How to determine which computers have an Extra.DAT installed using ePolicy Orchestrator reporting

Technical Articles ID: KB59410
Last Modified: 7/1/2019

Environment

McAfee Endpoint Security (ENS) Adaptive Threat Protection (ATP) 10.x
McAfee ENS Threat Prevention 10.x
McAfee ePolicy Orchestrator (ePO) 5.x
McAfee VirusScan Enterprise (VSE) 8.8

Summary

This article explains:

How to view an ePO report that displays a count of computers that have an Extra.DAT applied
How to create a report of all systems that have applied a specific Extra.DAT

Solution

To create a report of all systems that have applied an Extra.DAT, after you have checked in the Extra.DAT file to ePO and allowed it to run on the systems:

NOTE: This report only indicates whether an Extra.DAT is applied. It does not indicate which Extra.DAT is applied, for example, whether it is an older Extra.DAT or the newest Extra.DAT. See Solution 2 to create a report of systems that have applied a specific Extra.DAT.

Log on to the ePO console.
Click Queries & Reports.
Click New Query.
Select Managed Systems under Result Types, and then click Next.
Select Boolean Pie Chart under Chart type.
Select Number of for the Pie slice values, and do one of the following based on the product:
- For Endpoint Security: Locate Endpoint Security Threat Prevention Systems and select Names of threats that Extra.DAT can detect.
- For VirusScan Enterprise: Locate VirusScan Enterprise Properties and select Extra DAT (VirusScan Enterprise).
Click Configure Criteria and do one the following based on the product:
- For Endpoint Security:
  1. Under the Available Properties column, scroll down to locate Endpoint Security Threat Prevention Systems and click Names of threats that Extra.DAT can detect.
  2. Select Value is not blank under the Comparison column and click OK.
- For VirusScan Enterprise:
  1. Under the Available Properties column, scroll down to locate VirusScan Enterprise Properties and click Extra DAT (VirusScan Enterprise).
  2. Select Value is not blank under the Comparison column and click OK.
Click Next.
Select the columns you want to display in the drill-down table, such as Names of threats that Extra.DAT can detect or Extra DAT (VirusScan Enterprise), and then click Next.
Select any filters that you want to apply to the results, and then click Run.

The report displays any Extra.DAT file entries reported back for computers.

Solution

To create a compliance report of all systems that have applied a specific Extra.DAT, after you have checked in the Extra.DAT file to ePO and allowed it to run on the systems:

Log on to the ePO console.
Click Queries & Reports.
Click New Query.
Select Managed Systems under Result Types, and then click Next.
Select Boolean Pie Chart under Chart type.
Select Number of Managed Systems for the Pie slice values.
Click Configure Criteria and do one the following based on the product:
- For Endpoint Security:
  1. Under the Available Properties column, scroll down to locate Endpoint Security Threat Prevention Systems and click Names of threats that Extra.DAT can detect.
  2. Select Equals under the Comparison column, type the name of the Extra.DAT under the Value column, and then click OK.
- For VirusScan Enterprise:
  1. Under the Available Properties column, scroll down to locate VirusScan Enterprise Properties, and then click Extra DAT (VirusScan Enterprise).
  2. Select Equals under the Comparison column, type the name of the Extra.DAT under the Value column, and then click OK.
Click Next.
Select the columns that you want to display in the drill-down table, such as Names of threats that Extra.DAT can detect or Extra DAT (VirusScan Enterprise), and then click Next.
Select any filters that you want to apply to the results, and then click Run.

Affected Products

Endpoint Security Firewall 10.6.x
Endpoint Security Firewall 10.5.x
Endpoint Security Threat Prevention 10.6.x
Endpoint Security Threat Prevention 10.5.x
Endpoint Security Threat Prevention 10.2.x (EOL)
Endpoint Security Web Control 10.6.x
Endpoint Security Web Control 10.5.x
ePolicy Orchestrator 5.9
Reporting
VirusScan Enterprise 8.8

Languages:

This article is available in the following languages:

German
English United States
Spanish Spain
French
Italian
Japanese
Korean
Dutch
Portuguese Brasileiro
Chinese Simplified
Chinese Traditional

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

Environment

Summary

Solution

Solution

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Featured Solutions

Explore Our Portfolio

Security Outcomes

Industries

Products

Featured Solutions

Explore Our Portfolio

MVISION Products

Services & Training

Threat Research

Our Researchers

Threat Landscape Dashboard

Tools

Contact Us

Resources

Downloads

Product Help

Connect with Us

Explore

Our Company

Our Efforts

Other Resources

Careers

Partnerships

Knowledge Center

Environment

Summary

Solution

Solution

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title