cancel
Showing results for 
Search instead for 
Did you mean: 

Re: VSE 8.8. 6807 DAT problem - urgent!

Also reasons 1 and 2 do not mean that its not possible

McAfee Employee JoeBidgood
McAfee Employee
Report Inappropriate Content
Message 172 of 230

Re: VSE 8.8. 6807 DAT problem - urgent!

Does anyone know if its possible to create a query based on an SQL statement, such as this? Currently we can "view" queries in SQL language (select query in ePO , click Actions, view SQL) but not "create" , unless we log on to the DB directly..

I'm afraid not  

Queries in ePO are built by the query engine, which only supports a subset of the full SQL command set. There's no mechanism for converting a "normal" SQL query into the format that the query engine understands.

Sorry

Joe

mjmurra
Level 12
Report Inappropriate Content
Message 173 of 230

Re: VSE 8.8. 6807 DAT problem - urgent!

JoeBidgood wrote:


I'm afraid not  

Queries in ePO are built by the query engine, which only supports a subset of the full SQL command set. There's no mechanism for converting a "normal" SQL query into the format that the query engine understands.

*cough* FMR

Actually after some brainstorming today with a colleague, found a brilliant compromise.

Using the EPO tool I mentioned a few posts ago, I deployed to all machines, and  modified the query it was packaged with to do the following:

- Add the IP address column of hosts to the displayed results.

- Display as a normal table rather than a rolled-up table.

- Only display hosts that needed the patch.

Then displayed the table, exported it to CSV and loaded into Excel.

EPO has a wonderful filter for displaying hosts that allows you to enter a set of IPs. This is limited to ~100. So selected 100 -odd cells of IP addresses and pasted them in.

That 100 affected hosts were then shown. Created a new tag and tagged those hosts. Set the hosts to have the remediation run against them as a priority.

Did the same for the rest of the IPs.

End result: Happiness. But it was pretty messy!

Reliable Contributor twenden
Reliable Contributor
Report Inappropriate Content
Message 174 of 230

Re: VSE 8.8. 6807 DAT problem - urgent!

Noticed that McAfee has release a tool called the VSE 6807 & 6808 Integrity Tool.   Below is the overview.  Overview  This tool is used to provide a ‘snapshot’ collection of data from the environment (or where the tool has been run), allowing the ePolicy Orchestrator Admin to run a report that shows which systems have been affected by DAT 6807 or 6808. Using this information you can target/identify systems in your environment that need remediation. It inspects registry values and files including the OnAccessScanLog.txt, McScript.log, and McScript_backup.log to determine if the system has run the affected DAT versions, and generates an Agent Event to capture findings from the system.  =============  Have tried install it to the repositoryand can see the tool but don't see it as an option under product deployment or under server tasks. What am I missing?

mjmurra
Level 12
Report Inappropriate Content
Message 175 of 230

Re: VSE 8.8. 6807 DAT problem - urgent!

twenden wrote:

  Have tried install it to the repositoryand can see the tool but don't see it as an option under product deployment or under server tasks. What am I missing?

Should be under "Product Deployment" as something you can install. Strange you can't see it. I recall missing it the first time I looked in the list of installable products - although can't recall what it's actual title was.

Reliable Contributor brentil
Reliable Contributor
Report Inappropriate Content
Message 176 of 230

Re: VSE 8.8. 6807 DAT problem - urgent!

twenden wrote:

Have tried install it to the repositoryand can see the tool but don't see it as an option under product deployment or under server tasks. What am I missing?

Once checked in it shows as "VSE 6807 & 6808 DAT Integrity Reporter 2.0.0.7" as a McAfee Agent -> Product Deployment -> Create New Task.

I have it deployed to my test machines so far and I'm about to unleash it on our desktops.  If that goes well then servers next.

proma
Level 7
Report Inappropriate Content
Message 177 of 230

Re: VSE 8.8. 6807 DAT problem - urgent!

If you could provide an update as to how it goes, that would be great! I'm contemplating running this as well but don't want to be the first !!! Good luck...

mjmurra
Level 12
Report Inappropriate Content
Message 178 of 230

Re: VSE 8.8. 6807 DAT problem - urgent!

proma wrote:

If you could provide an update as to how it goes, that would be great! I'm contemplating running this as well but don't want to be the first !!! Good luck...

Ran it on over 6K servers/desktops today with no complaints. Decent tool, results seem legit - certainly match another source of data I was using.

proma
Level 7
Report Inappropriate Content
Message 179 of 230

Re: VSE 8.8. 6807 DAT problem - urgent!

How did all of you find out about this problem. I had to read about it on Computer World security 5 days after initial problem...Our regional rep contacted me on Wednesday 8/22, right after I saw the computer world article. I am subscribed to the SNS alerts and all other alerts from McAFee as far as I know but didn't recieve a freaking thing about this.

So we've been unprotected on 1100+ machines for almost a week. Many angry faces at this organization.

Reliable Contributor brentil
Reliable Contributor
Report Inappropriate Content
Message 180 of 230

Re: VSE 8.8. 6807 DAT problem - urgent!

It was an SNS that was sent out.  If you're on their SNS TXT service you got it there more than an hour before the emails went out too.  You might want to check what SNS items you're subscribed to because there's more than just being on the SNS.

https://sns.snssecure.mcafee.com/content/signup_login

I've just released the Reporter to all workstations, I've got 50+ machines already reported in and so far everything has been clean.

More McAfee Tools to Help You

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community