cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

How to get notified when Protection Workspace assign the tag "Escalated"

Jump to solution

Hello,

      The title says it all, i want to get notified when a system gets assigned the tag "Escalated" from the Protection Workspace. I've been trying to find a way but couldnt.

I can't see a "tag" filter in the automatic response.

If i make a report, it will send me an empty file every X min.

Is there a way to do what i'm trying to achieve ?

Thanks!

1 Solution

Accepted Solutions
McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 6 of 10

Re: How to get notified when Protection Workspace assign the tag "Escalated"

Jump to solution

That function currently does not exist, so you would need to submit an idea for that functionality.  It sounds like a great idea.

 

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

9 Replies
McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 2 of 10

Re: How to get notified when Protection Workspace assign the tag "Escalated"

Jump to solution

When it sends you an empty report, are there actual systems that do have the tag applied?  How specifically is your report or query set up?

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: How to get notified when Protection Workspace assign the tag "Escalated"

Jump to solution

So, the thing is, my report works fine if there is actual system with the tag. but i would like the report to be generate/sent "only" if there is ...  As if i do a check on the server every 10 min, i don't want 6 reports/h if none of the system we manage have the tag.

McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 4 of 10

Re: How to get notified when Protection Workspace assign the tag "Escalated"

Jump to solution

That would be a new feature, as that is not possible.  There is no way to evaluate if a query returns empty results or not.  The task just runs the query and sends the results, whether it is null or not.

KB60021 tells how to submit an idea for feature requests.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: How to get notified when Protection Workspace assign the tag "Escalated"

Jump to solution

And what about when the server decides to apply the tag "escalated" on its own; can we attach an action to that task like advise the admin?

McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 6 of 10

Re: How to get notified when Protection Workspace assign the tag "Escalated"

Jump to solution

That function currently does not exist, so you would need to submit an idea for that functionality.  It sounds like a great idea.

 

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: How to get notified when Protection Workspace assign the tag "Escalated"

Jump to solution
Reliable Contributor tao
Reliable Contributor
Report Inappropriate Content
Message 8 of 10

Re: How to get notified when Protection Workspace assign the tag "Escalated"

Jump to solution

I've used the following method before - tagging a system w/infection triggered by eventID, moving that system to a quarantine folder and sending E-mail alert. All driven by auto response and server tasks.

If this information was helpful or has answered your question, please select Accept as Solution. This will assist other memebers
McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 9 of 10

Re: How to get notified when Protection Workspace assign the tag "Escalated"

Jump to solution

That may work for detections, but protection workspace can tag it escalated if out of compliance with dat versions, etc., so there isn't an event for that necessarily. 

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Reliable Contributor tao
Reliable Contributor
Report Inappropriate Content
Message 10 of 10

Re: How to get notified when Protection Workspace assign the tag "Escalated"

Jump to solution

Well, build a query based off the tag (protection workspace can tag it) excluding the move location, create task to move it, disable sort & E-mail. 

If this information was helpful or has answered your question, please select Accept as Solution. This will assist other memebers
More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator