Showing results for 
Show  only  | Search instead for 
Did you mean: 
Level 10
Report Inappropriate Content
Message 1 of 3

Forwarding ATP Events in Splunk

Hi @cdinet and McAfee team, why is there a difference when getting the SQL query in ePO and then showing a different output when running that same SQL query on Microsoft's SQL Server Management Studio? 

So, for this query:

select [JTIClientRulesView].[Description], [JTIClientRulesView].[Name], [EPOEvents].[SourceURL], [EPExtendedEvent].[BladeName], [EPExtendedEvent].[TargetHash], [JTIClientEventInfoView].[CertCompany], [JTIClientEventInfoView].[CertName], [JTIClientEventInfoView].[Reputation], [JTIClientEventInfoView].[EventID] from [JTIClientEventInfoView] left join [JTIClientRulesView] on [JTIClientEventInfoView].[RuleID] = [JTIClientRulesView].[RuleID] and (LangID = 'en' OR (LangID = 'en' AND NOT EXISTS(SELECT 1 FROM JTIClientRulesView WHERE LangID = 'en' AND JTIClientRulesView.RuleID = JTIClientEventInfoView.RuleID))) left join [EPOEvents] on [JTIClientEventInfoView].[EventID] = [EPOEvents].[AutoID] left join [EPExtendedEvent] on [EPOEvents].[AutoID] = [EPExtendedEvent].[EventAutoID] order by [JTIClientRulesView].[Description] asc

When in ePO, the [EPExtendedEvent].[BladeName] shows this a column name of "Module Name" and the output is "Adaptive Threat Prevention" while [JTIClientEventInfoView].[Reputation] has an output of "Most Likely Malicious" or "Might Be Malicious".

But when I ran the same query in Microsoft's SQL Server Management Studio, this [EPExtendedEvent].[BladeName] field shows as "BladeName" and the output is "IDS_BLADE_NAME_TIE" while [JTIClientEventInfoView].[Reputation] is now shown with 15, 30, 50 results.

Trying to get ATP events forwarded to Splunk and make data "readable" or useful for analysts. I sifted through ePO 5.10.0 Internal Database Schema.pdf but couldn't find anything helpful in there in relation to what I am seeing. 

Labels (2)
2 Replies
Report Inappropriate Content
Message 2 of 3

Re: Forwarding ATP Events in Splunk

Those events belong to that product and as for the epo side of things, I personally can't answer to that.  I will move this over to ens team for adaptive thread prevention questions.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Forwarding ATP Events in Splunk

15 = Most Likely Malicious

30 = Might Be Malicious

50 = Unknown.

So you can either know them, or rename them I guess.  

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use our Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from product experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by employees.
Join the Community
Join the Community