通过SEPM控制台可以直接查询到客户端风险日志(Risk Logs),查询到的结果如下:
但是直接在SEPM的数据库 SQL Server查询相应的 客户端风险日志的SQL语句是怎么样的?
具体查询语句如下:
select TOP 20
A.Idx,
HP.APP_NAME,
HA.WEB_DOMAIN,
HA.WHITELIST_REASON as user_override,
Alert_Idx,
COMPUTER_NAME,
USER_NAME,
A.Parentserver_Idx,
P.NAME as Parentserver,
S.NAME as Domainname,
V.VIRUSNAME, V.TYPE,
NoOfViruses,
A.Servergroup_Idx,
A.Actualaction_Idx,
Source,
convert (varchar, Alertdatetime, 120) as Alertdatetime1,
convert (varchar, Alertinserttime, 120) as Alertinserttime1,
Filepath,
HP.HASH_TYPE as hash_type,
V.DYNAUBER,
SA.R_OS_TYPE as R_OS_TYPE,
A.STATUS
from alerts as A with (NOLOCK)
LEFT OUTER JOIN HPP_ALERTS HA with (NOLOCK) ON HA.IDX=A.IDX
INNER JOIN v_virus as V with (NOLOCK) on A.VIRUSNAME_IDX =