I believe that the stanzas for data extraction from EPO using db connect are only set to work with windows hosts, as the dat versions of the av engine are stored in different tables for windows and Linux within EPO and this is not catered for in the stanzas provided with the ta McAfee.
I think the windows data is in EPOProdPropsView_VIRUSCAN and the Linux equivalent data is in EPOProdPropsView_LSH.
Can anyone help with the sql for db connect that will select both of these in a format acceptable to splunk and the ES app? I am primarily interested in dat and engine versions at present.
Thanks.
