cancel
Showing results for 
Search instead for 
Did you mean: 
sp00k
Level 7

Design question: Parsing and forwarding detailed ePO events

I am investigating an (apparently authoritative) claim that "by design" ESM cannot produce a detailed parse of ePO events for forwarding to an external system.

e.g. consider a Malware alert event (576-1290). ePO provides fields "Target Hash", "Target Path", "Target File Size (Bytes)" and others which do not seem to be present in the ESM event.

Unfortunately I do not have access into the originating ePO/ESM ecosystem to validate, however having dealt with a number of top-tier SIEM/Logging products over the years (albeit not ESM/Nitro specifically), I am finding this advice somewhat dubious. Calling out to the community to get an expert position around the voracity of these claims.

Please feel free to reach out if you require further detail (versions, etc.)

Thanks in advance.

0 Kudos