log forwarding

[jaklsdjfalsdfj]

I have a requirement to send logs to our SIEM (RSA NetWitness). . After setting up a REGISTERED SYSLOG server, I am currently seeing the following on my SIEM: . Windows Security Logs Windows Event Logs . We are not seeing other McAfee-related events. . I followed the steps in the guide, but there is one section that seems unclear to me . I will upload a screen cap - for your review . the documentation states the following: . After you register the syslog server, (which has been completed successfully) you can set McAfee ePO to send events to your syslog server (what are the steps to set McAfee ePO to send events?) . Please advise on next steps

[cdinet]

In event filtering under server settings, you have to choose the event ID's you want sent to the syslog server - choose send to syslog and database so that if syslog fails for any reason, you still have them in epo.  You also need to ensure the syslog meets all the tls requirements.  See KB91194.

[jaklsdjfalsdfj]

no - same situation

[cdinet]

To see the windows event logs, you must be using the siem collector on the clients.  EPO never receives windows events from clients, only what the point products and agents generate.

When you registered the syslog server in epo, does the test connection succeed, fail, or show 3 dots?

Have you enabled the events to be forwarded to syslog in the server settings, event filtering?

What does eventparser log show in relation to the syslog - any errors sending events to syslog?  That is located in epo install directory under db\logs.

[jaklsdjfalsdfj]

registering the syslog server in epo, does the test connection succeed, fail, or show 3 dots? - SUCCEEDS

.

Have you enabled the events to be forwarded to syslog in the server settings, event filtering?

-when setting up the Registered Syslog Server, the checkbox for ENABLE EVENT FORWARDING is checked - yes

What does eventparser log show in relation to the syslog - any errors sending events to syslog?  That is located in epo install directory under db\logs.

-Event Parser (EVNTPRSR) shows the following:
reload syslog forwarder event received

Syslog received new syslog list signal

Loading syslog receiver list

Found 10.x.x.x:6514

Loaded 1 receivers

Succeeded <UpdateEvents>, C:\PROGRA~\McAfee\EPOLIC~1\DB\Events\NNNN-NNNN-NNNN-NNNN-mc-20211104xxxx.txml

[jaklsdjfalsdfj]

There is also the following entries:

Succeeded <EPOEvent>, C:\PROGRA, etc, etc, etc

[cdinet]

So there are no errors in eventparser regarding the syslog server?  

In server settings, event filtering, do you have the event id's checked that you want to see events for for send to both?  

[jaklsdjfalsdfj]

So there are no errors in eventparser regarding the syslog server? - CORRECT - no errors

In server settings, event filtering, do you have the event id's checked that you want to see events for for send to both? - YES we have dozens of events checked - and it is set to "STORE IN BOTH"
.
FYI - we have the same exact EVENTS selected - for both the US (existing) and EU (newly setup) SIEM
.
according to my colleagues - they say we are getting "everything" on the US SIEM, but only windows events and windows logs - from the EU
.
they are asking us to troubleshoot why there are no ePO events, etc showing up.

[cdinet]

Please open a ticket then with McAfee.  If you run a query in epo for threat events in last day or 2, are there any?

[jaklsdjfalsdfj]

In the Threat Event Log - I see the following entries - from today
.
Event ID - 1119
event description - The update failed, see event log (lots of these)
.
Event ID - 1095
event description - Access Protection rule violation detected (a couple of these)
.
1464 items total