Skip to main content
Skip table of contents

Create a Sample McAfee ePolicy Orchestrator (ePO) Event Log Source

LogRhythm utilizes its extensive knowledge of log formats from various vendors to process logs. Processing is based on LogRhythm rules which dictate is a log is elevated to an event or to an alarm. Because UDLA log collection users define the log format, the following sample should be used so that LogRhythm can process this UDLA log type. McAfee ePO has several components and modules that write events to various tables in the database. Tables can have single or multiple sources. Each table requires its own Log Source for collection. This example is for the Events table.

In order for the MPE Policy Processing rules provided by LogRhythm for McAfee ePO events to parse the logs correctly, use the following configuration making adjustments for the deployment environment.

Cutting-and-pasting the following Settings into a UDLA configuration in the LogRhythm Client Console may produce characters that are not supported by UDLA.

Parameter NameSetting
ODBC / OLE DBSelect ODBC connection.

Connection String

Driver={SQL Server};Server=myServer\myInstance;Database=myDBName;
Integrated Security=SSPI

Be sure to replace the variables myServer, myInstance, and myDBName with the appropriate settings for the current environment.

Query Statement

SELECT TOP <Max_Message_Count> AutoID, Counter, EventDateTime, ProductName,
ProductVersion, HostName, HostIPAddress, UserName, VirusName, TVDEventID, FileName, EngineVersion, DATVersion, ScanTime, ActionTaken, TVDSeverity, VirusType, TVDTaskName, ProductID, AgentGUID, NodeID, EventLocalDateTime, TheTimestamp, lVirusType, Source, DetectionName, ProcessName, ModuleName, APIName FROM Events

Output Format

<EventLocalDateTime> TVDEVENTID=<TVDEventID> TVDSEVERITY=<TVDSeverity> ACTIONTAKEN=<ActionTaken> VIRUSNAME=<VirusName> FILENAME=<FileName>
HOSTNAME=<HostName> HOSTIPADDRESS=<HostIPAddress> USERNAME=<UserName> SOURCE=<Source> ENGINEVERSION=<EngineVersion> DATVERSION=<DATVersion> SCANTIME=<ScanTime> VIRUSTYPE=<VirusType> TVDTASKNAME=<TVDTaskName> PRODUCTID=<ProductID> AGENTGUID=<AgentGUID> NODEID=<NodeID> LVIRUSTYPE=<lVirusType> PRODUCTNAME=<ProductName>
PRODUCTVERSION=<ProductVersion> DETECTIONNAME=<DetectionName>
PROCESSNAME=<ProcessName> MODULENAME=<ModuleName> APINAME=<APIName> AUTOID=<AutoID> COUNTER=<Counter> EVENDATETIME=<EventDateTime>
THETIMESTAMP=<TheTimestamp>

Unique Identifier Field

AutoID

Message Date Field

EventLocalDateTime

State Field Type

Increment

State Field

AutoID

State Field
Conversion

 

Get UTC Date Statement

SELECT GetUTCDate()

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.