report to be generate/sent "only" if there is ...  As if i do a check on the server every 10 min, i don't want 6 reports/h if none of the system we manage have the tag.

[cdinet]

That would be a new feature, as that is not possible.  There is no way to evaluate if a query returns empty results or not.  The task just runs the query and sends the results, whether it is null or not.

KB60021 tells how to submit an idea for feature requests.

[Yannick_Hache]

And what about when the server decides to apply the tag "escalated" on its own; can we attach an action to that task like advise the admin?

[cdinet · Accepted solution]

That function currently does not exist, so you would need to submit an idea for that functionality.  It sounds like a great idea.

[Yannick_Hache]

I just did : https://community.mcafee.com/t5/Business-Ideas/Protection-Workspace-notification-for-escalated-devic...

Thank you

[tao]

I've used the following method before - tagging a system w/infection triggered by eventID, moving that system to a quarantine folder and sending E-mail alert. All driven by auto response and server tasks.

[cdinet]

That may work for detections, but protection workspace can tag it escalated if out of compliance with dat versions, etc., so there isn't an event for that necessarily. 

[tao]

Well, build a query based off the tag (protection workspace can tag it) excluding the move location, create task to move it, disable sort & E-mail.