I have read mixed reviews, our team within our DoD sector suggest that ingestion the logs directly into the SIEM platform would be best and I feel that having a third party tool with signatures, look at the event and determine if was malicious and then forward on an alert to the ESM for investigation.

The next issue we have is getting these events and sub-events parsed.

I have noticed that McAfee ePolicy Orchestrator sometimes alerts on powershell events but we can't seem to write a custom parser override or find the field that contains the full powershell command issues, only partial information on the command.

Any help would be much appreciated!

closed as unclear what you're asking by schroeder Feb 11 at 17:11

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • This would appear to be a question for the vendor. – schroeder Feb 11 at 16:07
  • Actually, I'm not sure what you are asking help with. ArcSight? Whether to pre-process events? EPO? Can you take another stab at this question? – schroeder Feb 11 at 16:09
  • Take a look at log collection products on the market that can collect Powershell activity logs, parse these at the data source, then forwarded to Arcsight. Another item is if they can also parse in the CEF (Common Event Format) which is introduced by Arcsight. – NASAhorse Feb 12 at 10:34