What do your event types look like in EPO?
We use the epo connector in addition to the onaccess and scan connectors for each agent node. The updates generally log any DAT updates where the epo connector will log more system type events such as attempted agent uninstalls..etc.
Here is what our filter and appliance connector look like:
My ePO events look a little different, but I duplicated the server and workstation ones that currently send us an email alert and just changed the notification to SNMP.
My appliance connector looks the same, except my Tool Version is different.
I did not have a filter built, I was using the pre-built SNMP Traffic just to see if there was traffic there and didn't see any traffic. I have created the filter to see if that gives me what I am looking for.