McAfee Web Gateway Cloud Services (WGCS) Logpuller Script

the NEW Marketplace Other Solutions
1

McAfee Web Gateway Cloud Services (WGCS) Logpuller Script

@schindlerd

View on Github
Open Issues
Stargazers

Script to get McAfee Web Gateway Cloud Service logs from McAfee SaaS-API. Logs are downloaded to 'OutputLog.$NowUnixEpoch$.csv' and can be forwarded to a remote syslog host or SIEM when syslogEnable is set to 'True' .

Note:

When forwarding is used the downloaded CSV is transformed into a JSON stream. Configure your syslog/SIEM input correspondingly.

Timestamp is automatically adjusted with the last successful time of request. The corresponding configuration option requestTimestampFrom is updated after each run of the script.

The script is using McAfee SaaS Message API ver. 5

Field reference: https://docs.mcafee.com/bundle/web-gateway-cloud-service-product-guide/page/GUID-BDF3E4F1-1625-4569-BE80-D528CE521BC1.html

General API reference: https://docs.mcafee.com/bundle/web-gateway-cloud-service-product-guide/page/GUID-B24F5DAE-F9BB-44F7-976A-BF2245CBADF3.html

Usage

  • Download script and configuration file.
  • Make script executable and adjust the configuration file to your needs.
  • Run it periodically via cron for example.