locked
Malware Remediation Status Incorrect RRS feed

  • Question

  • We had malware detected and remediated in the last 24 hours but the "Malware remediated in the last 24 hours" status shows "0" clients. I check this status daily and use it to monitor clients and system health. Going into "Malware Detected" and it clearly shows 1 incident with 1 computer infected and 1 computer remediated within the last 24 hours. Why isn't the event being reported in "Malware Remediation status?" I have trusted the status display in the past, but if it's not reporting then there is an issue and SCCM's reporting tools cannot be considered reliable.
    Tuesday, October 21, 2014 2:53 PM

Answers

  • Hi,

    SCCM 2012 allows you run reports about SCEP information stored by SCCM, there are following report item you can try:

    Antimalware activity report
    Antimalware overall status and history
    Computer malware details
    Infected Computer
    Top users by threats
    User threat list

    If you get the empty result, please check if you used the correct collection when running above report.


    “Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.”

    • Proposed as answer by Garth JonesMVP Saturday, November 29, 2014 4:43 PM
    • Marked as answer by Garth JonesMVP Saturday, December 6, 2014 3:56 PM
    Friday, October 24, 2014 7:44 AM

All replies

  • Hi,

    SCCM 2012 allows you run reports about SCEP information stored by SCCM, there are following report item you can try:

    Antimalware activity report
    Antimalware overall status and history
    Computer malware details
    Infected Computer
    Top users by threats
    User threat list

    If you get the empty result, please check if you used the correct collection when running above report.


    “Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.”

    • Proposed as answer by Garth JonesMVP Saturday, November 29, 2014 4:43 PM
    • Marked as answer by Garth JonesMVP Saturday, December 6, 2014 3:56 PM
    Friday, October 24, 2014 7:44 AM
  • Just check if any updates on above information.

    “Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.”

    Monday, October 27, 2014 1:38 AM
  • Hello,

    We've not heard from you. I assume that the information provided by Kevin has helped, so I am marking the reply as the answer.

    In case you have further questions, please do let us know. Thanks.

    Regards,
    Bennie Chen

    Tuesday, November 4, 2014 2:14 AM