TA-Mcafee 2.1.3 does not support latest version of McAfee EPO

[jandre01]

We are sending McAfee logs from ePO DB using the documentation provided with the TA and DB connect (since 1 year)
http://docs.splunk.com/Documentation/AddOns/released/McAfeeEPO/ConfigureDBConnectv2inputs

But we notice that only the old mcafee client (Virus Scan) has correct logs in splunk, when it is the current client (EndPoint Security), data in splunk are not useful because crucial fields like file_name is empty (it is the file name of the threat)
From ePo console we can see that is it now Target Path + Target Name but not present.

[wandre_splunk · Accepted solution]

McAfee has modified the db schema in its latest release of EPO. There's a new table called EPExtendedEventMT and the syntax for the changes to your SQL statement in DB Connect needs to be as follows:
[EPExtendedEventMT].[field_to_be_retrieved] as [desired_field_name_in_Splunk]

We expect these changes to be supported in a future release of our TA. For now, follow the steps below.

In order to capture the process name which has now been moved to a new table in the latest version , the query needs to be modified as follow.

Replace
[EPOEvents].[SourceProcessName] as [process]
With
[EPExtendedEventMT].[TargetName] as [process]

After FROM [EOPEvents]
Add
left join [EPExtendedEventMT] on
[EPOEvents].[AutoID] = [EPExtendedEventMT].[EventAutoID]