cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
SteelRat
Level 9
Report Inappropriate Content
Message 1 of 6

Removing tag after scan

Jump to solution

hi, all

 

I need to have a full scan task triggered by tag in the ePO (that's the easy part).

the question is how to remove the tag after scan completed before it will enter to the scan loop?

so far I see these options:

- tag clearing task once in 1-2-3 hours (cons: it can run in a minute when tag applied but scan not yet started, as a result - scan will not start).

- applying 2 tags (like tag1 and tag2) and having 2 clearing tasks running with 1-2 hours shift (if 2 tags applied - remove tag 2 only, if only 1 tag applied - remove it). this will give me at least 1-2 hours tome frame for task start, but also far from being perfect solution.

 

is there anything else I can do?

 

thank you in advance 🙂

 

 

 

1 Solution

Accepted Solutions
aguevara
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 6

Re: Removing tag after scan

Jump to solution

You can try to first create a report of machines having event ID 1203 (on-demand scan completed) and then create a server task to run that Query/report and as a subtask to apply a new tag.

To create that report please see:

https://kc.mcafee.com/corporate/index?page=content&id=KB69428

I haven't tried this myself but you could test and see if it works 🙂 

Regards

Alejandro

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

View solution in original post

5 Replies
aguevara
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 6

Re: Removing tag after scan

Jump to solution

You can try to first create a report of machines having event ID 1203 (on-demand scan completed) and then create a server task to run that Query/report and as a subtask to apply a new tag.

To create that report please see:

https://kc.mcafee.com/corporate/index?page=content&id=KB69428

I haven't tried this myself but you could test and see if it works 🙂 

Regards

Alejandro

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

SteelRat
Level 9
Report Inappropriate Content
Message 3 of 6

Re: Removing tag after scan

Jump to solution

thanks, nice idea 🙂

 

I'm configuring it now, will update about results

SteelRat
Level 9
Report Inappropriate Content
Message 4 of 6

Re: Removing tag after scan

Jump to solution

at the end it doesn't work, the tag not removed 😞

 

any other suggestions?

cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 5 of 6

Re: Removing tag after scan

Jump to solution

How exactly was your query created - table, chart, etc?  What fields?  You should have minimum system name and it would have to be a table format  Otherwise, detail the steps you did and if you run the query separately, does it return any results?

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

SteelRat
Level 9
Report Inappropriate Content
Message 6 of 6

Re: Removing tag after scan

Jump to solution

at the end this solution works 🙂

 

my mistake was to use "client event query" instead "threat event query" as "scan complete" belongs to "threat events.

 

thank you very much 🙂

 

working solution is: threat events query filtered by "1203 threat event ID in past hour" and having the manual start tag running every hour via server task and clearing manual start tag as a subtask.

 

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community