The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Press CTRL+K to open search

Run query with XML data best practice

  • Published on Sep 7, 2026
  • 2 minute(s) read
Prev Next

Exporting existing query XML definitions is a great way to learn how to create web URL queries.

In this example, export the "VSE: DAT Deployment XML" definition file and use those table objects to create a list of the Threat Prevention DAT file versions for each system in your network.

  1. Export the existing query definition XML file and open it in a text editor.

    Your export files look similar to this VSE: DAT Deployment XML definition file.

    <list>
  <query>
    <dictionary/>
    <name>VSE: DAT Deployment</name>
    <description>Displays the three highest DAT versions, and a slice for all the other versions.</description>
    <target>EPOLeafNode</target>
    <table-uri>query:table?orion.table.columns=EPOComputerProperties.ComputerName%3AEPOComputerProperties.DomainName%3AEPOLeafNode.os%3AEPOComputerProperties.Description%3AEPOLeafNode.Tags%3AEPOProdPropsView_VIRUSCAN.productversion%3AEPOProdPropsView_VIRUSCAN.hotfix%3AEPOProdPropsView_VIRUSCAN.servicepack%3AEPOProdPropsView_VIRUSCAN.enginever%3AEPOProdPropsView_VIRUSCAN.enginever64%3AEPOProdPropsView_VIRUSCAN.datver%3AEPOLeafNode.LastUpdate&amp;orion.table.order.by=EPOComputerProperties.ComputerName%3AEPOComputerProperties.DomainName%3AEPOLeafNode.os%3AEPOComputerProperties.Description%3AEPOLeafNode.Tags%3AEPOProdPropsView_VIRUSCAN.productversion%3AEPOProdPropsView_VIRUSCAN.hotfix%3AEPOProdPropsView_VIRUSCAN.servicepack%3AEPOProdPropsView_VIRUSCAN.enginever%3AEPOProdPropsView_VIRUSCAN.enginever64%3AEPOProdPropsView_VIRUSCAN.datver%3AEPOLeafNode.LastUpdate&amp;orion.table.order=az</table-uri>
    <condition-uri>query:condition?orion.condition.sexp=%28+where+%28+version_ge+EPOProdPropsView_VIRUSCAN.productversion+%228%22+%29+%29</condition-uri>
    <summary-uri>query:summary?pie.slice.title=EPOProdPropsView_VIRUSCAN.datver&amp;pie.count.title=EPOLeafNode&amp;orion.query.type=pie.pie&amp;orion.sum.query=true&amp;orion.sum.group.by=EPOProdPropsView_VIRUSCAN.datver&amp;orion.sum.order=desc&amp;orion.show.other=true&amp;orion.sum.aggregation=count&amp;orion.sum.aggregation.showTotal=true</summary-uri>
  </query>
</list>

  2. Open an existing web URL query file to use as a template, then save it with a new name. For example, URL_template.

    Following is an example of an existing web URL template file.

    https://<localHost>:8443/remote/core.executeQuery?
target=<tableTarget>&
select=(select <tableObjectNames>)

  3. From the query definition XML file, find the query target listed between the target tags.

    For example, <target>EPOLeafNode</target> and paste the target table name in target= of your template URL.

    This is the template the URL with the target table name added.

    https://<localHost>:8443/remote/core.executeQuery?
target=EPOLeafNode&
select=(select <tableObjectNames>)

  4. From the query definition XML file, find the S-Expression function, listed between the opening and closing <condition-uri> ... </condition-uri> tags, then perform these steps:

    1. In the URL template file, paste the object names in the select=(select parameter and the closing parenthesis. This example adds the EPOLeafNode.NodeName (system name) and EPOProdPropsView_VIRUSCAN.datver (VirusScan Enterprise DAT version) from the EPOLeafNode (System Tree) table.

      https://<localHost>:8443/remote/core.executeQuery?
target=EPOLeafNode&
select=(select EPOLeafNode.NodeName EPOProdPropsView_VIRUSCAN.datver)

    2. Add the sort order function. For example, to sort the output by system name, add the string "& order=(order(desc EPOProdPropsView_VIRUSCAN.datver)" in the existing S-Expression.

      The following example sorts the output by the Threat Prevention DAT version.

      https://<localHost>:8443/remote/core.executeQuery?
target=EPOLeafNode&
select=(select EPOLeafNode.NodeName EPOProdPropsView_VIRUSCAN.datver&
order=(order(asc EPOProdPropsView_VIRUSCAN.datver))

  5. Replace the <localHost> variable with your ePO - On-prem server DNS name, or IP address and paste the URL in your browser address bar. Your output should be similar to this output, but with many entries.

    OK:
System Name: DP-2K12R2S-SRVR
DAT Version (VirusScan Enterprise): 

System Name: DP-EN-W7E1XP-2
DAT Version (VirusScan Enterprise): 

System Name: DP-W7PIP-2
DAT Version (VirusScan Enterprise): 7429.0000

System Name: DP-W7PIP-1
DAT Version (VirusScan Enterprise): 7437.0000
.
.
.

  6. (Optional) To have the information appear in table format, paste the string :output=terse& before any ampersand in the URL and rerun the command. This is an example of your template file with :output=terse& added.

    https://<localHost>:8443/remote/core.executeQuery?target=EPOLeafNode&:output=terse&select=(select EPOLeafNode.NodeName EPOProdPropsView_VIRUSCAN.datver)&
order=(order(desc EPOLeafNode.NodeName))

    Confirm that your output is similar to the following example.

    OK:
System Name     DAT Version (VirusScan Enterprise)
--------------- ----------------------------------
DP-2K12R2S-SRVR                                   
DP-EN-W7E1XP-2                                    
DP-W7PIP-2      7429.0000                         
DP-W7PIP-1      7437.0000                         
DP-2K8AGTHDLR   7437.0000                         
DP-2K8ER2EPO510 7465.0000                         
DP-W7PIP-3      7465.0000 
.
.
.  

You have created a web URL query using the information exported from an existing XML query definition.