McAfee Web Gateway

When you configure your McAfee Web Gateway to send log data to USM Appliance, you can use the McAfee Web Gateway (mwg) plugin to translate raw log data into normalized events for analysis. The table below provides some basic information for the plugin.

Plugin Information
Device Details
Vendor McAfee
Device Type Gateway
Connection Type Syslog
Data Source Name mcafee-mwg
Data Source ID 1699

Integrating McAfee Web Gateway

Before you configure the McAfee Web Gateway integration, you must have the IP Address of the USM Appliance Sensor.

To avoid potentially having your changes overwritten, complete this task, using only the McAfee Web Gateway web interface File Editor on a per appliance basis. Do not edit /etc/rsyslog.conf directly.

To configure McAfee Web Gateway to send log data to USM Appliance

  1. In File Editor, look for rsyslog.conf.

  2. Look for a line similar to the following:

    *.info;mail.none;authpriv.none;cron.none /var/log/messages

  3. Make sure that the syslog daemon does not write any messages coming from the daemon facility (McAfee Web Gateway) with the level "info" to the /var/log/messages file by replacing it with the following line:

    *.info;daemon.!=info;mail.none;authpriv.none;cron.none -/var/log/messages

    Important: This updated line ensures that the syslog daemon does not write any messages from the daemon facility (the McAfee Web Gateway) with info level, to the /var/log/messages file. Capturing and writing "info" level messages generates a high volume of messages, which could overflow the /var partition.

  4. Send the data to a syslog server using UDP by adding a line like the one below to the end of the file:

    daemon.info @<USM-Appliance-Sensor-IP-Address>:514

  5. Enable CEF format, as shown in the following figures.

    Syslog CEF Rule 1

    Syslog CEF Rule 2

Plugin Enablement

For plugin enablement information, see Enable Plugins.

Additional Resources and Troubleshooting

https://community.mcafee.com/docs/DOC-5206

For troubleshooting, refer to the vendor documentation:

https://kc.mcafee.com/corporate/index?page=content&id=KB73869