All Apps and Add-ons

Can someone help me with an ADDON for extracting fields out of the syslog data of McAfee DAM (Database Activity Monitor)


We are using McAfee DATABASE ACTIVITY MONITOR solution and have integerated it with Splunk and do not get much fields even in verbose mode search on Splunk search head ,hence looking for some addon that can help in field extraction.

I hav tried installing few McAfee addons but they all seem to be for Mcafee ePO or Antivirus & IPS but none for McAfee DAM.

Tags (1)
0 Karma

Path Finder

I don't believe there is an add-on for DAM, I looked a while back. I ended up creating my own props/transforms to extract all the fields. The fields DAM includes in its events are configurable as well, so my DAM logs may not be the same as your DAM logs. But here's what I've been using:


LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = ^"[^"]+?","
KV_MODE = none
EXTRACT-mcafee_dam-2_fields = "(?<ruleNameRaw>[^"]+)","(?<execTime>\d+)","(?<id>\d+)","(?<sourceIP>[^"]+)","(?<osUser>[^"]+)","(?<execUser>[^"]+)","(?<execProgram>[^"]+)","(?<sid>[^"]+)"\."McAfee Database Security","(?<cmdType>[^"]+)","(?<sqlStmt>.+?(?=","))","(?<accessedObjectsRaw>[^"]+)","(?<clientId>[^"]+)","(?<module>[^"]+)","(?<action>[^"]+)","(?<spid>[^"]+)","(?<inflowSqlStmt>.+?(?=","))","(?<inflowObjectsRaw>[^"]+)","(?<database>[^"]+)","(?<agentHost>[^"]+)","(?<sourceHost>[^"]+)","(?<schema>[^"]+)"
REPORT-mcafee_dam-2 = mcafee_dam-2_ruleName, mcafee_dam-2_accessedObjects, mcafee_dam-2_inflowObjects


SOURCE_KEY = ruleNameRaw
REGEX = (?<ruleName>[^\|]+)
MV_ADD = true

SOURCE_KEY = accessedObjectsRaw
REGEX = (?<accessedObjects>[^\|]+)
MV_ADD = true

SOURCE_KEY = inflowObjectsRaw
REGEX = (?<inflowObjects>[^\|]+)
MV_ADD = true
0 Karma
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...