Mcafee Epo Modeling Rule

Modeling Rule

McAfee ePO

Details

IDMcafeeEpo_ModelingRule
From Version8.15.0
TagsMcafeeEpoModelingRules

Schema

mcafee_epo_raw

Field Type Array?
AgentGUID string
AnalyzerContentVersion string
AnalyzerHostName string
AnalyzerMAC string
AnalyzerName string
AnalyzerRuleName string
AnalyzerVersion string
AutoID int
FileMD5Hash string
IPAddress string
IPHostName string
NodeName string
OSPlatform string
OSType string
SourceFilePath string
SourceHostName string
SourceMAC string
SourceParentProcessName string
SourcePort int
SourceProcessHash string
SourceProcessName string
SourceUserName string
TargetFileName string
TargetHash string
TargetHostName string
TargetMAC string
TargetName string
TargetPath string
TargetPort int
TargetProcessName string
TargetSigned boolean
TargetSigner string
TargetURL string
TargetUserName string
ThreatActionTaken string
ThreatCategory string
ThreatEventID int
ThreatHandled boolean
ThreatName string
ThreatSeverity int
{
  "mcafee_epo_raw": {
    "AnalyzerContentVersion": {
      "type": "string",
      "is_array": false
    },
    "AgentGUID": {
      "type": "string",
      "is_array": false
    },
    "AnalyzerHostName": {
      "type": "string",
      "is_array": false
    },
    "AnalyzerMAC": {
      "type": "string",
      "is_array": false
    },
    "AnalyzerName": {
      "type": "string",
      "is_array": false
    },
    "AnalyzerRuleName": {
      "type": "string",
      "is_array": false
    },
    "AnalyzerVersion": {
      "type": "string",
      "is_array": false
    },
    "AutoID": {
      "type": "int",
      "is_array": false
    },
    "FileMD5Hash": {
      "type": "string",
      "is_array": false
    },
    "IPAddress": {
      "type": "string",
      "is_array": false
    },
    "IPHostName": {
      "type": "string",
      "is_array": false
    },
    "NodeName": {
      "type": "string",
      "is_array": false
    },
    "OSPlatform": {
      "type": "string",
      "is_array": false
    },
    "OSType": {
      "type": "string",
      "is_array": false
    },
    "SourceFilePath": {
      "type": "string",
      "is_array": false
    },
    "SourceHostName": {
      "type": "string",
      "is_array": false
    },
    "SourceMAC": {
      "type": "string",
      "is_array": false
    },
    "SourceParentProcessName": {
      "type": "string",
      "is_array": false
    },
    "SourcePort": {
      "type": "int",
      "is_array": false
    },
    "SourceProcessHash": {
      "type": "string",
      "is_array": false
    },
    "SourceProcessName": {
      "type": "string",
      "is_array": false
    },
    "SourceUserName": {
      "type": "string",
      "is_array": false
    },
    "TargetFileName": {
      "type": "string",
      "is_array": false
    },
    "TargetHash": {
      "type": "string",
      "is_array": false
    },
    "TargetHostName": {
      "type": "string",
      "is_array": false
    },
    "TargetMAC": {
      "type": "string",
      "is_array": false
    },
    "TargetName": {
      "type": "string",
      "is_array": false
    },
    "TargetPath": {
      "type": "string",
      "is_array": false
    },
    "TargetPort": {
      "type": "int",
      "is_array": false
    },
    "TargetProcessName": {
      "type": "string",
      "is_array": false
    },
    "TargetSigned": {
      "type": "boolean",
      "is_array": false
    },
    "TargetSigner": {
      "type": "string",
      "is_array": false
    },
    "TargetURL": {
      "type": "string",
      "is_array": false
    },
    "TargetUserName": {
      "type": "string",
      "is_array": false
    },
    "ThreatActionTaken": {
      "type": "string",
      "is_array": false
    },
    "ThreatCategory": {
      "type": "string",
      "is_array": false
    },
    "ThreatEventID": {
      "type": "int",
      "is_array": false
    },
    "ThreatHandled": {
      "type": "boolean",
      "is_array": false
    },
    "ThreatName": {
      "type": "string",
      "is_array": false
    },
    "ThreatSeverity": {
      "type": "int",
      "is_array": false
    }
  }
}