Reading Logs from Mcafee ESM to Azure Sentinel

[hamzajeljeli]

Hello there !

I want to know if there is any possibility to import all the previous logs (and new logs also) from Mcafee ESM and integrate them to Azure Sentinel. I don't know if the Azure Sentinel CEF Connector can do the job or no, or, if there is any other tool or recommandation that i can test.

Thank you.

[#2]

@hamzajeljeli The Azure Sentinel CEF will not be able to do anything, it just takes the information from McAfee and forwards the data along.   You would need to go into the McAfee product and see if it can send old logs to the CEF connector.

Keep in mind the Timestamp column in the CommonSecurityLog is when the data was RECEIVED, it may not be the same as when the data was created in the McAfee product.

[#3]

@Gary Bushey Hello there, well after deeper investigations, i guess the CEF Connector might be a solution. At Mcafee ESM side, we can configure Event Forwarding to a Linux Server (I found that CEF is an option) , and link the CEF Connector to read informations from the Linux Server.

I wasn't aware actually about the Timestamp column, but i'll try to find a workaround for it.