Page Comparison

Introduction

The tags beginning with av.mcafee identify events generated by McAfee ePO.

There are several methods of ingestion from McAfee ePO. Using the Devo relay is the first method. The second method is using the third-party tool Logstash.

Valid tags and data tables

The full tag must have 4 levels. The first two are fixed as av.mcafee The third level identifies the type of events sent, and the fourth level indicates the event subtype. 

These are the valid tags and corresponding data tables that will receive the parsers' data:

How is data sent to Devo?

McAfee ePO can be configured to synchronize with a Syslog server. You can take advantage of this to send the data to a Devo Relay and then forward it to Devo. According to McAfee documentation, their Syslog forwarding only supports TCP over TLS, so you would need to install Stunnel in your Devo Relay machine, create your certificates and configure Stunnel.

The Stunnel configuration must include the incoming port where the McAfee ePO will send the logs to the Stunnel, the outgoing port where the Stunnel will forward the decrypted logs to the Devo Relay, and the necessary certificates. For more information about Stunnel, you can check this Devo’s documentation page and the official Stunnel website.

Devo Relay rules

Logs generated by McAfee ePO must be sent to the Devo platform via the Devo Relay to secure communication. When your Devo Relay is receiving Syslog messages, through port 13006, the Relay will be able to forward these logs to the right Devo tables.See the required relay rules below:

Relay rule 1 - McAfee ePO

• Source Port →13006

• Source Data → ^.*ProductName=\"McAfee Agent\".*$

• Target Tag → av.mcafee.epo.agent

• Select the Stop Processing and Sent without syslog tag checkboxes

Relay rule 2 - McAfee Endpoint Security

• Source Port → 13006

• Source Data → ^.*ProductName=\"McAfee Endpoint Security\".*$

• Target Tag → av.mcafee.epo.endpointsecurity

• Select the Stop Processing and Sent without syslog tag checkboxes

Relay rule 3 - McAfee VirusScan

• Source Port →13006

• Source Data → ^.*ProductName=\"VirusScan Enterprise\".*$

• Target Tag → av.mcafee.epo.virusscan

• Select the Stop Processing and Sent without syslog tag checkboxes

Below is an extra rule if you want to send to a my.app table all logs that do not match the previous rules.

Relay rule 4 - McAfee others

• Source Port →13006

• Source Data → 

• Target Tag → my.app.mcafee.epo

• Select the Stop Processing and Sent without syslog tag checkboxes

Image Added

Image Added

Image Added

Image Added

Image Added

Image Added

Logstash method

Events generated by McAfee EPO Console are stored in its SQL database in a table named EPOEventsMT or EPOEvents. We can use Logstash to extract the events from the database using JDBC, apply the av.mcafee.epo.events tag to each event, then send them in syslog format to port 13000 on the Devo Relay. 

...

• Logstash requires a database user with read permissions on the EPO tables.

• Some database fields need to be converted from signed int to a varchar IP address. The following function can do this for you.

  Code Block

  CREATE FUNCTION [dbo].[IntegerToIPAddress] (@ipin int) RETURNS CHAR(15) AS BEGIN declare @o1 bigint, @o2 bigint, @o3 bigint, @o4 bigint; declare @ip bigint; -- This is the magic epo conversion size... set @ip = (CAST(@ipin as bigint) + 2147483647) + 1; SET @o1 = @ip / 16777216; SET @ip = @ip % 16777216; SET @o2 = @ip / 65536; SET @ip = @ip % 65536; SET @o3 = @ip / 256; SET @ip = @ip % 256; SET @o4 = @ip; RETURN CONVERT(VARCHAR(4), @o1) + '.' + CONVERT(VARCHAR(4), @o2) + '.' + CONVERT(VARCHAR(4), @o3) + '.' + CONVERT(VARCHAR(4), @o4) END

  
  

• Install Logstash on the same machine as the Devo Relay and download the logstash-output-syslog plugin.

• Download and decompress the Microsoft JDBC Driver 4.1 for SQL Server into the /var/lib/logstash directory on the Devo Relay machine.

Configure Logstash

Create the configuration file that will direct the extraction and sending of events in /etc/logstash/conf.d. For example, /etc/logstash/conf.d/epo-DevoRelay.conf.

The following configuration file is a model which will extract new events from the database using the JDBC driver every one minute and send them using the syslog plugin to port 1300 13000 on the Devo Relay. The parameters enclosed in angled brackets (<>) should be modified for your environment.

...

• Add the Logstash service to be started at bootup using this command:

  No Formatcode
  update-rc.d - f logstash defaults 50

  
  

• Finally, start the Logstash service:

  No Formatcode
  /etc/init.d/logstash start

  
  

...