Configuring fault notification events for McAfee Network Security Platform 8.x - 10.x

To integrate fault notifications with McAfee Network Security Platform, you must configure your McAfee Network Security Platform to forward fault notification events.


  1. Log in to the McAfee Network Security Platform Manager user interface.
  2. Click the Manager tab.
  3. From the navigation menu, select Setup > Notification > Faults > Syslog.
  4. On the Syslog page, configure the following parameters to forward fault notification events:
    Table 1. McAfee Network Security Platform 8.x - 10.x fault notification parameters



    Enable Syslog Notification

    Select Yes to enable syslog notifications for McAfee Network Security Platform. You must enable this option to forward events to QRadar®.

    Admin Domain

    Select any of the following options:

    • Current - Select this check box to send syslog notifications for alerts in the current domain. This option is selected by default.
    • Children - Select this check box to send syslog notifications for alerts in any child domains within the current domain.
    Server Name or IP Address

    Type the IP address of your QRadar Console or Event Collector. This field supports both IPv4 and IPv6 addresses.


    Type 514 as the port for syslog events.


    Select a syslog facility value.

    Severity Mapping

    Select a value to map the informational, low, medium, and high alert notification level to a syslog severity.

    The options include the following levels:

    • Emergency - The system is unusable.
    • Alert - The system requires immediate user input or intervention.
    • Critical - The system should be corrected for a critical condition.
    • Error - The system has non-urgent failures.
    • Warning - The system displays a warning message that indicates an imminent error.
    • Notice - The system has notifications, no immediate action required.
    • Informational - Normal operating messages.
    • Debug - Debug level messages
    Forward Faults

    Select Informational and later.

  5. From the Message Preference field, click Edit to add a custom message filter.
  6. To ensure that fault notifications are formatted correctly, type the following message string:


    Note: The custom message string must be entered as a single line with no carriage returns. McAfee Network Security Platform expects the format of the custom message syslog information to contain a dollar sign ($) delimiter before and after each element. If you are missing a dollar sign for an element, the event might not parse properly.
  7. Click Save.

    As fault events are generated by McAfee Network Security Platform, they are forwarded to the syslog destination that you specified.

What to do next

You can log in to the QRadar Console and verify that the Log Activity tab contains fault events from the McAfee Network Security Platform appliance.