cancel
Showing results for 
Search instead for 
Did you mean: 

Thraet event logs

Hi All,

I am having issue in getting the threat event log information from the epo/system tree/ system

the right permission set is applied.

if i am using the admin account i didn't see any issue, but fro another another account it gave an error.

An error occurred while retrieving the requested data.

Any one has an idea about it?

ePo 5.3.2.

-k

16 Replies
McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 2 of 17

Re: Thraet event logs

it is a permission setting somewhere, either no permissions for that software, system tree location, or other.  Please review your permission set settings for all the categories.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Thraet event logs

Permission is view events for Threat event logs

McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 4 of 17

Re: Thraet event logs

Is that the only permission enabled?  Do you have any permissions to queries and reports?

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Thraet event logs

McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 6 of 17

Re: Thraet event logs

what does the orion log show as far as lacking permissions (epolicy orchestrator\server\logs on the epo server where it is installed)?  can you also send a screenshot of all the permission set settings?

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Thraet event logs

I think the issue is not with permission set.

it some kind of bug, if you login on epo GUI except admin you see the threat event log information error.

Name and users: Global Reviewer

1 users

0 Active Directory group mappings

Agent Handler: View Agent Handlers

Audit Log: View Audit Log

Automatic Response: View Responses; view Response results in the Server Task Log

Client Events: View Client Events

Common Catalog: No permissions

Contacts: Use contacts

Credential Catalog: No permissions

Dashboards: Use public dashboards

Database Security Configuration: No permissions

Database Security DAM Policies: View policy settings

Database Security DAM Tasks: View client tasks settings

Database Security DVM Policies: View DVM policy settings

Data Loss Prevention: No permissions

Data Protection Self-Service Portal: No permissions

Drive Encryption: View policy settings

Drive Encryption : Out Of Band Management: No permissions

Drive Encryption Go: View Drive Encryption Go settings

DXL McAfee MePO Certificate Creation: No permissions

Endpoint Protection for Mac 2.3.0:Application Protection: View settings

Endpoint Security Adaptive Threat Protection: View policy settings

Endpoint Security Adaptive Threat Protection Query: No permissions

Endpoint Security Common: View policy settings

Endpoint Security Firewall: View firewall settings

Endpoint Security Firewall Catalog: No permissions

Endpoint Security Firewall Client: No permissions

Endpoint Security Platform Query: No permissions

Endpoint Security Threat Prevention: View policy settings

View task settings

Endpoint Security Threat Prevention Client: No permissions

Endpoint Security Web Control: View settings

View task settings

Endpoint Security Web Control Query: No permissions

ePO Deep Command Actions: No permissions

ePO Deep Command Policies: Can view policy settings

View task settings

ePO Deep Command Profile Manager: Can view policy settings

Event Notifications: View registered executables

FRP Key Server: No permissions

FRP Policy Permission: View Policy

FRP Recovery: No permissions

Help Desk Actions: No permissions

Host Intrusion Prevention 8.0: View firewall settings

View general settings

View IPS settings

Issue Management: Basic: View issues

LDAP: No permissions

McAfee Agent: View policy settings

View task settings

McAfee DXL Broker Management: View policy settings

McAfee DXL Client Policies: Can view policy settings

McAfee DXL Fabric: No permissions

McAfee Labs: View McAfee Labs Portal

McAfee Management of Native Encryption: View policy settings

McAfee Security for Lotus Domino 7.5: View settings

View task settings

McAfee Security for Lotus Domino 7.5: View settings

View task settings

McAfee Security for Microsoft Exchange 8.6: View settings

View task settings

Multi-server roll-up data: Run and edit queries based on roll-up data

Policy Assignment Rule: View Rules

Product Improvement Program: View policy settings

Queries and Reports: Edit public groups; create and edit private queries/reports; make private queries/reports public.

Registered servers: All Server Types: View registered servers

Rogue DBMS Detection: View policy and task settings

View task settings

Rogue System Detection: No permissions

Rogue System Sensor: View sensor policy settings

View task settings

Edit

Server tasks: View Scheduler tasks; view Scheduler task results in the Server Task Log

Edit

Software: View packages

View repositories

Software Manager: View list of available products

Solidcore General: No permissions

Solidcore Policy Permission: View Application Control Policies

View task settings

View Change Control Policies

View task settings

View Integrity Monitoring Policies

View task settings

View General Policies

View task settings

Systems: View "System Tree" tab

System Tree access: Can access the following nodes and portions of the System Tree:My Organization

Threat Event Log: View events

User Directory: No permissions

VirusScan Enterprise 8.8: View policy settings

View task settings

VirusScan Enterprise for Linux 1.9.2 / 2.0.3: View settings

View task settings

 

VirusScan Enterprise for Storage 1.2.0: View settings

McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 8 of 17

Re: Thraet event logs

Check the Orion log please.  If a user can't access it not as a global admin, but global admin can, then there are permissions lacking somewhere.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Thraet event logs

user can see all the information except the threat event logs.

McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 10 of 17

Re: Thraet event logs

Please attach the orion log after an attempt to view the threat event logs. 

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community