McAfee MAP-3300-SWG - Web Security Appliance 3300, Product Manual

Page: 272 / 336

Table 271 Email and Web Security Appliance v5.6 Connector Field Mappings (continued)
McAfee-Specific Event Definition ArcSight Event Data Field
The definition of this field depends on the value of
the field 'cs5': If cs5 is 'AV' or 'PA' or 'PU':
'virus-names' If cs5 is 'AS': 'spam-rules-broken'
If cs5 is 'DL': 'dlpfile' If cs5 is 'FF': 'content-rules'
If cs5 is 'PX': 'content-rules'
cs1Label
The definition of this field depends on the value of
the field 'cs5': If cs5 is 'AV' or 'PA' or 'PU': The
version of the Anti-Virus engine If cs5 is 'AS': The
spam score If cs5 is 'DL': The DLP categories that
triggered If cs5 is 'PX': The terms that caused the
content filter event
cs2
The definition of this field depends on the value of
the field 'cs5': If cs5 is 'AV' or 'PA' or 'PU':
'av-engine-version' If cs5 is 'AS': 'spam-score' If
cs5 is 'DL': 'dlp-rules' If cs5 is 'PX':
'compliance-terms'
cs2Label
The definition of this field depends on the value of
the field 'cs5': If cs5 is 'AS': The threshold the
message exceeded
cs3
The definition of this field depends on the value of
the field 'cs5': If cs5 is 'AS': 'spam-threshold-score'
cs3Label
The attachments of the email (if available) cs4
'email-attachments' cs4Label
For a detection event, the scanner which
triggered the event: 'AP' - Anti-Phish 'AS' -
Anti-Spam 'AV' - Anti-Virus 'DL' - Data Loss
Prevention 'FF' - File Filtering 'MF' - Mail Filtering
'MS' - Mail Size 'PA' - Packer 'PU' - Potentially
Unwanted Program 'PX' - Compliancy 'SA' -
SiteAdvisor 'UF' - URL Filtering
cs5
'master-scan-type' cs5Label
The subject of the email cs6
'email-subject' cs6Label
Indicates if the action taken is the main action
defined for the event. 1 indicates primary action
cn1
'is-primary-action' cn1Label
The number of attachments in the email (if
available)
cn2
'num-email-attachments' cn2Label
The number of recipients of the email cn3
'num-email-recipients' cn3Label
Extended Syslog attributes for Splunk
Using the extended Syslog functions within the appliance, you can use external, third party software
— such as Splunk — to generate Syslog reports.
Table 272 Extended Syslog attributes for Splunk
Syslog entry Notes Example
Time and Appliance Name Dec 30 10:58:10 Appliance1
app Protocol Smtp
Overview of System features
Logging, Alerting and SNMP
272 McAfee Email and Web Security Appliances 5.6.0 Product Guide