McAfeeEpo Parsing Rule

Parsing Rule

McAfee ePO

Details

IDMcAfeeEpo Parsing Rule
From Version8.5.0

Source

McAfeeEpo.xif McAfeeEpo.yml
Download History Raw 
[INGEST:vendor="McAfee", product="ePO", target_dataset="mcafee_epo_raw" , no_hit=keep]
filter to_string(DetectedUTC) ~= "\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}(?:\.\d+)?"
| alter _time = parse_timestamp("%F %H:%M:%E*S", to_string(DetectedUTC));