All Apps and Add-ons

TA-Mcafee 2.1.3 does not support latest version of McAfee EPO

jandre01
Splunk Employee
Splunk Employee

We are sending McAfee logs from ePO DB using the documentation provided with the TA and DB connect (since 1 year)
http://docs.splunk.com/Documentation/AddOns/released/McAfeeEPO/ConfigureDBConnectv2inputs

But we notice that only the old mcafee client (Virus Scan) has correct logs in splunk, when it is the current client (EndPoint Security), data in splunk are not useful because crucial fields like file_name is empty (it is the file name of the threat)
From ePo console we can see that is it now Target Path + Target Name but not present.

Tags (1)
0 Karma
1 Solution

wandre_splunk
Splunk Employee
Splunk Employee

McAfee has modified the db schema in its latest release of EPO. There's a new table called EPExtendedEventMT and the syntax for the changes to your SQL statement in DB Connect needs to be as follows:
[EPExtendedEventMT].[field_to_be_retrieved] as [desired_field_name_in_Splunk]

We expect these changes to be supported in a future release of our TA. For now, follow the steps below.

In order to capture the process name which has now been moved to a new table in the latest version , the query needs to be modified as follow.

Replace
[EPOEvents].[SourceProcessName] as [process]
With
[EPExtendedEventMT].[TargetName] as [process]

After FROM [EOPEvents]
Add
left join [EPExtendedEventMT] on
[EPOEvents].[AutoID] = [EPExtendedEventMT].[EventAutoID]

View solution in original post

0 Karma

wandre_splunk
Splunk Employee
Splunk Employee

McAfee has modified the db schema in its latest release of EPO. There's a new table called EPExtendedEventMT and the syntax for the changes to your SQL statement in DB Connect needs to be as follows:
[EPExtendedEventMT].[field_to_be_retrieved] as [desired_field_name_in_Splunk]

We expect these changes to be supported in a future release of our TA. For now, follow the steps below.

In order to capture the process name which has now been moved to a new table in the latest version , the query needs to be modified as follow.

Replace
[EPOEvents].[SourceProcessName] as [process]
With
[EPExtendedEventMT].[TargetName] as [process]

After FROM [EOPEvents]
Add
left join [EPExtendedEventMT] on
[EPOEvents].[AutoID] = [EPExtendedEventMT].[EventAutoID]

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...