EVID 20835 : McAfee ePO App Control Messages

Vendor Documentation

Rule Name	Rule Type	Common Event	Classification
EVID 20835 : McAfee ePO App Control Messages	Base Rule	General Information Log Message	Information

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
Machinename	<dname>	Text/String	Name of the system hosting the detecting product.
AgentGUID	N/A	N/A	Unique identifier of the agent that forwarded the event.
IPAddress	<dip>	IP Address	IP address of the system hosting the detecting product (if given in the event).
OSName	N/A	N/A	N/A
UserName	<account> <domainimpacted>	Text/String	N/A
TimeZoneBias	N/A	N/A	N/A
RawMACAddress	<dmac>	Text/String/Number	MAC address of the system hosting the detecting product.
ProductName	<vendorinfo>	Text/String	Name of the detecting managed product.
ProductVersion	<version>	Text/String/Number	Version number of the detecting product.
ProductFamily	N/A	N/A	N/A
EventID	<vmid>	Number	Unique identifier of the event class.
Severity	<severity>	Text/String/Number	N/A
GMTTime	N/A	N/A	N/A
SCORevent_name	<action>	Text/String	N/A
SCORevt_id	N/A	N/A	N/A
SCORevt_type	N/A	N/A	N/A
ECORevt_sink	N/A	N/A	N/A
SCORseq_no	N/A	N/A	N/A
SCORtime_stamp	N/A	N/A	N/A
SCORserver_state	N/A	N/A	N/A
SCORprocess_name	<process>	Text/String	N/A
SXCORprocess_id	<processid>	Text/String/Number	N/A
SCORuser_name	<domainorigin> <login>	Text/String	N/A
SCORworkflow	N/A	N/A	N/A
SCORfile_name	<object>	Text/String	N/A
SCORparent_process_name	<parentprocesspath> <parentprocessname>	Text/String	N/A
SCORcmd_line	<command>	Text/String	N/A
SCORcomment	N/A	N/A	N/A
SCORfile_sha1	<hash>	Text/String/Number	N/A
SCORfile_md5	N/A	N/A	N/A
SCORfile_sha256	N/A	N/A	N/A