Endpoint Protection

SEPM > monitors > logs > risk <selection application bottom right under advanced setting>

is there a way to have this scheduled? or even set this up as a notification?

I would like to know when a particular application gets tagged as a risk and with any type of action,

and should be notified, or even checked in a scheduled report.

or if there is another way to get to the information? sql query side might be a little delayed?

Anyway - let me know if you guys know of anything

Regards

Gino

You can navigate to reports and  have this scheduled however there is no such notification with particular risk name 

hi there,

I know I can select risk as part of the report, but dont see where I can select a particular application,

and these reports dont provide me with the detail I am looking for

I basically need what I can get via the monitors > log > risk > selection (application) to be available on a schedule or notification?

Regards

Gino

There isn't an option to schedule on a per app basis. Unfortunately, what's there is what you get.

:( I suspected that there wasnt

would there be a way to export these monitor logs, maybe via a script ?

most of these monitoring logs are so relevant and would/could save a lot of time if it could just be exported on a regular basis

maybe I should add it as an idea :)

Thanks for the quick responses anyway.

Regards

Gino

Idea is the way to go. They may be able to be exported but I don't see much in the API to automate it.

There is a way of doing this via excel, please check all the 3 articles from Jeff

https://www.symantec.com/connect/articles/metrics-using-data-sepm

thanks Brain and Rafeeq,

I already have that script and excel template from jeff

unfortunately one still need to first export manually and then run the script to do the fine tuning.

so this wont work for me, at least not at the moment.

doing it via sql query would be time delayed as we only run those type of queries in the evening.

Thanks for the feedback guys - much appreciated.

Gino

No problem.