---
title: "av.mcafee"
canonical: "https://docs.devo.com/space/latest/94660322/av.mcafee"
format: markdown
---
> Macro (toc)

## Introduction

The tags beginning with** **`av.mcafee` identify events generated by <span style="color: #172b4d">[McAfee antivirus](https://www.mcafee.com/)</span> services.

## Valid tags and data tables

<span style="color: #282828">The full tag must have 4 levels. The first two are fixed as</span><span style="color: #282828">** **</span>`av.mcafee`<span style="color: #282828">. The third level identifies the type of events sent, and the fourth level indicates the event subtype.</span>

These are the valid tags and corresponding data tables that will receive the parsers' data:

| **Product / Service** | **Tags** | **Data tables** |
| --- | --- | --- |
| McAfee ePolicy Orchestrator (McAfee ePO) | `av.mcafee.epo.agent` | `av.mcafee.epo.agent` |
| `av.mcafee.epo.dlp` | `av.mcafee.epo.dlp` |
| `av.mcafee.epo.endpointsecurity` | `av.mcafee.epo.endpointsecurity` |
| `av.mcafee.epo.events` | `av.mcafee.epo.events` |
| `av.mcafee.epo.threat` | `av.mcafee.epo.threat` |
| `av.mcafee.epo.virusscan` | `av.mcafee.epo.virusscan` |

For more information, read more [About Devo tags](https://docs.devo.com/space/latest/95126204).

## How is data sent to Devo?

McAfee ePO can be configured to [synchronize with a Syslog server](https://docs.mcafee.com/bundle/epolicy-orchestrator-5.10.0-product-guide/page/GUID-5C5332B3-837A-4DDA-BE5C-1513A230D90A.html). You can take advantage of this to send the data to a Devo Relay and then forward it to Devo. According to [McAfee documentation](https://kc.mcafee.com/corporate/index?page=content&id=KB91194), their Syslog forwarding only supports TCP over TLS, so you would need to [install Stunnel](#) in your Devo Relay machine, create your certificates and configure Stunnel. 

The Stunnel configuration must include the incoming port where the McAfee ePO will send the logs to the Stunnel, the outgoing port where the Stunnel will forward the decrypted logs to the Devo Relay, and the necessary certificates. For more information about Stunnel, you can check [this Devo’s documentation page](#) and [the official Stunnel website](https://www.stunnel.org/).

## Devo Relay rules

Logs generated by McAfee ePO must be sent to the Devo platform via the [Devo Relay](https://devodocs.atlassian.net/wiki/spaces/latest/pages/96468993) to secure communication. When your Devo Relay is receiving Syslog messages through port 13006, the relay will be able to forward these logs to the right Devo tables. See the required [relay rules](https://devodocs.atlassian.net/wiki/spaces/latest/pages/96469377) below:

### Relay rule 1 - McAfee ePO

---

### Relay rule 2 - McAfee Endpoint Security

---

### Relay rule 3 - McAfee VirusScan

---

### Relay rule 4 - McAfee others

## Logstash method

Events generated by McAfee EPO Console are stored in its SQL database in a table named **EPOEventsMT** or **EPOEvents**. We can use [Logstash ](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94658762)to extract the events from the database using JDBC, apply the `av.mcafee.epo.events` tag to each event, then send them in syslog format to port 13000 on the Devo Relay. 

Because Logstash saves the ID of the last record read in a dedicated file, each time the query is run only new records are retrieved and sent to Devo.

## Prerequisites

- Logstash requires a database user with read permissions on the EPO tables.
- Some database fields need to be converted from **signed int** to a **varchar IP address**. The following function can do this for you.
- Install Logstash on the same machine as the Devo Relay and download the<span style="color: #282828"> </span>[logstash-output-syslog](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-syslog.html)<span style="color: #282828"> plugin.</span>
- <span style="color: #282828">Download and decompress the </span><span style="color: #282828">[Microsoft JDBC Driver 4.1 for SQL Server](https://www.microsoft.com/en-us/download/details.aspx?id=54670)</span><span style="color: #282828"> into the </span>`/var/lib/logstash`<span style="color: #282828"> directory on the Devo Relay machine.</span>

## <span style="color: #000000">Configure Logstash</span>

Create the configuration file that will direct the extraction and sending of events in `/etc/logstash/conf.d`. For example, `/etc/logstash/conf.d/epo-DevoRelay.conf`.

The following configuration file is a model which will extract new events from the database using the JDBC driver every one minute and send them using the syslog plugin to port 13000 on the Devo Relay. The parameters enclosed in angled brackets (<>) should be modified for your environment.

```
input {
	jdbc {
        jdbc_driver_library => "/var/lib/logstash/sqljdbc_4.1/enu/sqljdbc41.jar"
        jdbc_driver_class => "com.microsoft.sqlserver.jdbc.SQLServerDriver"
        jdbc_connection_string => "jdbc:sqlserver://<ip_epo_server>\EPOSERVER:<port>;databaseName=<db_instance_name>"
        jdbc_user => "<username>"
        jdbc_password => "<password>"
        schedule => "* * * * *"   #each 1 minute
        use_column_value => true
        tracking_column => "autoid"
        last_run_metadata_path => "/var/lib/logstash/.logstash_jdbc_last_run"
        statement => "select autoid,AutoGUID,ServerID,CONVERT(varchar(24),DetectedUTC,120) as detectedUTC,dbo.IntegerToIPAddress(SourceIPV4) as SourceIP,dbo.IntegerToIPAddress(TargetIPV4) as TargetIP,TargetUserName,TargetFileName,SourceHostName,TargetHostName,ThreatCategory,ThreatEventID,ThreatSeverity,ThreatName,ThreatActionTaken,ThreatHandled from dbo.EPOEventsMT where autoid > :sql_last_value"
    }
}
# filter {
#
# }

output {
	syslog {
        facility => "local7"
        severity => "informational"
    	host => "localhost"
    	port => 13000 
        sourcehost => "<epo_server_name>"
    	appname => "av.mcafee.epo.events"
        protocol => "tcp"
        codec => line {
            format => "mcafeeEPO,%{autoid},%{autoguid},%{serverid},%{detectedutc},%{sourceip},%{targetip},%{targetusername},%{targetfilename},%{sourcehostname},%{targethostname},%{threatcategory},%{threateventid},%{threatseverity},%{threatname},%{threatactiontaken},%{threathandled}"
        }
	}
}
```

- Add the Logstash service to be started at bootup using this command:
- Finally, start the Logstash service:

Now you can confirm that the events are being correctly extracted and sent to Devo.

- Log in to the Devo web application and domain to which you are sending the EPO events.
- Open the finder in the **Data Search** area and locate the `av.mcafee.epo.events` table.

## Table structure

These are the fields displayed in these tables:

> Macro (rw-ui-tabs-macro)
> 
> > Macro (rw-tab)
> 
> - [av.mcafee.epo.agent](#tag1)
> - [av.mcafee.epo.dlp](#tag2)
> - [av.mcafee.epo.endpointsecurity](#tag3)
> 
> ### > Macro (anchor)
> 
> av.mcafee.epo.agent
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *EventReceivedTime* | `str` |  |
> | *tenantId* | `str` |  |
> | *bpsId* | `str` |  |
> | *tenantGUID* | `str` |  |
> | *tenantNodePath* | `str` |  |
> | *AgentGUID* | `str` |  |
> | *MachineName* | `str` |  |
> | *RawMACAddress* | `str` |  |
> | *IPAddress* | `ip4` |  |
> | *AgentVersion* | `str` |  |
> | *OSName* | `str` |  |
> | *TimeZoneBias* | `str` |  |
> | *UserName* | `str` |  |
> | *ProductName* | `str` |  |
> | *ProductVersion* | `str` |  |
> | *ProductFamily* | `str` |  |
> | *EventID* | `str` |  |
> | *Severity* | `str` |  |
> | *GMTTime* | `str` |  |
> | *ProductID* | `str` |  |
> | *Locale* | `str` |  |
> | *Error* | `str` |  |
> | *Type* | `str` |  |
> | *Version* | `str` |  |
> | *InitiatorID* | `str` |  |
> | *InitiatorType* | `str` |  |
> | *SiteName* | `str` |  |
> | *Description* | `str` |  |
> | *ThreatActionTaken* | `str` |  |
> | *ThreatName* | `str` |  |
> | *TargetHostName* | `str` |  |
> | *TargetUserName* | `str` |  |
> | *TargetFileName* | `str` |  |
> | *TargetName* | `str` |  |
> | *TaskName* | `str` |  |
> | *TargetPath* | `str` |  |
> | *TargetHash* | `str` |  |
> | *DataType* | `str` |  |
> | *CorrelationID* | `str` |  |
> | *CustomFields* | `str` |  |
> | *Data* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> av.mcafee.epo.dlp
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *machine* | `str` | *vmachine* |  |
> | *EventReceivedTime* | `str` |  |  |
> | *tenantId* | `str` |  |  |
> | *bpsId* | `str` |  |  |
> | *tenantGUID* | `str` |  |  |
> | *tenantNodePath* | `str` |  |  |
> | *AgentGUID* | `str` |  |  |
> | *MachineName* | `str` |  |  |
> | *RawMACAddress* | `str` |  |  |
> | *IPAddress* | `ip4` |  |  |
> | *AgentVersion* | `str` |  |  |
> | *OSName* | `str` |  |  |
> | *TimeZoneBias* | `str` |  |  |
> | *UserName* | `str` |  |  |
> | *ProductName* | `str` |  |  |
> | *ProductVersion* | `str` |  |  |
> | *ProductFamily* | `str` |  |  |
> | *EventID* | `str` |  |  |
> | *Severity* | `str` |  |  |
> | *GMTTime* | `str` |  |  |
> | *OPGData* | `str` |  |  |
> | *UserInfo* | `str` |  |  |
> | *ThreatName* | `str` |  |  |
> | *PolicyName* | `str` |  |  |
> | *TimeSZone* | `str` |  |  |
> | *rawMessage* | `str` |  | **✓** |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` |  | **✓** |
> 
> ### > Macro (anchor)
> 
> av.mcafee.epo.endpointsecurity
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *EventReceivedTime* | `str` |  |  |  |
> | *tenantId* | `str` |  |  |  |
> | *bpsId* | `str` |  |  |  |
> | *tenantGUID* | `str` |  |  |  |
> | *tenantNodePath* | `str` |  |  |  |
> | *AgentGUID* | `str` |  |  |  |
> | *MachineName* | `str` |  |  |  |
> | *RawMACAddress* | `str` |  |  |  |
> | *IPAddress* | `ip4` |  |  |  |
> | *AgentVersion* | `str` |  |  |  |
> | *OSName* | `str` |  |  |  |
> | *TimeZoneBias* | `str` |  |  |  |
> | *UserName* | `str` |  |  |  |
> | *ProductName* | `str` |  |  |  |
> | *ProductVersion* | `str` |  |  |  |
> | *ProductFamily* | `str` |  |  |  |
> | *ProductID* | `str` |  |  |  |
> | *EventID* | `str` |  |  |  |
> | *Severity* | `str` |  |  |  |
> | *GMTTime* | `str` |  |  |  |
> | *Locale* | `str` |  |  |  |
> | *Error* | `str` |  |  |  |
> | *Type* | `str` |  |  |  |
> | *Version* | `str` |  |  |  |
> | *InitiatorID* | `str` |  |  |  |
> | *InitiatorType* | `str` |  |  |  |
> | *SiteName* | `str` |  |  |  |
> | *Description* | `str` |  |  |  |
> | *Analyzer* | `str` |  |  |  |
> | *AnalyzerName* | `str` |  |  |  |
> | *AnalyzerVersion* | `str` |  |  |  |
> | *AnalyzerDetectionMethod* | `str` |  |  |  |
> | *AnalyzerHostName* | `str` |  |  |  |
> | *AnalyzerDATVersion* | `str` |  |  |  |
> | *AnalyzerEngineVersion* | `str` |  |  |  |
> | *AnalyzerMAC* | `str` |  |  |  |
> | *AnalyzerIPV4* | `ip4` | ```
> ip4(AnalyzerIPV4_int)
> ``` | *AnalyzerIPV4_int* |  |
> | *AnalyzerIPV6__type* | `str` |  |  |  |
> | *AnalyzerIPV6__data* | `str` |  |  |  |
> | *ThreatActionTaken* | `str` |  |  |  |
> | *ThreatEventID* | `str` |  |  |  |
> | *ThreatName* | `str` |  |  |  |
> | *ThreatType* | `str` |  |  |  |
> | *ThreatCategory* | `str` |  |  |  |
> | *ThreatHandled* | `str` |  |  |  |
> | *ThreatSeverity* | `str` |  |  |  |
> | *SourceHostName* | `str` |  |  |  |
> | *SourceUserName* | `str` |  |  |  |
> | *SourceProcessName* | `str` |  |  |  |
> | *SourceIPV4* | `ip4` | ```
> isnull(SourceIPV4_ipv4) ? ip4(SourceIPV4_int) : SourceIPV4_ipv4
> ``` | *SourceIPV4_int*<br>*SourceIPV4_ipv4* |  |
> | *SourceIPV6__type* | `str` |  | * * |  |
> | *SourceIPV6__data* | `str` |  | * * |  |
> | *SourceIPV6_ipv6* | `ip6` |  | * * |  |
> | *SourceMAC* | `str` |  | * * |  |
> | *SourceURL* | `str` |  | * * |  |
> | *TargetHostName* | `str` |  | * * |  |
> | *TargetUserName* | `str` |  | * * |  |
> | *TargetProcessName* | `str` |  | * * |  |
> | *TargetFileName* | `str` |  | * * |  |
> | *TargetName* | `str` |  | * * |  |
> | *TargetIPV4* | `ip4` | ```
> ip4(TargetIPV4_int)
> ``` | *TargetIPV4_int* |  |
> | *TargetIPV6__type* | `str` |  |  |  |
> | *TargetIPV6__data* | `str` |  |  |  |
> | *TargetMAC* | `str` |  |  |  |
> | *TargetPort* | `str` |  |  |  |
> | *TargetProtocol* | `str` |  |  |  |
> | *TaskName* | `str` |  |  |  |
> | *TargetPath* | `str` |  |  |  |
> | *TargetHash* | `str` |  |  |  |
> | *DataType* | `str` |  |  |  |
> | *CorrelationID* | `str` |  |  |  |
> | *CustomFields* | `str` |  |  |  |
> | *Data* | `str` |  |  |  |
> | *AutoID* | `str` |  |  |  |
> | *AutoGUID* | `str` |  |  |  |
> | *ServerID* | `str` |  |  |  |
> | *ReceivedUTC* | `timestamp` |  |  |  |
> | *DetectedUTC* | `timestamp` |  |  |  |
> | *TheTimestamp__type* | `str` |  |  |  |
> | *TheTimestamp__data* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *message* | `str` |  | *raw* |  |
> | *rawMessage* | `str` |  | *message* | **✓** |
> 
> > Macro (rw-tab)
> 
> - [av.mcafee.epo.events ](#tag4)
> - [av.mcafee.epo.threat ](#tag5)
> - [av.mcafee.epo.virusscan](#tag6)
> 
> ### > Macro (anchor)
> 
> av.mcafee.epo.events
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *machine* | `str` | *vmachine* |  |
> | *AutoID* | `int8` |  |  |
> | *AutoGUID* | `str` |  |  |
> | *ServerID* | `str` |  |  |
> | *DetectedUTC* | `timestamp` |  |  |
> | *SourceIP* | `ip4` |  |  |
> | *TargetIP* | `ip4` |  |  |
> | *TargetUserName* | `str` |  |  |
> | *TargetFileName* | `str` |  |  |
> | *SourceHostName* | `str` |  |  |
> | *TargetHostName* | `str` |  |  |
> | *ThreatCategory* | `str` |  |  |
> | *ThreatEventID* | `str` |  |  |
> | *ThreatSeverity* | `int4` |  |  |
> | *ThreatName* | `str` |  |  |
> | *ThreatActionTaken* | `str` |  |  |
> | *ThreatHandled* | `str` |  |  |
> | *rawMessage* | `str` |  | **✓** |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` |  | **✓** |
> 
> ### > Macro (anchor)
> 
> av.mcafee.epo.threat
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *machine* | `str` | *vmachine* |  |
> | *autoID* | `str` |  |  |
> | *autoGUID* | `str` |  |  |
> | *serverID* | `str` |  |  |
> | *receivedUTC* | `str` |  |  |
> | *detectedUTC* | `str` |  |  |
> | *agentGUID* | `str` |  |  |
> | *analyzer* | `str` |  |  |
> | *analyzerName* | `str` |  |  |
> | *analyzerVersion* | `str` |  |  |
> | *analyzerHostname* | `str` |  |  |
> | *analyzerIPv4* | `ip4` |  |  |
> | *analyzerIPv6* | `str` |  |  |
> | *analyzerMAC* | `str` |  |  |
> | *analyzerDATVersion* | `str` |  |  |
> | *analyzerEngineVersion* | `str` |  |  |
> | *analyzerDetectionMethod* | `str` |  |  |
> | *sourceHostname* | `str` |  |  |
> | *sourceIPv4* | `ip4` |  |  |
> | *sourceIPv6* | `str` |  |  |
> | *sourceMAC* | `str` |  |  |
> | *sourceUsername* | `str` |  |  |
> | *sourceProcessName* | `str` |  |  |
> | *sourceURL* | `str` |  |  |
> | *targetHostname* | `str` |  |  |
> | *targetIPv4* | `ip4` |  |  |
> | *targetIPv6* | `str` |  |  |
> | *targetMAC* | `str` |  |  |
> | *targetUsername* | `str` |  |  |
> | *targetPort* | `int4` |  |  |
> | *targetProtocol* | `str` |  |  |
> | *targetProcessName* | `str` |  |  |
> | *targetFilename* | `str` |  |  |
> | *threatCategory* | `str` |  |  |
> | *threatEventID* | `int8` |  |  |
> | *threatSeverity* | `str` |  |  |
> | *threatName* | `str` |  |  |
> | *threatType* | `str` |  |  |
> | *threatActionTaken* | `str` |  |  |
> | *threatHandled* | `bool` |  |  |
> | *osPlatform* | `str` |  |  |
> | *osType* | `str` |  |  |
> | *definedAt* | `str` |  |  |
> | *nodeTextPath* | `str` |  |  |
> | *eventDesc* | `str` |  |  |
> | *theTimestamp* | `str` |  |  |
> | *rawMessage* | `str` |  | **✓** |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` |  | **✓** |
> 
> ### > Macro (anchor)
> 
> av.mcafee.epo.virusscan
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *EventReceivedTime* | `str` |  |
> | *tenantId* | `str` |  |
> | *bpsId* | `str` |  |
> | *tenantGUID* | `str` |  |
> | *tenantNodePath* | `str` |  |
> | *AgentGUID* | `str` |  |
> | *MachineName* | `str` |  |
> | *RawMACAddress* | `str` |  |
> | *IPAddress* | `ip4` |  |
> | *AgentVersion* | `str` |  |
> | *OSName* | `str` |  |
> | *TimeZoneBias* | `str` |  |
> | *UserName* | `str` |  |
> | *ProductName* | `str` |  |
> | *ProductVersion* | `str` |  |
> | *ProductFamily* | `str` |  |
> | *EventID* | `str` |  |
> | *Severity* | `str` |  |
> | *GMTTime* | `str` |  |
> | *UTCTime* | `str` |  |
> | *ProductID* | `str` |  |
> | *Locale* | `str` |  |
> | *Error* | `str` |  |
> | *Type* | `str` |  |
> | *Version* | `str` |  |
> | *InitiatorID* | `str` |  |
> | *InitiatorType* | `str` |  |
> | *SiteName* | `str` |  |
> | *Description* | `str` |  |
> | *ThreatActionTaken* | `str` |  |
> | *ThreatName* | `str` |  |
> | *TargetHostName* | `str` |  |
> | *TargetUserName* | `str` |  |
> | *TargetFileName* | `str` |  |
> | *TargetName* | `str` |  |
> | *TaskName* | `str` |  |
> | *TargetPath* | `str` |  |
> | *TargetHash* | `str` |  |
> | *DataType* | `str` |  |
> | *CorrelationID* | `str` |  |
> | *CustomFields* | `str` |  |
> | *Data* | `str` |  |
> | *Analyzer* | `str` |  |
> | *AnalyzerName* | `str` |  |
> | *AnalyzerVersion* | `str` |  |
> | *AnalyzerDATVersion* | `str` |  |
> | *AnalyzerDetectionMethod* | `str` |  |
> | *AnalyzerEngineVersion* | `str` |  |
> | *DATVersion* | `str` |  |
> | *EngineVersion* | `str` |  |
> | *ScannerType* | `str` |  |
> | *RuleName* | `str` |  |
> | *ProcessName* | `str` |  |
> | *FileName* | `str` |  |
> | *Source* | `str` |  |
> | *ActionsBlocked* | `str` |  |
> | *szActionsBlocked* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |

### Related articles

- [Logstash](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94658762)