Mcafee Epo Modeling Rule

Details

ID	`mcafee_epo_modeling_rule`
From Version	6.8.0
To Version	6.9.9
Tags	McafeeEpoModelingRules

Rules (XIF)

[MODEL: dataset = mcafee_epo_raw, model=Endpoint]
filter AnalyzerName = "McAfee Endpoint Security" or AnalyzerName = "Data Loss Prevention"
| alter XDM.Endpoint.event_timestamp = _time,
    XDM.Endpoint.original_event_id = to_string(ThreatEventID),
    XDM.Endpoint.threat.category = ThreatCategory,
    XDM.Endpoint.threat.severity = to_string(ThreatSeverity),
    XDM.Endpoint.threat.name = ThreatName,
    XDM.Endpoint.Actor.host.hostname = NodeName,
    XDM.Endpoint.Actor.host.device_id = ServerID,
    XDM.Endpoint.Target.host.ipv4_addresses = arraycreate(coalesce(TargetIPV4, 0)),
    XDM.Endpoint.Target.host.ipv6_addresses = arraycreate(coalesce(TargetIPV6, "")),
    XDM.Endpoint.Target.host.mac_addresses = arraycreate(coalesce(TargetMAC , "")),
    XDM.Endpoint.Target.agent.version = AnalyzerVersion,
    XDM.Endpoint.Observer.product = AnalyzerName;

Schema

`mcafee_epo_raw`

Field	Type	Array?
`AnalyzerName`	string	—
`AnalyzerVersion`	string	—
`NodeName`	string	—
`ServerID`	string	—
`ThreatCategory`	string	—
`ThreatEventID`	string	—
`ThreatName`	string	—
`ThreatSeverity`	string	—
`_raw_log`	datetime	—

Raw JSON

{
  "mcafee_epo_raw": {
    "_raw_log": {
      "type": "datetime",
      "is_array": false
    },
    "ThreatEventID": {
      "type": "string",
      "is_array": false
    },
    "ThreatCategory": {
      "type": "string",
      "is_array": false
    },
    "ThreatSeverity": {
      "type": "string",
      "is_array": false
    },
    "ThreatName": {
      "type": "string",
      "is_array": false
    },
    "NodeName": {
      "type": "string",
      "is_array": false
    },
    "ServerID": {
      "type": "string",
      "is_array": false
    },
    "AnalyzerVersion": {
      "type": "string",
      "is_array": false
    },
    "AnalyzerName": {
      "type": "string",
      "is_array": false
    }
  }
}