Available on ESM Signature ID List

[Former Member]

Hello guys,

I would like to create some alarm, views, report. Problem is that not all system behaviors I can simulate.

Is there existing any list of all parsed by McAfee Messages? Specially Internal Messages generated by McAfee SIEM?

[alexander_h]

Actually there is a list of predefined alarms within ESM that are purely for internal events.

[Former Member]

Do you mean list from Policy Editor? Problem is those signatures are not normalize most important operations done on system.

An example:

Account creation/ change is there but account deletion not.

Would you be so kind and share this list or link to it, please?

[alexander_h]

Hi Michel,

Under the ESM settings on the alarms tab there are some alarms or you can create your own and filter based on events and devices.

[Former Member]

Hi Alexander,

Yup I know how to do it, problem is that I cannot see events which I need. An example is User has been deleted from any McAfee SIEM appliance. Such normalized event does not exist. ( or I cannot find it). Or a log source has been added to McAfee REC, deleted or modyfied etc... Those logs exist on Appliance log but not are parsed or I cannot find it. That's why I am asking for a List of all parsed messages from McAfee SIEM BOX.

[alexander_h]

Honestly there are some limitations i believe that not everything is logged.

[Former Member]

Yep Know that. I have  opened PER case for it.

[alexander_h]

Yeah that's probably the best

[Former Member]

Michal,

Firstly; your question on parsing.. the message parsed is dependent on the Device and the ASP applied to it.

Second; the link below is the KnowledgeBase for native SIEM "Health" rules..

These are "306" rules ie. SID: 306-500XX

McAfee KnowledgeBase - How to determine which rules/signature IDs are generated by the SIEM Health S...