cancel
Showing results for 
Search instead for 
Did you mean: 
anhp
Level 7
Report Inappropriate Content
Message 1 of 5

How to add SCCM as Data Source in McAfee ESM

Hi guys,

I'm trying to add SCCM as a data source into McAfee ESM. I'm not talking about WMI logs of the server that the management console is sitting on, but rather the actual event logs generated by SCCM operations. I'm guessing I need to use the SIEM Collector as the liason to collect the logs and send them off to the server but I can't figure out how to add the data source in the SIEM. Can anybody help?

Thanks,

Anh Pham

4 Replies
Reliable Contributor exbrit
Reliable Contributor
Report Inappropriate Content
Message 2 of 5

Re: How to add SCCM as Data Source in McAfee ESM

Moved to SIEM for faster handling.

---

Peter

Moderator

Reliable Contributor sssyyy
Reliable Contributor
Report Inappropriate Content
Message 3 of 5

Re: How to add SCCM as Data Source in McAfee ESM

Can't you connect the receiver to the SCCM Database and read the tables?

anhp
Level 7
Report Inappropriate Content
Message 4 of 5

Re: How to add SCCM as Data Source in McAfee ESM

How do I do that? Use the SIEM collector?

Reliable Contributor sssyyy
Reliable Contributor
Report Inappropriate Content
Message 5 of 5

Re: How to add SCCM as Data Source in McAfee ESM

Yep for flat files. and use the SQL utility to read DB tables.

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator