Use queries to retrieve detailed information about the status of your managed systems and any threats in your environment. You can export, download, or combine queries into reports, and use queries as dashboard monitors.
Queries are questions that you ask Trellix ePO - On-prem, which returns answers as charts and tables. Reports enable you to package one or more queries into a single PDF document, for access outside of Trellix ePO - On-prem.
Similar information is available by accessing activity logs from the Trellix Endpoint Security (ENS) Client on individual systems.
You can view query data only for resources where you have permissions. For example, if your permissions grant access to a specific System Tree location, your queries return data only for that location.
Default queries
The module adds default queries to Trellix Groups. Depending on your permissions, you can use them as is, modify them, or create custom queries from events and properties in the Trellix ePO - On-prem database.
Endpoint Security Web Control: Compliance Status
Endpoint Security Web Control: Download Log
Endpoint Security Web Control: Downloads by Action
Endpoint Security Web Control: Downloads by Rating
Endpoint Security Web Control: Hotfixes Installed
Endpoint Security Web Control: Top 100 Blocked Red Sites
Endpoint Security Web Control: Top 100 Blocked Sites
Endpoint Security Web Control: Top 100 Red Downloads
Endpoint Security Web Control: Top 100 Red Sites on Allow List
Endpoint Security Web Control: Top 100 Sites on Allow List
Endpoint Security Web Control: Top 100 Sites on Block List
Endpoint Security Web Control: Top 100 Unrated Downloads
Endpoint Security Web Control: Top 100 Visited Red Sites
Endpoint Security Web Control: Top 100 Visited Unrated Sites
Endpoint Security Web Control: Top 100 Visited Yellow Sites
Endpoint Security Web Control: Top 100 Warned-Cancelled Sites
Endpoint Security Web Control: Top 100 Warned-Continued Sites
Endpoint Security Web Control: Top 100 Yellow Downloads
Endpoint Security Web Control: Top Sites Grouped by Content
Endpoint Security Web Control: Visit Log
Endpoint Security Web Control: Visits by Action
Endpoint Security Web Control: Visits by Action Grouped by Content
Endpoint Security Web Control: Visits by Content
Endpoint Security Web Control: Visits by Rating
Endpoint Security Web Control: Web Content Categories that Caused the Most Infections in the Last 7 Days
Custom queries (Trellix ePO - On-prem)
The module adds default properties to the Endpoint Security feature group. You can use these properties to create custom queries.
Feature Group | Result Type | Property (Column) | Property (Column) |
|---|---|---|---|
Endpoint Security | Endpoint Security Web Control Systems | Compliance Status | Language |
Compliance Status Additional Reasons | License Status | ||
Compliance Status Reason | Web Control Enabled | ||
Functional in Chrome | Web Control Functional Status | ||
Functional in Firefox | Web Control Hotfixes | ||
Functional in Internet Explorer | Web Control Patch Version | ||
Functional in Safari (macOS only) | |||
Endpoint Security Web Control Properties | Language (Endpoint Security Web Control) | Product Version (Endpoint Security Web Control) | |
Events | Web Control Events | Action | |
Affiliations | Exploits | ||
Annoyances | List Type | ||
Content | Observe Mode | ||
Count | Rating | ||
Domain | Reason | ||
Download | URL | ||
e-Commerce | |||
Endpoint Security Platform Systems | Web Control Debug Logging Enabled | Web Control Event Filter Level |
For information about queries and reports, see the Trellix ePO - On-prem documentation.