diff --git a/docs/sources/McAfee/index.md b/docs/sources/McAfee/index.md index 250d6e5..c9ec15e 100644 --- a/docs/sources/McAfee/index.md +++ b/docs/sources/McAfee/index.md @@ -19,8 +19,9 @@ | source | notes | |----------------|---------------------------------------------------------------------------------------------------------| -| Future | source field will be updated in the future to identify record types | - +| policy_auditor_vulnerability_assessment | Policy Auditor Vulnerability Assessment events | +| mcafee_agent | McAfee Agent events | +| mcafee_endpoint_security | McAfee Endpoint Security events | ### Index Configuration | key | index | notes | diff --git a/package/etc/conf.d/log_paths/lp-mcafee_epo.conf.tmpl b/package/etc/conf.d/log_paths/lp-mcafee_epo.conf.tmpl index f484bf6..6c1cf8c 100644 --- a/package/etc/conf.d/log_paths/lp-mcafee_epo.conf.tmpl +++ b/package/etc/conf.d/log_paths/lp-mcafee_epo.conf.tmpl @@ -21,13 +21,25 @@ log { }; }; + if { + filter { + message('ProductName="([^"]+)"' flags(store-matches)); + }; + rewrite { + set("$(lowercase $1)" value(".mcafee.product")); + subst('\s', '_', value(".mcafee.product") flags("global")); + r_set_splunk_dest_default(sourcetype("mcafee:epo:syslog"), source("${.mcafee.product}")) + }; + } else { + # If the product is not provided by EPO we will just use a constant for the value + rewrite { + set("mcafee_epo", value("fields.sc4s_vendor_product")); + r_set_splunk_dest_default(sourcetype("mcafee:epo:syslog"), source("epo")) + }; - rewrite { - set("mcafee_epo", value("fields.sc4s_vendor_product")); - r_set_splunk_dest_default(sourcetype("mcafee:epo:syslog")) }; - parser {p_add_context_splunk(key("mcafee_epo")); }; + parser {p_add_context_splunk(key("mcafee_epo")); }; parser (compliance_meta_by_source); rewrite { set("$(template ${.splunk.sc4s_template} $(template t_msg_only))" value("MSG")); }; diff --git a/tests/test_mcafee_epo.py b/tests/test_mcafee_epo.py index 8d8df32..e9e17e6 100644 --- a/tests/test_mcafee_epo.py +++ b/tests/test_mcafee_epo.py @@ -12,16 +12,76 @@ import pytest env = Environment() -testdata = [ + +mcafee_endpoint_security_testdata = [ r'{{ mark }} {{ iso }}Z {{ host }} EPOEvents - EventFwd [agentInfo@3401 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] ?DESKTOP-000010011aacc-eeee-0000-0000-00001122331110.222.22.131Windows 10 Server%CTX_DOMAIN_USER%-330000011223311ENDP_GS_1060McAfee Endpoint Security10.6.1.1607DESKTOP-0000111200{{ iso }}_ops.update1none6', r'{{ mark }} {{ iso }}Z {{ host }} EPOEvents - EventFwd [agentInfo@3401 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] ?DESKTOP-000010011aacc-eeee-0000-0000-00001122331110.222.22.83Windows 10 Server%CTX_DOMAIN_USER%-330000011223311ENDP_GS_1070McAfee Endpoint Security10.7.0.1285DESKTOP-0000111180{{ iso }}_ops.update.end1none6', r'{{ mark }} {{ iso }}Z {{ host }} EPOEvents - EventFwd [agentInfo@3401 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] ?DESKTOP-000010011aacc-eeee-0000-0000-00001122331110.222.22.45Windows 10 WorkstationSYSTEM-330000011223311ENDP_WP_1060McAfee Endpoint Security10.6.1DESKTOP-00001URL navigation186003{{ iso }}wp.detect.url186002Web Control ViolationIDS_THREAT_TYPE_URL{{ iso }}ZblockedTrue213.211.198.58http://2222.aaaaa.org/download/eicarcom2.zipDESKTOP-00001\adminC:\Program Files\McAfee\Endpoint Security\Web Control\McChHost.exeDESKTOP-00001\adminIDS_BLADE_NAME_WPTrue03e33bcdd99853ea8c83407c3ab4599cC:\Program Files\Google\Chrome\Application\chrome.exea1902e39f3a1610751b707a6742082c3TrueGoogle LLC0FalseIDS_SECUIRTY_RATING_SA_REDIDS_SAE_CONTENT_MS1IDS_WC_NLD_URL_RATING|SourceURL=http://2222.aaaaa.org/download/eicarcom2.zip|SourceProcessName=C:\Program Files\McAfee\Endpoint Security\Web Control\McChHost.exe|SourceUserName=DESKTOP-00001\admin|ThreatActionTaken=blocked|AnalyzerName=McAfee Endpoint Security|SourceURLRatingCode=IDS_SECUIRTY_RATING_SA_RED186002222.aaaaa.orghttp://2222.aaaaa.org/download/eicarcom2.zip10413143444413000000100000000000000000011000000', r'{{ mark }} {{ iso }}Z {{ host }} EPOEvents - EventFwd [agentInfo@3401 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] ?DESKTOP-000010011aacc-eeee-0000-0000-00001122331110.222.22.131Windows 10 ServerSYSTEM-330000011223311ENDP_AM_1060McAfee Endpoint Security10.6.1DESKTOP-000016010.8670On-Access Scan3811.012783{{ iso }}av.detect12782EICAR test filetest{{ iso }}ZIDS_ALERT_ACT_TAK_DELTrueDESKTOP-00001C:\Users\admin123.WIN-QFN79SPC5U4.000\Desktop\Tops.exeDESKTOP-00001DESKTOP-00001\admin123C:\Users\admin123.WIN-QFN79SPC5U4.000\Desktop\TEST_SAMPLES_MVS\Standard Test Set\eicarIDS_BLADE_NAME_SPB2019-08-25T02:22:00ZFalseTrueeicarC:\Users\admin123.WIN-QFN79SPC5U4.000\Desktop\TEST_SAMPLES_MVS\Standard Test Sete7e5fa40569514ec442bbdf755d89c2f702000-10-24T05:13:46Z2019-08-26T05:32:39Z2019-08-26T05:32:39ZFalseIDS_OAS_TASK_NAMEIDS_ALERT_THACT_ATT_CLEFalseIDS_ALERT_THACT_ATT_DELTrue410IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=eicar|TargetPath=C:\Users\admin123.WIN-QFN79SPC5U4.000\Desktop\TEST_SAMPLES_MVS\Standard Test Set|ThreatName=EICAR test file|SourceProcessName=C:\Users\admin123.WIN-QFN79SPC5U4.000\Desktop\Tops.exe|ThreatType=test|TargetUserName=DESKTOP-00001\admin123IDS_OAS_DEFAULT_THREAT_MESSAGE3811.0', +] +mcafee_agent_testdata = [ r'{{ mark }} {{ iso }}Z {{ host }} EPOEvents - EventFwd [agentInfo@4444 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] {0011aacc-eeee-0000-0000-000011223311}THEMBP1000011223311172.16.23.1231.1.1.103Windows 1024024224{{ iso }}POLICYAU6000040959Policy EnforcementN/AEPOAGENT3000N/AN/AN/A', +] +policy_auditor_vulnerability_assessment_testdata = [ r'{{ mark }} {{ iso }}Z {{ host }} EPOEvents - EventFwd [agentInfo@4444 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] {0011aacc-eeee-0000-0000-000011223311}THEMBP1000011223311172.16.23.1231.1.1.103Linux0GARY189050{{ iso }}Policy Auditor Vulnerability Assessment1.1.0Security020eJx1jjELgzAUhPf+ipCpBYWoS+smOHYQHEuR1xjKK+YZzEupiP+9j+7d7o7vuNs0gXe61l2jmhgd qxYYVG+BCOmprkjpo45N1/UnnemUcBS4NKIZvYsMPvyC0uSmyouLKqramLo8C7G4mCYeeA2ysGkI YUILjDMN8+PlLEsTyS7OO2KY9J6JfYuel3UY5ce/1u2+74cvff89lg==', ] -@pytest.mark.parametrize("event", testdata) -def test_mcafee_epo_structured(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s,event): + +@pytest.mark.parametrize("event", mcafee_endpoint_security_testdata) +def test_mcafee_epo_structured_mcafee_endpoint_security(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s,event): + host = get_host_key + + dt = datetime.datetime.now(datetime.timezone.utc) + iso, bsd, time, date, tzoffset, tzname, epoch = time_operations(dt) + + # Tune time functions + iso = dt.isoformat()[0:23] + epoch = epoch[:-3] + + mt = env.from_string(event + "\n") + message = mt.render(mark="<29>1", iso=iso, host=host) + + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) + + st = env.from_string('search _time={{ epoch }} index=epav host="{{ host }}" sourcetype="mcafee:epo:syslog" source="mcafee_endpoint_security"') + search = st.render(epoch=epoch, host=host) + + resultCount, eventCount = splunk_single(setup_splunk, search) + + record_property("host", host) + record_property("resultCount", resultCount) + record_property("message", message) + + assert resultCount == 1 + +@pytest.mark.parametrize("event", mcafee_agent_testdata) +def test_mcafee_epo_structured_mcafee_agent(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s,event): + host = get_host_key + + dt = datetime.datetime.now(datetime.timezone.utc) + iso, bsd, time, date, tzoffset, tzname, epoch = time_operations(dt) + + # Tune time functions + iso = dt.isoformat()[0:23] + epoch = epoch[:-3] + + mt = env.from_string(event + "\n") + message = mt.render(mark="<29>1", iso=iso, host=host) + + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) + + st = env.from_string('search _time={{ epoch }} index=epav host="{{ host }}" sourcetype="mcafee:epo:syslog" source="mcafee_agent"') + search = st.render(epoch=epoch, host=host) + + resultCount, eventCount = splunk_single(setup_splunk, search) + + record_property("host", host) + record_property("resultCount", resultCount) + record_property("message", message) + + assert resultCount == 1 + +@pytest.mark.parametrize("event", policy_auditor_vulnerability_assessment_testdata) +def test_mcafee_epo_structured_policy_auditor_vulnerability_assessment(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s,event): host = get_host_key dt = datetime.datetime.now(datetime.timezone.utc) @@ -36,7 +96,7 @@ def test_mcafee_epo_structured(record_property, setup_wordlist, get_host_key, se sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) - st = env.from_string("search _time={{ epoch }} index=epav host=\"{{ host }}\" sourcetype=\"mcafee:epo:syslog\"") + st = env.from_string('search _time={{ epoch }} index=epav host="{{ host }}" sourcetype="mcafee:epo:syslog" source="policy_auditor_vulnerability_assessment"') search = st.render(epoch=epoch, host=host) resultCount, eventCount = splunk_single(setup_splunk, search)