Where to download the epolicy parser?

[ShellyFan]

hi, Team

we would like to log the EPO Server to RSA. According to your guide - RSA Security Analytics
Event Source Log Configuration Guide-McAfee ePolicy Orchestrator. 

"If you do not see your parser in the list while performing this procedure, you need to
download it in Security Analytics Live.". But I can't find it neither in the RSA Live nor RSA Link. Could you please help to provide the "epolicy parser"? We need it as soon as possible.

Many Thanks,

Regards,

Shelly

[JacobDorval]

Hi Shelly,

From the RSA NetWitness UI please navigate to Live -> Search.  In the search criteria section on the left of the screen, type in 'epolicy' and click search.  You should then see the content on the right in my screenshot below.  

From here you can select the epolicy parser, subscribe to it if you want automatic updates in the future, add it to a deployment group and push it out to your Log Decoder.  Once it is pushed to your Log Decoder you should be able to enable it using the instructions in the screenshot you provided above.

I hope this helps!

[ShellyFan]

Hi, Jacob,

Thanks a lot for the prompt reply.

Here is what I got. Which one is the parser?

[JacobDorval]

No problem, Shelly.  The top one is the actual parser and the second one is the log collector configuration content.  No harm in selecting them both and pushing them both out within your environment.

[ShellyFan]

Hi, Jacob,

I think I am good for this issue. Just recognize that find the wrong place. Now I saw the epolicy now.

Thanks a lot for the help.

Many Thanks,

Regards,

Shelly