Querying SEPM Database

[Bryan Arreola]

Hi, team

We are currently working on coding a script to get automated reports from SEPM, this reports are the ones extracted in Reports > Network and Exploit Mitigation, in a lapse of one hour. I'm currently digging into the tables and views in SEPM DB but I cannot found the correct table or view to extract that information, do you have any idea? 

Regards,

[John Owens]

Hi Bryan,

Have you reviewed our Schema Guide?

http://techdocs.broadcom.com/content/dam/broadcom/techdocs/symantec-security-software/endpoint-security-and-management/endpoint-protection/generated-pdfs/Database_Schema_Reference_SEP14.2.2_SEP14.3.zip

------------------------------
John Owens
Principal Product Support
Symantec
United StatesJohn Owens
Principal Product Support
Symantec
United States
------------------------------

[Bryan Arreola]

Well, now I have, but I seem to fail finding what I need. I don't know, maybe I don't need a single table but a few. This is an example of what we pull from SEPM->Network and Host Exploit Mitigation->Full Report->Past 24 hours.

[Bryan Arreola]

Here's the attachment.

Attachment(s)

firewall_report_example.csv   1 KB 1 version

[ClayShooter]

Looking at my SEP SQL database, it looks like most of those fields in your CSV attachment can be found directly in the table(s) "AGENT_SECURITY_LOG_*"

[John Owens]

You could also run a SQL trace. Then run the report in the SEPM.  You could then find the exact SQL Queries being run to produce the results in the SEPM.

------------------------------
John Owens
Principal Product Support
Symantec
United States
------------------------------

[Bryan Arreola]

I have done that, now I have the exact query, however, I see a few rows that are displayed with an ID, in the SEPM report I see them converted, for example, one of the OS TYPE value is 805961730, but in the report is shown as "Windows 10 Professional". How can I do the same programatically or by modifying the query?