cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Joining EPOEvents with HIP8 Signature names

Jump to solution

We pull logs from the EPO database via the EPOEventsMT table. One thing I noticed is that any Exploit Protection entry lists the same ThreatID every time (ID 18054) with nothing distinguishing which specific one it refers to. In the agent gui I can clearly see the specifics via Analyzer rule ID and name.

I did find the table that houses the simple list of HIP8 signatures via KB82313 (and then removing the CVE where criteria). This has the details I need.

What I am struggling with however is what I can use to join these two, so that I can query the EPOEventsMT table and join in the specific signature details for the individual entries. Is anyone aware of how I can accomplish this? Or is there another table that has the info I'm looking for?

Labels (1)
1 Solution

Accepted Solutions
vivs
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 5

Re: Joining EPOEvents with HIP8 Signature names

Jump to solution

Hello @User76548052 

Thanks for your response.

KB is retired because ePO 5.3.X is no more supported and it is end of life.

Thats the reason you are seeing the retired notification while opening the KB86265

Was my reply helpful?

If you find this post useful, please give it a KudosAlso, please don't forget to select "Accept as a Solution" if this reply resolves your query!

View solution in original post

4 Replies
vivs
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 5

Re: Joining EPOEvents with HIP8 Signature names

Jump to solution

Hello @User76548052 

Thanks for you post.

You can create a Query adding that events in ePO and after that go to that Query- Actions - View SQL and you will get all the information about tables from the data is coming.

Also you can try referring the database schema :

KB91051

https://kc.mcafee.com/corporate/index?page=content&id=KB54753&actp=null&showDraft=false&platinum_sta...

Was my reply helpful?

If you find this post useful, please give it a KudosAlso, please don't forget to select "Accept as a Solution" if this reply resolves your query!

Re: Joining EPOEvents with HIP8 Signature names

Jump to solution

Thanks. I don't see the ability to create a query, I think I'm lacking in rights on the server.

I tried to follow the documentation to get the schema document, but the the KB it cites (KB86265) says the document is retired and no longer available.

vivs
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 5

Re: Joining EPOEvents with HIP8 Signature names

Jump to solution

Hello @User76548052 

Thanks for your response.

KB is retired because ePO 5.3.X is no more supported and it is end of life.

Thats the reason you are seeing the retired notification while opening the KB86265

Was my reply helpful?

If you find this post useful, please give it a KudosAlso, please don't forget to select "Accept as a Solution" if this reply resolves your query!

View solution in original post

Re: Joining EPOEvents with HIP8 Signature names

Jump to solution

Thanks. I was able to get the schema now. Guess I'll need to reach out to support for the HIP8 schema next.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community