cancel
Showing results for 
Search instead for 
Did you mean: 

Creating Alerts Off of a Query?

Is it possible to create an automated alert based off of query in ePO?

I have a query that utilizes the EEGo and EEPC products (both EEPC 5.x and 6.x since we have both in our environment at this time) to look for any machines that do not have either EEPC installed, or some other incompatible encryption products as defined by EEGo. I would like the ability to be alerted on this as the query increases or decreases, but I have not figured out a way to use the Automated Response portion of ePo to do this.

Short of manually checking the query every day, is there a more efficient way to do this?

For those interested, the query is as follows in SQL:

select top 360 count(*) as 'count', [EPOComputerProperties].[OSType], [EPOComputerProperties].[OSType] from [EPOLeafNode] left join [EPOComputerProperties] on [EPOLeafNode].[AutoID] = [EPOComputerProperties].[ParentID] left join [EPOProdPropsView_MCAFEE_EEPC] on [EPOLeafNode].[AutoID] = [EPOProdPropsView_MCAFEE_EEPC].[LeafNodeID] left join [EPOProductPropertyProducts] on [EPOLeafNode].[AutoID] = [EPOProductPropertyProducts].[ParentID] left join [EEGOProductDetection] on [EPOLeafNode].[AutoID] = [EEGOProductDetection].[LeafNodeID] where ( ( [EPOComputerProperties].[IsPortable] = 1 ) and ( [EPOProductPropertyProducts].[Products] not like N'%SBDE%' ) and ( not ( ( [EPOProdPropsView_MCAFEE_EEPC].[verProductMajor] >= 6 ) ) ) and ( [EEGOProductDetection].[Product] is null or ltrim( rtrim( [EEGOProductDetection].[Product] ) ) = '' ) ) group by [EPOComputerProperties].[OSType] order by 'count' desc, [EPOComputerProperties].[OSType] asc

4 Replies
Highlighted
Tristan
Level 15
Report Inappropriate Content
Message 2 of 5

Re: Creating Alerts Off of a Query?

I don't think it's possible from within ePO

1. To measure an increase or decrease you would need to compare the result against a stored result of a previous run of the query. I don't think there's any way of storing values within ePO.

2. From what i can tell the automated alerts are triggered from events not queries.

The only way i can think of doing would be to script it outside of ePO using the API and another piece of reporting software

Re: Creating Alerts Off of a Query?

Thanks, Tristan.

I had a feeling it would come to API scripting. Sadly this is expertise that we currently do not have in house.

Tristan
Level 15
Report Inappropriate Content
Message 4 of 5

Re: Creating Alerts Off of a Query?

Not quite the full solution your looking for but you could schedule ePO to run the query  and email you the results as a PDF, csv, graph or pie chart.

It would remove the need to log into ePO every day and you could track and compare previous results within your mailbox.

Re: Creating Alerts Off of a Query?

That is the same conclusion I came to, as well. Luckily the query only produces a low number of results, so monitoring it from day -to-day should not be too overwhelming. Thanks for the help!

More McAfee Tools to Help You

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community