ePO's DLP events forwarded to syslog showing limited fields when data is ingested in Splunk

[JKBH1]

Hi, we recently configured our ePO to forward events to syslog. The DLP data is showing in Splunk, however, we noticed that the fields are limited.

For example, for a Removable Storage incident, these are the fields that are showing up in Splunk:

• timestamp
• IncidentID
• dest_nt_host
• source_logon_user
• event_description
• dlp_rule
• detection_method
• UniqueMatchKeywords
• EvidenceFileName
• classification

In ePO, when digging into a Removable Storage incident, these fields (from Additional Information) are not showing up in Splunk:

• Copy Direction
• Device Friendly Name
• Device Description
• Device Class Name
• Device Class GUID
• Compatible ID
• Instance ID
• Bus Type
• USB Class
• USB Serial Number
• File System Access
• File System Type
• Volume Label
• Volume Serial Number
• Destination Path
• USB (VID/PID Codes)

For a Cloud Protection incident, this field is not showing up in Splunk: Cloud Service.

These are the DLP events selected. Wish it was easier to go through what events are being sent out as it is a long list. A filter perhaps for Agent, DLP, ENS, ATP, etc.

19136: McAfee DLP Endpoint User Sessions (Info)

19402: McAfee DLP Prevent Registered (Info)

[cdinet]

See if this helps any, otherwise you might want to contact dlp team.

KB93612

https://community.mcafee.com/t5/Data-Loss-Prevention-DLP/bd-p/data-loss-prevention

[JKBH1]

Thank you @cdinet for the KB info.

Based on the attached files in that KB, the DLP events do not seem to forward everything when a DLP incident is generated. 

We're trying to get out of the DB query/connect as this is custom, joining tables can be daunting when you're not a DBA. Unfortunately, the support team won't touch an SR when we need assistance when it comes to custom DB query.

So, I'm leveraging this forward feature from ePO to syslog. Disappointing to initially see that the forwarded DLP events are limited. It's looking like we have to go back to modifying our DB queries to get this information to Splunk.

[cdinet]

Let me move this over to dlp team to see if they have any other suggestions.