Endpoint Protection

Below is a handy collection of SQL queries that might be useful for day to day admin work. All of these queries has been tested & confirmed as working for SEPM v14.

Fancy reading up the Database Schema Reference?

SEPM v11 - https://support.symantec.com/en_US/article.DOC4935.html

SEPM v12 - https://support.symantec.com/en_US/article.DOC4324.html

SEPM v12.1.6 - https://support.symantec.com/en_US/article.DOC8633.html

SEPM v14 - https://support.symantec.com/en_US/article.DOC9438.html

If you have any other SQL queries that you're happy to share, please leave a comment!

List of computers that requested full zip (thanks to Arjun2228)

use [sem5]
select SEM_COMPUTER.COMPUTER_NAME,CONTENT_EVENTS.*
from CONTENT_EVENTS
INNER JOIN SEM_AGENT ON CONTENT_EVENTS.AGENT_ID = SEM_AGENT.AGENT_ID
INNER JOIN SEM_COMPUTER ON SEM_AGENT.COMPUTER_ID = SEM_COMPUTER.COMPUTER_ID
where CONTENT_CATEGORY = 'AV_DEFS'AND CONTENT_NAME Like '%Definitions%'

Reputation Error Events (thanks to tknorr)

use [sem5]
 SELECT [USN]
       ,[DOMAIN_ID]
       ,[GROUP_ID]
       ,[COMPUTER_ID]
       ,[TIME_STAMP]
       ,[EVENT_TIME]
       ,[HOST_NAME]
       ,[EVENT_SOURCE]
       ,[EVENT_DESC]
       ,[SEVERITY]
       , dateadd(s,convert(bigint,[TIME_STAMP])/1000,' 01-01-1970 01:00:00') as [Calculated_Time_Stamp]
   FROM [sem5].[dbo].[AGENT_SYSTEM_LOG_1]
   Where EVENT_SOURCE like '%rep%' 
  and EVENT_DESC like '%408%' --Eventfilter (413,502,503,403,408)
   Group by
      [HOST_NAME]
      ,[USN]
       ,[DOMAIN_ID]
       ,[GROUP_ID]
       ,[COMPUTER_ID]
       ,[TIME_STAMP]
       ,[EVENT_TIME]
       ,[HOST_NAME]
       ,[EVENT_SOURCE]
       ,[EVENT_DESC]
       ,[SEVERITY]
   Order by TIME_STAMP Desc

Check the size of the stored content in GB (without client packages) in the database (thanks to greg12)

use [sem5]
SELECT SUM(DATALENGTH(CONTENT))/1024.0/1024/1024
  AS "content size (GB)" FROM BINARY_FILE
  WHERE TYPE='DownloadedContentFile'

List of Unmanaged Detectors (thanks to greg12)

use [sem5]
SELECT  CL.COMPUTER_NAME AS "Unmanaged Detector"
  , DD.DELETED
  , DD.IP_ADDRESS_TEXT
FROM V_LAN_DEVICE_DETECTED AS DD
INNER JOIN SEM_CLIENT AS CL ON DD.COMPUTER_ID = CL.COMPUTER_ID

Get the Domain ID & name of your Domains (thanks to Ian_C.)

use [sem5]
SELECT [ID]
      ,[TYPE]
      ,[DOMAIN_ID]
      ,[NAME]
      ,[DESCRIPTION]
FROM [SEM5].[dbo].[BASIC_METADATA]
WHERE [Type] = 'SemDomain'