Press CTRL+K to open search

Run query using table objects, commands, and arguments: best practice

  • Published on Sep 7, 2026
  • 8 minute(s) read
Prev Next

You can create web URL queries using a web query template and the web URL Help.

This example describes creating a simple web URL query that displays this information about your managed systems:

  • System name

  • Trellix Agent version

  • When the agent was last updated

  • Threat Prevention product family

  • Threat Prevention version

  • Displays the information as a table

  1. To find the name of the SQL table with most of your information, use this Help command.

    https://<localHost>:8443/remote/core.listTables?:output=terse

  2. Using your text editor, type this web URL template command.

    https://<localHost>:8443/remote/core.executeQuery?target=<tableName>&select=(select <columns>)

  3. Use the information from this command to find the arguments for the system names, Trellix Agent version, and when it was last updated.

    https://<localHost>:8443/remote/core.listTables?:output=terse&table=EPOLeafNode

    This command displays this information, which you need for your web URL query:

    • Query "target" — EPOLeafNode

    • System name — EPOLeafNode.NodeName

    • Trellix Agent version — EPOLeafNode.AgentVersion

    • When the agent was last updated — EPOLeafNode.LastUpdate

    • Products installed on each system — EPOProductPropertyProducts

    OK:
Name: Managed Systems
Target: EPOLeafNode
Type: target
Database Type: 
Description: Retrieves information about systems that have been added to your System Tree.
Columns: 
    Name                         Type          Select? Condition? GroupBy? Order? Number? 
    ---------------------------- ------------- ------- ---------- -------- ------ -------
    AutoID                       int           False   False      False    True   True   
    Tags                         string        True    False      False    True   False  
    ExcludedTags                 string        True    False      False    True   False  
    AppliedTags                  applied_tags  False   True       False    False  False  
    LastUpdate                   timestamp     True    True       True     True   False  
    os                           string        True    False      False    False  False  
    products                     string        False   False      False    False  False  
    NodeName                     string        True    True       True     True   False  
    ManagedState                 enum          True    True       False    True   False  
    AgentVersion                 string_lookup True    True       True     True   False  
    AgentGUID                    string        True    False      False    True   False  
    Type                         int           False   False      False    True   False  
    ParentID                     int           False   False      False    True   True   
    ResortEnabled                boolean       True    True       False    True   False  
    ServerKeyHash                string        True    True       False    True   False  
    NodePath                     string_lookup False   False      False    True   False  
    TransferSiteListsID          isNotNull     True    True       False    True   False  
    SequenceErrorCount           int           True    True       False    True   True   
    SequenceErrorCountLastUpdate timestamp     True    True       False    True   False  
    LastCommSecure               string_enum   True    True       True     True   False  
    TenantId                     int           False   False      False    True   True   
Related Tables: 
    Name
    --------------------------
    EPOProdPropsView_EEFF
    EPOProdPropsView_VIRUSCAN
    EPOProductPropertyProducts
    EPOProdPropsView_PCR
    EPOBranchNode
    EPOProdPropsView_EPOAGENT
    EPOComputerProperties
    EPOComputerLdapProperties
    EPOTagAssignment
    EPOProdPropsView_TELEMETRY
Foreign Keys: 
    Source table Source Columns Destination table          Destination columns Allows inverse? One-to-one? Many-to-one? 
    ------------ -------------- -------------------------- ------------------- --------------- ----------- ------------
    EPOLeafNode  AutoID         EPOComputerProperties      ParentID            False           False       True        
    EPOLeafNode  AutoID         EPOTagAssignment           LeafNodeID          False           False       True        
    EPOLeafNode  ParentID       EPOBranchNode              AutoID              False           False       True        
    EPOLeafNode  AutoID         EPOComputerLdapProperties  LeafNodeId          False           False       True        
    EPOLeafNode  AutoID         EPOProductPropertyProducts ParentID            False           False       True  

  4. Add the arguments from step 3 to the web URL template command and test it. Confirm that your command looks similar to this example.

    https://<localHost>:8443/remote/core.executeQuery?target=EPOLeafNode&select=(select EPOLeafNode.NodeName EPOLeafNode.AgentVersion EPOLeafNode.LastUpdate)

    Confirm that your output is similar to this example.

    OK:
System Name: DP-2K8ER2EPO510
Agent Version (deprecated): 4.8.0.887
Last Communication: 6/13/14 9:21:49 AM PDT

System Name: DP-2K12R2S-SRVR
Agent Version (deprecated): 4.8.0.887
Last Communication: 6/13/14 9:55:19 AM PDT

System Name: DP-EN-W7E1XP-2
Agent Version (deprecated): null
Last Communication: null

.
.
.

  5. Use the core.listTables Help command again, but with the EPOProdPropsView_VIRUSCAN table. This table lists the Threat Prevention products and versions installed on each system. Confirm that your command looks similar to this example.

     https://<localHost>:8443/remote/core.listTables?table=EPOProdPropsView_VIRUSCAN
                    

  6. Using the output of step 5, add these parameters to your web URL command and test it.

    • Threat Prevention product family — EPOProdPropsView_VIRUSCAN.ProductFamily

    • Threat Prevention version — EPOProdPropsView_VIRUSCAN.productversion

    Confirm that your example looks similar to the following.

    https://<localHost>:8443/remote/core.executeQuery?target=EPOLeafNode&select=(select EPOLeafNode.NodeName EPOLeafNode.AgentVersion EPOLeafNode.LastUpdate EPOProdPropsView_VIRUSCAN.ProductFamily EPOProdPropsView_VIRUSCAN.productversion)

    Confirm that your example output looks similar to the following.

    OK:
System Name: DP-2K8ER2EPO510
Agent Version (deprecated): 4.8.0.887
Last Communication: 6/13/14 10:21:50 AM PDT
ProdProps.productFamily (VirusScan Enterprise): VIRUSCAN
Product Version (VirusScan Enterprise): 8.8.0.1266

System Name: DP-2K12R2S-SRVR
Agent Version (deprecated): 4.8.0.887
Last Communication: 6/13/14 10:55:19 AM PDT
ProdProps.productFamily (VirusScan Enterprise): VIRUSCAN
Product Version (VirusScan Enterprise): 

System Name: DP-EN-W7E1XP-2
Agent Version (deprecated): null
Last Communication: null
ProdProps.productFamily (VirusScan Enterprise): VIRUSCAN
Product Version (VirusScan Enterprise): 

.
.
.

  7. Finally, to show the output as a table, add the command :output=terse& after the first ampersand and rerun the command.

    Confirm that your example command looks similar to the following.

    https://<localHost>:8443/remote/core.executeQuery?target=EPOLeafNode&:output=terse&select=(select EPOLeafNode.NodeName EPOLeafNode.AgentVersion EPOLeafNode.LastUpdate EPOProdPropsView_VIRUSCAN.ProductFamily EPOProdPropsView_VIRUSCAN.productversion)

    Confirm that your example output looks similar to the following.

    OK:
System Name     Agent Version (deprecated) Last Communication      ProdProps.productFamily (VirusScan Enterprise) Product Version (VirusScan Enterprise)
--------------- -------------------------- ----------------------- ---------------------------------------------- --------------------------------------
DP-2K8ER2EPO510 4.8.0.887                  6/13/14 10:21:50 AM PDT VIRUSCAN                                       8.8.0.1266                            
DP-2K12R2S-SRVR 4.8.0.887                  6/13/14 10:55:19 AM PDT VIRUSCAN                                                                             
DP-EN-W7E1XP-2  null                       null                    VIRUSCAN                                                                             
DP-W7PIP-1      4.8.0.887                  6/13/14 10:37:20 AM PDT VIRUSCAN                                       8.8.0.1266                            
DP-W7PIP-2      4.8.0.887                  6/13/14 10:36:56 AM PDT VIRUSCAN                                       8.8.0.1266                            
DP-W7PIP-3      4.8.0.887                  6/13/14 10:37:00 AM PDT VIRUSCAN                                       8.8.0.1266                            
DP-2K8AGTHDLR   4.8.0.887                  6/13/14 10:25:10 AM PDT VIRUSCAN                                       8.8.0.1266                            
Related articles