1 Reply Latest reply on Oct 28, 2013 11:42 AM by Scott Taschler

    Windows Event -> McAfee Event Correlation

    wiz312

      I'm getting started with ESM and running into issues with trying to find which McAfee "Signature ID" corresponds to a particular Windows Event ID.  Is there a place that I can put in a Windows Event ID (for example, 4609) and have it return which windows machines have been 'shut down'? 

       

      Thanks