Mappings: McAfee Endpoint VSAS130PerformanceEvent
| Input | Value |
|---|---|
| Vendor | McAfee |
| Product | Endpoint Security |
| Log Format | JSON |
| Event ID Regex Pattern | VSAS130PerformanceEvent |
| Output | Value |
|---|---|
| Vendor | McAfee |
| Product | Endpoint Security |
| Record Type | Endpoint |
| Cloud SIEM Schema Field | Original Record Key | Notes |
|---|---|---|
| device_hostname | VSAS130PerformanceEvent.MachineInfo.MachineName | |
| device_ip | VSAS130PerformanceEvent.MachineInfo.IPAddress | |
| device_mac | VSAS130PerformanceEvent.MachineInfo.RawMACAddress | |
| severity | VSAS130PerformanceEvent.ScannerSoftware.VSASPerformanceEventInfo.Severity | |
| timestamp | VSAS130PerformanceEvent.ScannerSoftware.VSASPerformanceEventInfo.GMTTime | We expect the orginal record value of VSAS130PerformanceEvent.ScannerSoftware.VSASPerformanceEventInfo.GMTTime is in the format YYYY-MM-dd'T'HH:mm:ss |
| user_username | VSAS130PerformanceEvent.MachineInfo.UserName |