Create a Sample McAfee ePolicy Orchestrator (ePO) Event Log Source

LogRhythm utilizes its extensive knowledge of log formats from various vendors to process logs. Processing is based on LogRhythm rules which dictate is a log is elevated to an event or to an alarm. Because UDLA log collection users define the log format, the following sample should be used so that LogRhythm can process this UDLA log type. McAfee ePO has several components and modules that write events to various tables in the database. Tables can have single or multiple sources. Each table requires its own Log Source for collection. This example is for the Events table.

In order for the MPE Policy Processing rules provided by LogRhythm for McAfee ePO events to parse the logs correctly, use the following configuration making adjustments for the deployment environment.

Cutting-and-pasting the following Settings into a UDLA configuration in the LogRhythm Client Console may produce characters that are not supported by UDLA.

Parameter Name	Setting
ODBC / OLE DB	Select ODBC connection.
Connection String	Driver={SQL Server};Server=myServer\myInstance;Database=myDBName; Integrated Security=SSPI Be sure to replace the variables myServer, myInstance, and myDBName with the appropriate settings for the current environment.
Query Statement	SELECT TOP <Max_Message_Count> AutoID, Counter, EventDateTime, ProductName, ProductVersion, HostName, HostIPAddress, UserName, VirusName, TVDEventID, FileName, EngineVersion, DATVersion, ScanTime, ActionTaken, TVDSeverity, VirusType, TVDTaskName, ProductID, AgentGUID, NodeID, EventLocalDateTime, TheTimestamp, lVirusType, Source, DetectionName, ProcessName, ModuleName, APIName FROM Events
Output Format	<EventLocalDateTime> TVDEVENTID=<TVDEventID> TVDSEVERITY=<TVDSeverity> ACTIONTAKEN=<ActionTaken> VIRUSNAME=<VirusName> FILENAME=<FileName> HOSTNAME=<HostName> HOSTIPADDRESS=<HostIPAddress> USERNAME=<UserName> SOURCE=<Source> ENGINEVERSION=<EngineVersion> DATVERSION=<DATVersion> SCANTIME=<ScanTime> VIRUSTYPE=<VirusType> TVDTASKNAME=<TVDTaskName> PRODUCTID=<ProductID> AGENTGUID=<AgentGUID> NODEID=<NodeID> LVIRUSTYPE=<lVirusType> PRODUCTNAME=<ProductName> PRODUCTVERSION=<ProductVersion> DETECTIONNAME=<DetectionName> PROCESSNAME=<ProcessName> MODULENAME=<ModuleName> APINAME=<APIName> AUTOID=<AutoID> COUNTER=<Counter> EVENDATETIME=<EventDateTime> THETIMESTAMP=<TheTimestamp>
Unique Identifier Field	AutoID
Message Date Field	EventLocalDateTime
State Field Type	Increment
State Field	AutoID
State Field Conversion
Get UTC Date Statement	SELECT GetUTCDate()