Forwarding ATP Events in Splunk

[JKBH1]

Hi @cdinet and McAfee team, why is there a difference when getting the SQL query in ePO and then showing a different output when running that same SQL query on Microsoft's SQL Server Management Studio? 

So, for this query:

select [JTIClientRulesView].[Description], [JTIClientRulesView].[Name], [EPOEvents].[SourceURL], [EPExtendedEvent].[BladeName], [EPExtendedEvent].[TargetHash], [JTIClientEventInfoView].[CertCompany], [JTIClientEventInfoView].[CertName], [JTIClientEventInfoView].[Reputation], [JTIClientEventInfoView].[EventID] from [JTIClientEventInfoView] left join [JTIClientRulesView] on [JTIClientEventInfoView].[RuleID] = [JTIClientRulesView].[RuleID] and (LangID = 'en' OR (LangID = 'en' AND NOT EXISTS(SELECT 1 FROM JTIClientRulesView WHERE LangID = 'en' AND JTIClientRulesView.RuleID = JTIClientEventInfoView.RuleID))) left join [EPOEvents] on [JTIClientEventInfoView].[EventID] = [EPOEvents].[AutoID] left join [EPExtendedEvent] on [EPOEvents].[AutoID] = [EPExtendedEvent].[EventAutoID] order by [JTIClientRulesView].[Description] asc

When in ePO, the [EPExtendedEvent].[BladeName] shows this a column name of "Module Name" and the output is "Adaptive Threat Prevention" while [JTIClientEventInfoView].[Reputation] has an output of "Most Likely Malicious" or "Might Be Malicious".

But when I ran the same query in Microsoft's SQL Server Management Studio, this [EPExtendedEvent].[BladeName] field shows as "BladeName" and the output is "IDS_BLADE_NAME_TIE" while [JTIClientEventInfoView].[Reputation] is now shown with 15, 30, 50 results.

Trying to get ATP events forwarded to Splunk and make data "readable" or useful for analysts. I sifted through ePO 5.10.0 Internal Database Schema.pdf but couldn't find anything helpful in there in relation to what I am seeing. 

[cdinet]

Those events belong to that product and as for the epo side of things, I personally can't answer to that.  I will move this over to ens team for adaptive thread prevention questions.

[Daveb3d]

15 = Most Likely Malicious

30 = Might Be Malicious

50 = Unknown.

So you can either know them, or rename them I guess.