Event retrieval issues when ePolicy Orchestrator is added as a device

Technical Articles ID: KB90872
Last Modified: 2022-08-18 10:43:38 Etc/GMT

Environment

ePolicy Orchestrator (ePO) 5.x
SIEM Enterprise Security Manager (ESM) 11.x, 10.x

SIEM Event Receiver (Receiver) 11.x, 10.x

Problem

When ePO is integrated as a device, if you retrieve events directly from the ePO database, you might see the following issues:

A red flag on the ePO device
A yellow flag on the ePO device.
An error message when you test the connection

After you upgrade to ePO 5.10, SIEM versions 10.3.2 or lower and 11.1.2 or lower are unable to retrieve events. You can't connect to the database server because ePO disables TLS 1.0; so no events come through.

System Change

You upgraded the ePO server and Receiver to a new version, and upgraded or migrated the ePO database.

Cause

Improper communication to the ePO database causes this issue.

Solution

Support for gathering data from databases using TLS 1.2 is included in SIEM 10.3.4 and 11.1.3. We recommend that you upgrade to the latest available version to benefit from all enhancements and resolved issues.

Workaround

Allow your ePO server to connect to a database running TLS 1.0 and enable TLS 1.0. For details, see KB90222 - Unable to make outbound connections to SQL or LDAP where Transport Layer Security 1.0 is disabled.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Event retrieval issues when ePolicy Orchestrator is added as a device

Environment

Problem

System Change

Cause

Solution

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

Event retrieval issues when ePolicy Orchestrator is added as a device

Environment

Problem

System Change

Cause

Solution

Workaround

Affected Products

Languages:

Choose your region

Title

Title