All Apps and Add-ons

Is anyone getting RSD (Rogue System Detection) alerts from ePO into Splunk?

Builder

The title says it all. It does not appear that RSD alerts are in the search query. Can they be added?

We have ePO 4.6, Splunk Add-on for McAfee version 2.1.3, DB Connect version 1, Splunk 6.4 and running on Linux.

Thanks.

0 Karma
1 Solution

Builder

OK, we (the Sec Engineering team) got a good config. We set up a SECOND query in the McAfee Add-On for McAfee app just for the rogues. Using DB Connect v3, this is the SQL query we set up:

SELECT [ePO_Server].[dbo].[RSDDetectedSystems].[DeviceType] as [devicetype],
[ePO_Server].[dbo].[RSDDetectedSystems].[DnsName] as [fqdn],
[dvc_ip] = ( convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([ePO_Server].[dbo].[RSDDetectedSystems].[IPV4] + 2147483648))),1,1)))+'.'+convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([ePO_Server].[dbo].[RSDDetectedSystems].[IPV4] + 2147483648))),2,1)))+'.'+convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([ePO_Server].[dbo].[RSDDetectedSystems].[IPV4] + 2147483648))),3,1)))+'.'+convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([ePO_Server].[dbo].[RSDDetectedSystems].[IPV4] + 2147483648))),4,1))) ),
[ePO_Server].[dbo].[RSDDetectedSystems].[LastDetectedTime] as [LastDetectedTime],
[ePO_Server].[dbo].[RSDDetectedSystems].[MAC] as [mac],
[ePO_Server].[dbo].[RSDDetectedSystems].[Managed] as [managed],
[ePO_Server].[dbo].[RSDDetectedSystems].[OSPlatform] as [os], 
[ePO_Server].[dbo].[RSDDetectedSystems].[LastReportingSensor] as [LastReportingSensor],
[ePO_Server].[dbo].[RSDDetectedSystems].[DetectedSourceName] as [product],
[ePO_Server].[dbo].[RSDDetectedSystems].[OSVersion] as [os_version],
[ePO_Server].[dbo].[RSDDetectedSystems].[LastAgentCommunication] as [LastAgentCommunication],
[ePO_Server].[dbo].[RSDDetectedSystems].[HostID] as [HostID]
FROM "ePO_Server"."dbo"."RSDDetectedSystems" 
WHERE [ePO_Server].[dbo].[RSDDetectedSystems].[HostID] > 0 AND [ePO_Server].[dbo].[RSDDetectedSystems].[Rogue]=1
ORDER BY [ePO_Server].[dbo].[RSDDetectedSystems].[HostID] ASC

I used HostID from the RSDDetectedSystems table as my rising check and LastDetectedTime as my timestamp. I set it to run every 3600 seconds.

Seems to be working nicely right now.

View solution in original post

0 Karma

Builder

OK, we (the Sec Engineering team) got a good config. We set up a SECOND query in the McAfee Add-On for McAfee app just for the rogues. Using DB Connect v3, this is the SQL query we set up:

SELECT [ePO_Server].[dbo].[RSDDetectedSystems].[DeviceType] as [devicetype],
[ePO_Server].[dbo].[RSDDetectedSystems].[DnsName] as [fqdn],
[dvc_ip] = ( convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([ePO_Server].[dbo].[RSDDetectedSystems].[IPV4] + 2147483648))),1,1)))+'.'+convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([ePO_Server].[dbo].[RSDDetectedSystems].[IPV4] + 2147483648))),2,1)))+'.'+convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([ePO_Server].[dbo].[RSDDetectedSystems].[IPV4] + 2147483648))),3,1)))+'.'+convert(varchar(3),convert(tinyint,substring(convert(varbinary(4),convert(bigint,([ePO_Server].[dbo].[RSDDetectedSystems].[IPV4] + 2147483648))),4,1))) ),
[ePO_Server].[dbo].[RSDDetectedSystems].[LastDetectedTime] as [LastDetectedTime],
[ePO_Server].[dbo].[RSDDetectedSystems].[MAC] as [mac],
[ePO_Server].[dbo].[RSDDetectedSystems].[Managed] as [managed],
[ePO_Server].[dbo].[RSDDetectedSystems].[OSPlatform] as [os], 
[ePO_Server].[dbo].[RSDDetectedSystems].[LastReportingSensor] as [LastReportingSensor],
[ePO_Server].[dbo].[RSDDetectedSystems].[DetectedSourceName] as [product],
[ePO_Server].[dbo].[RSDDetectedSystems].[OSVersion] as [os_version],
[ePO_Server].[dbo].[RSDDetectedSystems].[LastAgentCommunication] as [LastAgentCommunication],
[ePO_Server].[dbo].[RSDDetectedSystems].[HostID] as [HostID]
FROM "ePO_Server"."dbo"."RSDDetectedSystems" 
WHERE [ePO_Server].[dbo].[RSDDetectedSystems].[HostID] > 0 AND [ePO_Server].[dbo].[RSDDetectedSystems].[Rogue]=1
ORDER BY [ePO_Server].[dbo].[RSDDetectedSystems].[HostID] ASC

I used HostID from the RSDDetectedSystems table as my rising check and LastDetectedTime as my timestamp. I set it to run every 3600 seconds.

Seems to be working nicely right now.

View solution in original post

0 Karma

Builder

We are also on ePO 5.x, Splunk 7.x, Windows 2016, and McAfee add-on 2.21.

0 Karma

Engager

Going to give this a try. By chance did you do the same for the DLP events as well? I need a security engineering team...

0 Karma

Builder

No, we did not.

And for the record, the DB connection has stopped working and I haven't had a chance to figure out if it is a problem on the Splunk side or the ePO side.

0 Karma

New Member

| dbxquery query="SELECT * FROM RSDManagedSystemsForSubnet" connection="mcafee_epo" shortnames=t wrap=t
| where HasSensor="1"
| fields IPAddress
| table IPAddress

0 Karma

Builder

Turns out the Splunk query in the McAfee add-on does not request this data. I am using the connector from another product to get this information along with the AV, HIPS, and DLP alerts.

0 Karma