0 Replies Latest reply on Mar 6, 2015 1:14 PM by dkeller

    Windows Signature Ids




      Did the Windows signature IDs change between Windows 2008 and 2012?


      According to this document: McAfee KnowledgeBase - Windows Event ID to Nitro Signature ID translation the signature can end either with 0 or 1 depending on the revision. In my environment all signatures end with 0. Is there another revision out there or is that it? Can it change in the future?

      I am asking because I am concerned that my queries will stop working if the sig id changes?