Moving from McAfee VSE to ENS

[chris]

Hi,

I used the following DB Query to find out at what VSE version our clients have:

| dbxquery connection="ePO_server" query="SELECT
|EPOLeafNode.NodeName, EPOLeafNode.LastUpdate,
|EPOProdPropsView_VIRUSCAN.datver AS vse_dat_version,
|EPOComputerProperties.UserName AS [user] FROM EPOLeafNode LEFT JOIN
|EPOProdPropsView_VIRUSCAN ON EPOLeafNode.AutoID =
|EPOProdPropsView_VIRUSCAN.LeafNodeID LEFT JOIN EPOComputerProperties ON
|EPOLeafNode.AutoID = EPOComputerProperties.ParentID"

We are moving to ENS now, has anyone gone through the trouble of implementing a similar query for ENS?
I know that this is not a Splunk problem, I will also post on the McAfee forums.

Regards
Chris

[chris · Accepted solution]

One of my team mates found a solution:

| dbxquery connection="ePO_server" query="SELECT
EPOLeafNode.NodeName, EPOLeafNode.LastUpdate,
EPOProdPropsView_THREATPREVENTION.verDAT32Major AS AMCoreContent,
EPOComputerProperties.UserName AS [user] FROM EPOLeafNode LEFT JOIN
EPOProdPropsView_THREATPREVENTION ON EPOLeafNode.AutoID =
EPOProdPropsView_THREATPREVENTION.LeafNodeID LEFT JOIN EPOComputerProperties ON
EPOLeafNode.AutoID = EPOComputerProperties.ParentID"

Regards
Chris