Try event ID 2401 instead.
Separately, turning off the event filter is a sure-fire way of losing free disk space on the Sql database. not advisable to leave it that way
do you have any idea in which table are 2401/2402 stored?
I believe this are 'server-side' events as opposed to clientside 1118-1119?
The relationship between events & DB tables is not necessarily simple.
If you are looking to query the data directly from the Database you should open a support case with McAfee to discuss the options.
far from my assumptions that relationship between tables is simple.
I'll get in touch soon with mcafee tier2.