Online manual migration- DBQueries folder is missing after extracting the Tech Support ZIP file
Symptom
When migrating from On Premises to Managed Services - step 2 asks to extract the TechSupport ZIP file which contains two zipped files (one for Core and one for Console).
Thereafter extract the Console ZIP file. Open the DBQueries folder and locate the Verdict_Override_Exports.csv file.
After doing this step, the DBQueries folder and the Verdict_Override_Exports.csv file are missing.
This can occur when following the steps in the online manual "Migrate from Traps Endpoint Security Manager to Traps Management Services" :
https://docs.paloaltonetworks.com/traps/tms/traps-management-service-admin/get-started-with-tms/migrate-esm-to-tms.html
Environment
Migrating from On Premises to TMS
Resolution
You can use "GetLogsUitlServer.exe" to generate the "Verdict_Override_Exports.csv" file.
You should be able to generate the file by executing the following command with "cmd.exe" running as "Administrator".
---
"%PROGRAMFILES%\Palo Alto Networks\Endpoint Security Manager\Server\GetLogsUtilServer.exe" "%PROGRAMFILES%\Palo Alto Networks\Endpoint Security Manager\Server"
---
The resulting file will be saved in "%PROGRAMFILES%\Palo Alto Networks\Endpoint Security Manager\Server" an will be named something like "TechSupport_Core_xxxxxxxx_xxxxxx_xxxxxxxx-xxxxx-xxxxx-xxxx-xxxxxxxxxxxxx.zip" and inside of it you should see a "DBQueries" folder with "Verdict_Override_Exports.csv" needed for the migration.
Please delete the entire zip file after you have extracted the necessary file.
=====================================================================
You can also connect to the DB and run this query below:
SELECT hv.Verdict, phd.Hash, pp.Name, phd.FileType FROM HashVerdicts as hv, ProcessHashesData as phd, ProtectedProcess as pp, ProcessHashes as ph WHERE hv.Source = 1 AND hv.ProcessHashData_id = phd.Id AND ph.ProcessHashData_Id = phd.Id AND ph.ProtectedProcess_Id = pp.Id and FirstApplied = (SELECT MAX(FirstApplied) FROM HashVerdicts hv2 WHERE hv.ProcessHashData_id = hv2.ProcessHashData_id)
You also need to copy the 'column headers' or manually insert them prior to importing to TMS.
You should be able to right click on the 'Results' pan and click on 'Save Result As' and save it as .csv.
Column headers should be: Verdict, Hash, Name, File Type.