Getting Mcafee HIPS Firewall Logs to Splunk

[theouhuios]

Hello

Has anyone figured out a way to send Mcafee's HIPS firewall logs which are written to event.log file on the agent to be indexed to Splunk? It writes in binary so splunk can't just read the file. Any ideas on how to do it? It looks like the ePO doesn't get the firewall event logs back to itself so I can't get them to write it as a text file for splunk to read it. And it doesn't get them to its database too so can't use DB Connect to pull them in.

Any ideas?

[daniel_goolsby_]

After discovering the event.log was binary-- but the file would seemingly load up fine in notepad, or notepad++.. I discovered the file was actually in a different character set called UCS-2 LE, which according to (http://docs.splunk.com/Documentation/Splunk/4.1/Admin/Configurecharactersetencoding) maps to the utf-16le characterset- that I had to specify that in the props.conf on the forwarder.

[monitor://C:\ProgramData\McAfee\Host Intrusion Prevention\Event.log]
index=
disabled = 0
sourcetype = hipsfw
followTail = 1

in props.conf (still on forwarder)

[hipsfw]
NO_BINARY_CHECK = true
CHARSET = utf-16le

This should get everyone going.

[hortonew]

This worked for me. Just need to do field extraction now.