I am investigating an (apparently authoritative) claim that "by design" ESM cannot produce a detailed parse of ePO events for forwarding to an external system.
e.g. consider a Malware alert event (576-1290). ePO provides fields "Target Hash", "Target Path", "Target File Size (Bytes)" and others which do not seem to be present in the ESM event.
Unfortunately I do not have access into the originating ePO/ESM ecosystem to validate, however having dealt with a number of top-tier SIEM/Logging products over the years (albeit not ESM/Nitro specifically), I am finding this advice somewhat dubious. Calling out to the community to get an expert position around the voracity of these claims.
Please feel free to reach out if you require further detail (versions, etc.)
Thanks in advance.