Endpoint Protection

Am new to SEP 14. 

Want to find 'system infected' alerts for the past month. 

NTP is now replaced with network & host mitigation. 

Can someone help me? 

Monitors page and go to Logs tab. Set it to Network and Host Mitigation and Attacks. Set whatever time range you need.

i want only sys infected. I dont see that option under 'events' when i choose 'attacks'

Set the 'Severity' to 'Critical', set 'Event Type' to 'Intrusion Prevention' and set 'Direction' to 'Outbound'.

This will get you closer to filtering out the noise.

You cannot filter on specific signatures in SEPM. Export it to CSV and open in Excel. Then filter on what you need.