0 Replies Latest reply on Mar 6, 2015 10:06 AM by suhaimi

    How can we check in the McAfee ESM tool that the Windows Events ID that was parsed correctly and map to McAfee ESM fields schema.

    suhaimi

      Hi All,

      How are you guys doing? Hope all good. I got another question to ask regarding McAfee ESM. How can we check and verify in the McAfee ESM tool that the Windows Events ID like 672 was parsed correctly and map to McAfee ESM fields schema. Can we see the mapping schema? This is important so that we can understand and can relate the information to the original Windows Event ID detail to confirm our finding is true. Really appreciate your help in advance. Thank you.

       

      Regards,

      Suhaimi

       

      672.gif