Live Query
Live Query is a new EPS feature that is part of other Seqrite product Endpoint Detection & Response (EDR). With Live Query, you can ask questions of endpoints in real-time and identify areas for improving security.
This feature is only available to customers with the following licenses.
- EPS Server 8.2 onwards only.
- EDR
Supported Platforms
- EPS 8.2 is available only on Ubuntu 22.
- EDR – Windows 64-bit client only, Win 7 and above
To run live query, do the following steps.
Step 1 : Download EDR Setup on EPS Console
Step 2: On Oracle VM VirtualBox, fresh install MISP and Live Query server
Step 3: Configure Live Query Server on EPS console
Step 4: Run live query on EPS console
Step 1 : Download EDR Setup on EPS Console
- Log on to the SEQRITE Endpoint Security.
- Go to EDR > Live Query.
- When you open this page for the first time, as Live Query Settings are not configured, you see the message about configuring Live Query Settings. Click Configure Live Query Settings.
- You are redirected to the Configurations > EDR page. Click Download EDR setup.
Step 2: On Oracle VM VirtualBox, fresh install MISP and Live Query server
For the fresh installation of MISP and Live Query server procedure, see EDR OVA Deployment.
Step 3: Configure Live Query Server on EPS console
After MISP and Live Query server are installed successfully, to configure Live Query server, follow these steps.
- Go to Configurations > EDR.
- Select the Enable Live Query check box .
- Enter host name in the Server text box.
- Enter Port number. By default, the value is 6443. You can change the port number if required.
- To test the Live Query server connection, click Test connection.
- After successful verification, click Apply.
The Live Query server is configured.
Note
After configuring and applying the Live Query server settings, the Live query server installation starts for available machines. If installation fails, you will receive ‘Live Query Installation failed’ notification.
Repeat Test Connection step and apply again to retry the installation.