All Apps and Add-ons

Splunk_TA_mcafee-wg fields wrong?

dominiquevocat
Motivator

Is it me or are the extractions in Splunk_TA_mcafee-wg next to totaly wrong?

To take an example Log entry from some of my activity the log looks like this:

Jul 18 08:44:27 xxx_hostname_xxx mwg: McAfeeWG|time_stamp=[18/Jul/2018:08:44:27 +0200]|auth_user=cn=XXXX,ou=XXX,ou=XXXX,ou=XXX,o=XXX|src_ip=10.9.16.6|server_ip=172.217.22.100|host=www.google.com|url_port=443|status_code=200|bytes_from_client=958|bytes_to_client=426|categories=Sea... Engines|rep_level=Minimal Risk|method=GET|url=https://www.google.com/searchdomaincheck?format=domain&type=chrome|media_type=text/plain|application... (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.79 Safari/537.36|referer=|block_res=0|block_reason=|virus_name=|hash=|filename=searchdomaincheck|filesize=426|

for src, src_ip,user,user_agent the value is "unknown"

There is the field auth_user containing the dn but i think user should contain the cn...

What am i doing wrong?

pkellyz
Explorer

@dominiquevocat @jbrocks Did either of you ever get a solution to this? I appear to have the same problem.

As far as I'm aware we are also using the TA as it was downloaded and no changes were made to props or transforms files.

0 Karma

dominiquevocat
Motivator

no update on the enhancement request - i m not sure if we tried to fix it ourselfs

0 Karma

sudosplunk
Motivator

Hello, can you paste your props.conf and transforms.conf from Splunk_TA_mcafee-wg/default OR local.

0 Karma

dominiquevocat
Motivator

hi, we use the TA out of the box - we have a newer version of mcafee web gateway then is supported by the TA

0 Karma

jbrocks
Communicator

Hi dominiquevocat, did you found a solution to your problem?

0 Karma

dominiquevocat
Motivator

nope, we opened a support ticket and have a enhancement request going

0 Karma

jbrocks
Communicator

I am not sure if this will help you, but I think the MWG AddOn only works with syslog. So you need to import a .xml file to MWG which helps splunk decoding the headers and parsing the right fields. As far as i understood this article: https://docs.splunk.com/Documentation/AddOns/released/McAfeeWG/Setup
https://answers.splunk.com/answers/138800/import-log-file.html

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...