Hello, We need to archive some events so they're not lost forever after 30 days. I believe Splunk can integrate with the AMP API and can do this but alas we do not have Splunk or any other decent SIEM for that matter. Any bright ideas on how we could achieve this? Thanks, Matt. ... View more

Hello, A customer has asked if it's possible using AMP4E to block/quarantine all .bat files regardless of the disposition. Do you know if this is possible? Thanks, Matt. ... View more

Hi all,   Using AMP, I need to produce a report that lists all endpoints against the known software vulnerabilities on those endpoints so they can be upgraded/patched. I need to include the group that the endpoint belongs to (there are many endpoints grouped by country, endpoint type, etc, each group being managed by different IT teams).   Analysis > Vulnerable Software displays a list of all the vulnerable software. Clicking on one of these lists all the CVEs, "observed in groups", and the last observed individual endpoint. What is doesn’t let me see is each and every endpoint affected by that vuln (unless I’m being blind). Same deal if Export to CSV, it only shows that last observed endpoint for each vuln, not all affected endpoints.   "Dashboard > Events > Event Type = Vulnerable Application Detected" does a better job, especially when exported to CSV but it doesn't include the group that the endpoint is a member of. This is a must for me.   Anybody know the best way to achieve this?   Many thanks in advance, Matt. ... View more