Strange format when events are being forwarded from McAfee ePo to SIEM

[sanba06c]

Hi there,

I forwarded logs from McAfee ePo to SIEM through SNMPv2 protocol. The log source showed successful events, but their format was so weird:

1.3.6.1.2.1.1.3.0=70 days, 2:30:24.68	1.3.6.1.6.3.1.1.4.1.0=1.3.6.1.4.1.3401.12.2.1.1.0.101	1.3.6.1.4.1.3401.12.2.1.1.5.2.20=12/02/20 08:10:59 UTC	1.3.6.1.4.1.3401.12.2.1.1.5.2.10=12/02/20 08:12:56 UTC	1.3.6.1.4.1.3401.12.2.1.1.5.2.80=10........

Please help.

Below is the screenshot:

[cdinet]

Please check kb's 72813, 90566 and 89607 to see if they help any.

[sanba06c]

@cdinet, I can't find those KBs. Can you give me the respective links?

[rackroyd]

Hi,

The first KB seems to have been recently retired, for the other two:

https://kc.mcafee.com/corporate/index?page=content&id=KB90566
https://kc.mcafee.com/corporate/index?page=content&id=KB89607

Hth,

[sanba06c]

@rackroyd, Thank you for your help! These KBs provide me with some useful information. However, I still can't solve my problem yet.

[rackroyd]

Hi,

Glad you found them useful.
Perhaps it's best you open a support case to discuss this in more detail if needed ?

Kind Regards, 

[sanba06c]

@rackroyd, I just opened a support ticket with McAfee. Thanks for your advice.