cancel
Showing results for 
Search instead for 
Did you mean: 
wiz312
Level 7
Report Inappropriate Content
Message 1 of 2

Windows Event -> McAfee Event Correlation

Jump to solution

I'm getting started with ESM and running into issues with trying to find which McAfee "Signature ID" corresponds to a particular Windows Event ID.  Is there a place that I can put in a Windows Event ID (for example, 4609) and have it return which windows machines have been 'shut down'? 

Thanks

1 Solution

Accepted Solutions
Highlighted

Re: Windows Event -> McAfee Event Correlation

Jump to solution

If you click the filter funnel on "Signature ID", you will see there is a "Windows" tab.  Here you can enter the MS Windows Event ID, and then select what kind of log you are looking for (some event IDs get reused in multiple ways).  Generally you are probably looking for "Microsoft-Windows-Security-Auditing".  This will allow you to filter any view based on Windows Event ID.

Here's a post by Kara Cole with some screenshots for you:

https://community.mcafee.com/message/292677

Scott

1 Reply
Highlighted

Re: Windows Event -> McAfee Event Correlation

Jump to solution

If you click the filter funnel on "Signature ID", you will see there is a "Windows" tab.  Here you can enter the MS Windows Event ID, and then select what kind of log you are looking for (some event IDs get reused in multiple ways).  Generally you are probably looking for "Microsoft-Windows-Security-Auditing".  This will allow you to filter any view based on Windows Event ID.

Here's a post by Kara Cole with some screenshots for you:

https://community.mcafee.com/message/292677

Scott

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community