QRadar®: Troubleshooting unknown and stored events in McAfee ePo v5.10

Troubleshooting

Problem

After integrated McAfee ePo v5.10 via TLS Syslog, many of the events are Unknown and have low-level category Stored.

How to identify supported McAfee EPO events
What if I receive a "McAfee ePolicy Orchestrator Unknown" event?
Unsupported event types

Symptom

Open the Log Activity tab and filter the log sources down to the McAfee ePo log source(s). If you see the events have the low-level category stored, this means that no parsing was done on the events, and some examination is required.

Diagnosing The Problem

How to identify supported McAfee EPO events

You will need to drill down into the events to see the actual payload. If you are viewing real-time events, then click the pause icon in the top-right corner to halt the real-time view. Double-click on any event to see properties and the payload.

Only events between tags <EPOEvent> </EPOEvent> are currently supported.

Sample payload (source: IBM Knowledge Center: McAfee ePolicy Orchestrator sample event messages)

<29>1 2018-06-29T10:53:33.0Z mcafee.epo.test EPOEvents - EventFwd [agentInfo@3401 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] <?xml version="1.0" encoding="UTF-8"?><EPOEvent><MachineInfo><MachineName>mcafee.epo.test</MachineName><AgentGUID>{890cc45c-7b89-11e8-1cd6-005056afc747}</AgentGUID> [---] </CustomFields></Event></SoftwareInfo></EPOEvent>

What if I receive a "McAfee ePolicy Orchestrator Unknown" event?

If the event does contain the correct, supported <EPOEvent> </EPOEvent> tags, then raise a case with IBM Support to have QID's created for them. Please include an event export in "XML, Full" format from QRadar Log Activity.
You can, of course, map the events manually in the DSM Editor as well. See step 2.
If the event does not contain the tags, then you can:
- Map the events yourself in the DSM Editor. Guide: IBM Knowledge Center: QRadar, event mapping
- If you think these events should be supported, raise a Request for Enhancement (RFE). Guide: QRadar: Request For Enhancements (RFE) and how to use them

Unsupported event types

Here are a few examples of unsupported event types. You will see these tags in the event payloads. These are referring to other McAfee products. Note: Some events containing these tags may still parse and get mapped seemingly correct.

<BehaviourBlockEvent>
<DLPAGENT_____> (DLP products)
<DCMoveEventData>
<EE_Event>
<HostIPS8>
<MSMERoot>
<PortBlockEvent>
<SCORData> (Solidcore)
<SCOREvent>
<SCORSoftware>
<UpdateEvents>

Related Information

McAfee products

Document Location

Worldwide

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt0AAA","label":"Log Source"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)"}]

Tips