McAfee decoders and rules integration

[joselopezrio]

New decoders and rules to integrate McAfee EPO in our ruleset.

This is the log example used:

Syslog Output RAW.txt

The decoders are made to extract every field one by one following this structure:

<decoder name="mcafee-epo2">
        <prematch>\pEPOEvent\p</prematch>
</decoder>

<decoder name="mcafee-epo2-fields">
    <parent>mcafee-epo2</parent>
    <regex offset="after_parent">\pMachineName\p(\.+)\p/MachineName\p</regex>
    <order>machine_name</order>
</decoder>

<decoder name="mcafee-epo2-fields">
    <parent>mcafee-epo2</parent>
    <regex offset="after_parent">\pAgentGUID\p(\.+)\p/AgentGUID\p</regex>
    <order>agent_guid</order>
</decoder>

<decoder name="mcafee-epo2-fields">
    <parent>mcafee-epo2</parent>
    <regex offset="after_parent">\pIPAddress\p(\.+)\p/IPAddress\p</regex>
    <order>ip.address</order>
</decoder>

• Rules provide information about the type of threat using the decoded field ThreatName. These are the rules:

<group name="mcafee_epo,">

    <rule id="65500" level="0">
        <decoded_as>mcafee-epo2</decoded_as>
        <description>Mcafee EPO2</description>
    </rule>
    <rule id="65501" level="3">
        <if_sid>65500</if_sid>
        <description>$(ThreatName)</description>
    </rule>

</group>