Idea ID 2798516
The Tags attached to a device in ePO are available for Virusscan events, but not Endpoint Security events.
The ePO Tags could be used to allow the events to be separated by customer in ArcSight.
The Viruscan query joins with the EPOLEAFNODE table and returns the Tags field, but the Endpoint query does not join the EPOLEAFNODE table at all.
Please update the ePO DB SmartConnector query for ENS, and all other ePO events, to make the Tags field available.
May 04 2018 - Service Request for this request opened.
May 09 2018 - CON-20823 created.
May 14 2020 - Support inform me that the original SR will be closed, and the request should be logged here instead.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.