Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 3 replies
  • Subscribers 19 subscribers
  • Views 9985 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Any plans to improve built-in reporting for Enterprise Console

KarmaIsReal

I would like to be able to create a report that lists all computers with a certain undesirable app (i.e. Call of Duty), but cannot find any way of doing this in the built-in reporting function.  Yes, I've read about implementing the Reporting Interface and running SQL queries, but I find that to be a bit ridiculous.  Am I missing something?  Is there really no way of obtaining this simple information?  I have no use for seeing the number or percentage of machines that have it installed; I want a list of which machines have it installed, so that I can act on it.

:56415


This thread was automatically locked due to age.
Parents
  • 0

    Hello KarmaIsReal,

    Am I missing something?

    perhaps. In Report Manager [Create...] a new report, use the Alert and event history template. Either with the Wizard (Select the report filter.) or from the Properties/Configuration's Alert and event types to include pane check only the Application control type, click the [Advanced...] button and enter the desired expression (a rather simple pattern), the Alerts and events included pane shows all matching encountered items of the selected type(s) (i.e. all still in the database for which SEC has received an alert regardless of the selected period or location).

    Note that an endpoint will likely be listed more than once. Select the appropriate sorting (Display options) and if you schedule the report you can choose among a small number of output formats (some of them suitable for "post-processing").

    Is that what you need?

    Christian

    :56427
Reply
  • 0

    Hello KarmaIsReal,

    Am I missing something?

    perhaps. In Report Manager [Create...] a new report, use the Alert and event history template. Either with the Wizard (Select the report filter.) or from the Properties/Configuration's Alert and event types to include pane check only the Application control type, click the [Advanced...] button and enter the desired expression (a rather simple pattern), the Alerts and events included pane shows all matching encountered items of the selected type(s) (i.e. all still in the database for which SEC has received an alert regardless of the selected period or location).

    Note that an endpoint will likely be listed more than once. Select the appropriate sorting (Display options) and if you schedule the report you can choose among a small number of output formats (some of them suitable for "post-processing").

    Is that what you need?

    Christian

    :56427
Children
No Data
Unfiltered HTML