cancel
Showing results for 
Search instead for 
Did you mean: 
takie
Level 7
Report Inappropriate Content
Message 1 of 4

How to check HIP & VSE status on endpoint

Jump to solution

Is there a way to check in EPO if VSE and HIP of a certain endpoints are disabled?

1 Solution

Accepted Solutions

Re: How to check HIP & VSE status on endpoint

Jump to solution

From ePO it is hard to get VSE status as OAS status tab is not present in ePO queries but you can get it through DB by running SQL query.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

For VSE OAS should be running.

SELECT
   [EPOLeafNode].[NodeName] AS ServerName,
   CASE WHEN rsOASEnabled.value IS NOT NULL THEN rsOASEnabled.value ELSE 'Unknown' END AS OASEnabled
FROM
   [EPOLeafNode]
   INNER JOIN [EPOProductProperties] ON [EPOLeafNode].[AutoID] = [EPOProductProperties].[ParentID]
   LEFT JOIN [dbo].EPOProductSettings AS rsOASEnabled ON (EPOProductProperties.AutoID = rsOASEnabled.ParentID AND
                                                                                                                  rsOASEnabled.SectionName = N'On-Access General' AND
                                                                                                                  rsOASEnabled.SettingName = N'bEnabled')
WHERE
   EPOProductProperties.ProductCode LIKE 'VIRUSCAN%'

Examples:
LIKE ‘VIRUSCAN8800’ for VSE 8.8.
LIKE ‘VIRUSCAN8700’ for VSE 8.7.

NOTE: The 1 entry under the Enabled column means the OAS is enabled for that system.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

For HIPS you can get by ePO query by checking HIPS service as Enable/Blank/Unknown.

3 Replies

Re: How to check HIP & VSE status on endpoint

Jump to solution

With VirusScan you can create a report that shows the on-access scanner status (with the latest VSE extension) but I don't know if you can do the same with HIPS

andrep1
Level 14
Report Inappropriate Content
Message 3 of 4

Re: How to check HIP & VSE status on endpoint

Jump to solution

Same for hips, by component. It is already part of the ePO HIPS dashboard.

Re: How to check HIP & VSE status on endpoint

Jump to solution

From ePO it is hard to get VSE status as OAS status tab is not present in ePO queries but you can get it through DB by running SQL query.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

For VSE OAS should be running.

SELECT
   [EPOLeafNode].[NodeName] AS ServerName,
   CASE WHEN rsOASEnabled.value IS NOT NULL THEN rsOASEnabled.value ELSE 'Unknown' END AS OASEnabled
FROM
   [EPOLeafNode]
   INNER JOIN [EPOProductProperties] ON [EPOLeafNode].[AutoID] = [EPOProductProperties].[ParentID]
   LEFT JOIN [dbo].EPOProductSettings AS rsOASEnabled ON (EPOProductProperties.AutoID = rsOASEnabled.ParentID AND
                                                                                                                  rsOASEnabled.SectionName = N'On-Access General' AND
                                                                                                                  rsOASEnabled.SettingName = N'bEnabled')
WHERE
   EPOProductProperties.ProductCode LIKE 'VIRUSCAN%'

Examples:
LIKE ‘VIRUSCAN8800’ for VSE 8.8.
LIKE ‘VIRUSCAN8700’ for VSE 8.7.

NOTE: The 1 entry under the Enabled column means the OAS is enabled for that system.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

For HIPS you can get by ePO query by checking HIPS service as Enable/Blank/Unknown.