Available queries

Use the available queries to review information for the endpoints based on the data stored in the Trellix ePO - On-prem database.

Application Control queries
Query	Description
Alerts	Displays all alerts generated in the last 3 months.
Application Control Agent Status	Displays the status of all endpoints with the Application Control license which are managed by the Trellix ePO - On-prem server. The pie chart categorizes the information based on the client status. Click a segment to review endpoint information.
Attempted Violations in the Last 24 Hours	Displays the tried violation events detected during the last 24 hours. The line chart plots data on a per hour basis. Click a value on the chart to review event details.
Attempted Violations in the Last 7 Days	Displays the tried violation events detected during the last 7 days. The line chart plots data on a per day basis. Click a value on the chart to review event details.
Non Compliant Solidcore Agents	Lists the endpoints that are currently not compliant. The list is sorted based on the reason for noncompliance. An endpoint can be noncompliant if: It is in Disabled, Observe, or Update mode. The local command line interface (CLI) access is recovered.
Policy Assignments By System	Lists the number of policies applied on the managed endpoints. Click a system to review information about the applied policies.
Policy Discovery Requests for Automatically-Approved Installations	Lists all files that were identified as installers on the endpoints and executed automatically with installer rights in the last 1 month.
Solidcore Agent License Report	Indicates the number of Solidcore Agents that are managed by the Trellix ePO - On-prem server. The information is categorized by the license information and further sorted based on the operating system on the endpoint.
Solidcore Agent Status Report	Displays the status of all endpoints managed by the Trellix ePO - On-prem server. This report combines information for the Application Control licenses. The pie chart categorizes the information by the client status. Click a segment to review detailed information.
Summary Server Reboot Log - Rolling 30 Days	Displays the reboot log grouped by system name.
Systems for which Inventory Cannot be Fetched Currently	List the systems in your enterprise for which inventory information can't be fetched currently. You can't fetch inventory for a system if the specified interval between consecutive inventory runs hasn't been reached. This interval value is configurable.
Systems for which Inventory Information has not been Fetched for in Last 1 Month	Lists the systems in your enterprise for which inventory hasn't been fetched in the last month. We recommend that you fetch inventory weekly.
Top 10 Application Vendors	Displays the top 10 application vendors in the enterprise with the maximum number of applications. The chart includes a bar for each vendor and lists the applications for each vendor. The bar chart sorts the data in descending order. Click a section on a bar on the chart to review detailed information for the associated application.
Top 10 Systems with Most Violations in the Last 24 Hours	Displays the top 10 systems with the maximum number of violations in the last 24 hours. The chart includes a bar for each system and indicates the number of violations for each system. Click a bar on the chart to review detailed information.
Top 10 Systems with Most Violations in the Last 7 Days	Displays the top 10 systems with the maximum number of violations in the last 7 days. The chart includes a bar for each system and indicates the number of violations for each system. Click a bar on the chart to review detailed information.
Top 10 Users with Most Violations in the Last 7 Days	Displays the top 10 users with the most policy violation attempts in the last 7 days. The chart includes a bar for each user and indicates the number of policy violation attempts for each user. The bar chart sorts the data in descending order. Click a bar on the chart to review detailed information.
Top 10 Users with Most Violations in the Last 24 Hours	Displays the top 10 users with the most policy violation attempts in the last 24 hours. The chart includes a bar for each user and indicates the number of policy violation attempts for each user. The bar chart sorts the data in descending order. Click a bar on the chart to review detailed information.

Health Monitoring queries
Query	Description
Client Task Logs Data Congestion Trend in Last 7 Days	Displays the data congestion trend for client task logs on the last 7 days. The line chart plots data on a per day basis. Click a value on the chart to review details.
Inventory Data Congestion Trend in Last 7 Days	Displays the data congestion trend for inventory in the last 7 days. The line chart plots data on a per day basis. Click a value on the chart to review details.
Observations Data Congestion Trend in Last 7 Days	Displays the data congestion trend for observations in the last 7 days. The line chart plots data on a per day basis. Click a value on the chart to review details.
Systems with Most Pending Requests Generated in Observe Mode	Displays systems running in Observe mode with pending Policy Discovery requests. The summary table sorts the data in descending order.
Top 10 Events for 10 Most Noisy Systems in Last 7 days	Displays the top 10 events for the most noisy systems in last 7 days. The bar chart sorts the data in descending order. Click a bar on the chart to review detailed information.