Welcome Serena Central users! CLICK HERE
The migration of the Serena Central community is currently underway. Be sure to read THIS MESSAGE to get your new login set up to access your account.
MaryCordova Frequent Contributor.
Frequent Contributor.

Re: P-McAfee_ePO_1.0.0.2.arb

Woot!  Successful install of package

Thanks Prentice!

0 Likes
MaryCordova Frequent Contributor.
Frequent Contributor.

Re: P-McAfee_ePO_1.0.0.2.arb

Is there supposed to be a parser override for this?

0 Likes
MaryCordova Frequent Contributor.
Frequent Contributor.

Re: P-McAfee_ePO_1.0.0.2.arb

- can you send me the parser override for this?

0 Likes
prentice@hpe.co Honored Contributor.
Honored Contributor.

Re: P-McAfee_ePO_1.0.0.2.arb

Hey,

I don't think there is a parser override for this. Perhaps knows, but I think if there was one, he would have posted it.

0 Likes
MaryCordova Frequent Contributor.
Frequent Contributor.

Re: P-McAfee_ePO_1.0.0.2.arb

So I believe there is definitely supposed to be a parser override.  Below is a screenshot from the wiki documentation:

mcafee_wiki.PNG

Also, parsed events don't contain a target or attacker hostname but the raw events have that information in their schema as agenthostname.  Raw events also have the username which is not available in parsed events as well as some other pieces of data. 

/ / do any of you have this parser?

0 Likes
deathbywedgie1 Frequent Contributor.
Frequent Contributor.

Re: P-McAfee_ePO_1.0.0.2.arb

Sorry, that one isn't ringing a bell at the moment.

0 Likes
MaryCordova Frequent Contributor.
Frequent Contributor.

Re: P-McAfee_ePO_1.0.0.2.arb

/ deathbywedgie / chrisb / awmorris

OMG...the parser is attached to the WIKI...THAT IS A LINK!!!

<sorry lol>

mcafee_parser_omg.PNG

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.