cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

"Client Events" Query in Server tasks to apply/remove TAG

Jump to solution

Hello,

I want remove and add specific tag on a System x days after an product installation.

I have creat an Query type "Client Events" in charts type "List - Table". When I run it, I have 3 hostname results.

But in Server Task, tags aren't apply/removed.

 

Do you have tips to do this ?

1 Solution

Accepted Solutions
cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 13 of 14

Re: "Client Events" Query in Server tasks to apply/remove TAG

Jump to solution

I tested this on my test system and it applied the tag properly.  So I would suggest opening a ticket with McAfee so we can look at logs and see what is going on with it.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

View solution in original post

13 Replies
cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 14

Re: "Client Events" Query in Server tasks to apply/remove TAG

Jump to solution

What do you have for the sub actions to take once you run the query in server task?  

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: "Client Events" Query in Server tasks to apply/remove TAG

Jump to solution

Hello Cdinet,

 

In Server Task :

- Action : Run Query

- Query : "My Client envents query"

- Language : English

- Subactions : Apply Tag

- Tag : "MyTag"


Query is type "Client Events" in charts type "List - Table". Return 2 column : GUID - Hostname

When I run it, I have 3 hostname results.

 

But in Server Task Log i have : 

Started: Run Query
Completed: Run Query (The query 'MyQuery' was run as a scheduled command or part of a scheduled command chain.)
Started: Apply Tag
Completed: Apply Tag (Applied tag 'MyTag' to 0.)

cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 14

Re: "Client Events" Query in Server tasks to apply/remove TAG

Jump to solution

Do the systems already have the tag?  Is the field for the host name "system name" from systems section?  Try putting that first if the systems don't already have the tag.  If they already have it, the task will not re-apply it as it already exists.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: "Client Events" Query in Server tasks to apply/remove TAG

Jump to solution

Befor test I clean all tag. Device hasn't tag i want.

 

I think this error is due to method use by server task to identify target device.
In a System Query, when we check SQL query. An additional select is add : [EPOLeafNode].[AutoID]
In a Client Event Query, when we check SQL query. And additional selecti is add : [EPOProductEvents].[AutoID]

I think, server task use [EPOLeafNode].[AutoID] to apply action on device.

 

But if we want apply action on devices with specify Client Event. How do we do ?

rgc
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 6 of 14

Re: "Client Events" Query in Server tasks to apply/remove TAG

Jump to solution

Open the custom query from queries and reports and edit the query by selecting the RESULT type as: TABLE and save it and go back to server task and see the sub actions will have plenty as you expected.

These sub actions more will be listed only when it is table format query


Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!


Raghavendra GC - [RGC]

Re: "Client Events" Query in Server tasks to apply/remove TAG

Jump to solution

Hello rgc,

Already done and explain in y poste of yesterday :
Query is type "Client Events" in charts type "List - Table". Return 2 column : GUID - Hostname

aguevara
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 8 of 14

Re: "Client Events" Query in Server tasks to apply/remove TAG

Jump to solution

at the time of execution we should see the Server task log and the orion log and see why it cant apply the tag.

The orion log will contain a lot of information but you can try searching with the server task name or the tag name 

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

 

cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 9 of 14

Re: "Client Events" Query in Server tasks to apply/remove TAG

Jump to solution

What exact hostname field are you using?  There are several options - detecting product host name, threat source host name and system name.  I tested with agent guid and detecting product host name and it applied a tag I assigned to the task.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: "Client Events" Query in Server tasks to apply/remove TAG

Jump to solution
 

Hello,

All my configuration :

2021-09-09_12-19-43.png2021-09-09_12-19-56.png2021-09-09_12-20-35.png2021-09-09_12-20-57.png2021-09-09_12-21-39.png

My theory on this issue.
Server Task use EPOLeafNode.AutoID to found devoice where tag should bee apply.
But ePO  query creator remote only EPOProductEvents.AutoID in SQL query.

Resume.... We can't use Client Events Query in server Task.... but is allow by epo with-out any warning.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community