When ePO is integrated as a device, if you retrieve events directly from the ePO database, you might see the following issues:
- A red flag on the ePO device.
- A yellow flag on the ePO device.
- An error message when you test the connection.
After you upgrade to ePO 5.10, SIEM versions 10.3.2 or lower and 11.1.2 or lower are unable to retrieve events. You can't connect to the database server because ePO disabled TLS 1.0, so no events comes through.
