cancel
Showing results for 
Search instead for 
Did you mean: 
mlajoie
Level 10
Report Inappropriate Content
Message 1 of 9

Tag Applied Date

Jump to solution

Is there a way to determine when a tag was applied?  For instance, I have tags that are applied (via a PAR) during specific software installations.  When the install is completed, it is supposed to remove the tag and clear the PAR.  

So.  What I'd like to find out is how long or when the tag was applied.  This way I can tell if the device is going through an installation or someone has gone "rogue", if you will.

Maybe through a combination of alerts or something?  IDK.  Please advise.

1 Solution

Accepted Solutions
McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 6 of 9

Re: Tag Applied Date

Jump to solution
What you can do is set up a report to be sent to you based on when a system gets TP disabled. If you run it daily or however frequently you want, you would see the same systems in that report to take action on.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

8 Replies
McAfee Employee Hawkmoon
McAfee Employee
Report Inappropriate Content
Message 2 of 9

Re: Tag Applied Date

Jump to solution

Hi mlajoie,

There are two locations you can see date information surrounding a TAG.

These being the 'TAG catalog' and the 'Audit.log', with respect to the Audit log you need to add a filter to display TAG entries:TAG_Audit_log.JPGAudit log informationTAG_dates.JPGTAG catalog detail

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

mlajoie
Level 10
Report Inappropriate Content
Message 3 of 9

Re: Tag Applied Date

Jump to solution
I wasn't able to find the tag being applied in the audit log..

The tag I'm trying to track down is created, first, by a custom tag. I then have a tag applied based on that criteria. Would the audit log still capture that? If so, maybe I just missed it.
McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 4 of 9

Re: Tag Applied Date

Jump to solution
Can you be more specific on exactly how you are doing all this? I would assume you are using server tasks for this functionality. You might want to check the server task log also for any entries around it. Did you check the audit log for that system name or the tag name? Are you sure the audit log search covered enough time frame where this would have occurred?

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

mlajoie
Level 10
Report Inappropriate Content
Message 5 of 9

Re: Tag Applied Date

Jump to solution

Sure.  

I set the tag to evaluate the "custom property 2" system tag (see attachment "tag criteria.jpb") which is filled automatically by the installation script.  In that script, after setting the custom tag, we the perform an ASCI which, in turn, runs the tag (see "tag evaluation.jpg").  The ePO tag that is then assigned assigns a Threat Prevention policy that disables all of TP, via a PAR.

To turn TP back on, we then, programmatically, remove the "custom property 2" tag and run an ASCI.  That, in turn, removes the ePO tag which, then, removes the PAR which removes the disable policy.  THis returns the machine to full enforcement.

What I'm trying to figure out is how to tell how long the tag has been applied.  What I don't want is the admins to use this as a way to disable TP because they don't like it on or whatever.  Being able to tell how long that tag has been applied will give me the information I need to go back to them to get them to remove the tag.

Does that make more sense?  Hopefully, there's a way to figure it out.

 
McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 6 of 9

Re: Tag Applied Date

Jump to solution
What you can do is set up a report to be sent to you based on when a system gets TP disabled. If you run it daily or however frequently you want, you would see the same systems in that report to take action on.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

mlajoie
Level 10
Report Inappropriate Content
Message 7 of 9

Re: Tag Applied Date

Jump to solution
Yeah - I thought of that. It just isn't a good method. I have to keep track and cross-reference the machine names. It would be a whole heck of a lot easier if a date the tag was assigned was available.
McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 8 of 9

Re: Tag Applied Date

Jump to solution
Agreed - that sounds like a good thing to submit an idea for. See kb60021.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

mlajoie
Level 10
Report Inappropriate Content
Message 9 of 9

Re: Tag Applied Date

Jump to solution
Will do. Thanks.
More McAfee Tools to Help You

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community