Design question: Parsing and forwarding detailed ePO events
I am investigating an (apparently authoritative) claim that "by design" ESM cannot produce a detailed parse of ePO events for forwarding to an external system.
e.g. consider a Malware alert event (576-1290). ePO provides fields "Target Hash", "Target Path", "Target File Size (Bytes)" and others which do not seem to be present in the ESM event.
Unfortunately I do not have access into the originating ePO/ESM ecosystem to validate, however having dealt with a number of top-tier SIEM/Logging products over the years (albeit not ESM/Nitro specifically), I am finding this advice somewhat dubious. Calling out to the community to get an expert position around the voracity of these claims.
Please feel free to reach out if you require further detail (versions, etc.)
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.
Community Help Hub
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.