Endpoint Security Storage Protection default queries and dashboards don't show threat events in results

Technical Articles ID: KB95613
Last Modified: 2022-07-01 15:10:58 Etc/GMT

Environment

Endpoint Security Storage Protection (ENSSP) 2.1.x, 2.0.x
ePolicy Orchestrator (ePO) 5.x

Problem

The ENSSP (ENS-SP) extension manages both ENSSP and legacy VirusScan Enterprise for Storage (VSES). But, the threat events for ENSSP use the ENS schema while the default queries in the default dashboards still use the schema from VSE. As such, incoming ENSSP events don't match the default query criteria and are filtered out.

Solution

This issue is resolved in ENSSP 2.2.0.

Our product software, upgrades, maintenance releases, and documentation are available on the Product Downloads site.

NOTE: You need a valid Grant Number for access. See KB56057 - How to download product updates and documentation for more information about the Product Downloads site, and alternate locations for some products.

Workaround

You can import custom queries and dashboards into ePO, such as the ones attached to this article. Or, you can create your own using ENSSP threat events as your template.

To import updated custom queries and dashboards, perform the steps below:

Download and extract ENS-SP_Queries_and_Dashboards.zip from the "Attachment" section of this article.
In ePO, navigate to the Queries & Reports page.
Click Import Queries.
Click Browse, select Qry--ENSSP--Statistics--ICAP.xml, and save the query.
Click OK on the Import Queries screen.
Click Import Queries.
Click Browse, select Qry--ENSSP--Statistics--NetApp.xml, and save the query.
Click OK on the Import Queries screen.
Navigate to the Dashboards page in ePO.
Click Dashboard Actions and choose Import.
Click Browse and select Endpoint_Security_Storage_Protection_ICAP__Current_Detections-Dashboard--Fixed.xml.
To import the dashboard, click OK and then OK.
Click Dashboard Actions and choose Import.
Click Browse and select Endpoint_Security_Storage_Protection_NetApp__Current_Detections-Dashboard--Fixed.xml.
To import the dashboard, click OK and then OK.

Attachment

ENS-SP_Queries_and_Dashboards.zip
5K • < 1 minute @ broadband

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Endpoint Security Storage Protection default queries and dashboards don't show threat events in results

Environment

Problem

Solution

Workaround

Attachment

Affected Products

Languages:

Title

Title

Knowledge Center

Endpoint Security Storage Protection default queries and dashboards don't show threat events in results

Environment

Problem

Solution

Workaround

Attachment

Affected Products

Languages:

Choose your region

Title

Title