WMI - Tracking logs that show data source sent logs to SIEM

[Mayhaps]

Is there a Windows Event Number or a method to track when the data source sends logs to the SIEM via WMI? We are using a domain user to connect to the data source. I want to see when the data source communicates with the SIEM to send WMI logs, but from the data source perspective. Thank you in advance!

[pbpillai · Accepted solution]

If you are able to see events on the ESM from the datasource when you select the datasource & then do a Event drill down for the last 10 minutes or 1 hour that means we are parsing live logs collected from the WMI DS.

There is also another method by using the Receiver CLI.

On the ERC CLi execute teh following command:

tcpdump -nni eth0 host <WMI IP Address>

If the ERC is in a HA pair, please execute:

tcpdump -nni eth1 host <WMI IP Address>

You will see messages indicating communication between the ERC & the WMI datasource.

You can also go to the location

cd /var/log/data/inline/thirdparty.logs/<vipsid>/wmin/in

Execute 'ls -latr'.

This will show the raw logs being collected.

vipsid can be obtained by executing the below command:

tq | grep <WMI IP address>

Regards,

Prashanth B Pillai

McAfee Technical Support

Customer Success Group