The Threat Event Log - McAfee EPOLICY ORCHESTRATOR 4.5 Product Manual

Reporting On System Status

The Threat Event Log

• The pound character "#" identifies the "Nth" day of the month. For example, using "
in the Day of Week field is the third Friday of every month, "
" " is the fifth Wednesday.
4#5
NOTE: If the month does not have a fifth Wednesday, the task does not run.
The Threat Event Log
Use the Threat Event Log to quickly view and sort through events in the database. The log can
be purged only by age.
You can choose which columns are displayed in the sortable table. You can choose from a
variety of event data to use as columns.
Depending on which products you are managing, you can also take certain actions on the
events. Actions are available in the Actions menu at the bottom of the page.
Common event format
Most managed products now use a common event format. The fields of this format can be used
as columns in the Threat Event Log. These include:
• Action Taken — Action that was taken by the product in response to the threat.
• Agent GUID — Unique identifier of the agent that forwarded the event.
• DAT Version — DAT version on the system that sent the event.
• Detecting Product Host Name — Name of the system hosting the detecting product.
• Detecting Product ID — ID of the detecting product.
• Detecting Product IPv4 Address — IPv4 address of the system hosting the detecting
product (if applicable).
• Detecting Product IPv6 Address — IPv6 address of the system hosting the detecting
product (if applicable).
• Detecting Product MAC Address — MAC address of the system hosting the detecting
product.
• Detecting Product Name — Name of the detecting managed product.
• Detecting Product Version — Version number of the detecting product.
• Engine Version — Version number of the detecting product's engine (if applicable).
• Event Category — Category of the event. Possible categories depend on the product.
• Event Generated Time (UTC) — Time in Coordinated Universal Time that the event was
detected.
• Event ID — Unique identifier of the event.
• Event Received Time (UTC) — Time in Coordinated Universal Time that the event was
received by the ePO server.
• File Path — File path of the system which sent the event.
• Host Name — Name of the system which sent the event.
• IPv4 Address — IPv4 address of the system which sent the event.
212 McAfee ePolicy Orchestrator 4.5 Product Guide
6#3
" is the first Monday, and
2#1
"