Sticky: SIEM Custom rules sharing

[jal]

Share your custom parser regex in comments

Tips:

• How to submit a ESM parser PER McAfee_ESM_Parser_Request_Checklist.pdf
• How to write a McAfee custom parser : https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/24000/PD24926/en_US/...
• McAfee KnowledgeBase - How to create custom parsing rules ASP Parser

How to export a rule:

[jal]

And don't forget to upvote

[jal]

Nice sharing from

[jal]

Another one from

[jal]

and another one

[jal]

some feedback from from his blog https://mecstuff.wordpress.com/

Symantec parsing rules improvments Replacement Symantec Endpoint ASP Parser rules for McAfee/Nitro SIEM | Mec's Place

Checkpoint parsing rules improvments Replacement Checkpoint ASP Parser rules for McAfee/Nitro SIEM | Mec's Place

Citrix XenServer rules Citrix Xenserver XenCenter RBAC logging for Mcafee/Nitro SIEM | Mec's Place

[jal]

Python script to test your custom parsing rules

see the last comment

[jal]

Some ESET regex from

[davidi]

Hello,

Why does not McAfee just update Check Point related rules and send it as an update?