topic How to Ingest Trellix ePO Logs into Splunk in Splunk Dev

How to Ingest Trellix ePO Logs into Splunk

refahiati — Tue, 29 Oct 2024 13:24:01 GMT

Hi everyone,

I'm currently working on integrating Trellix ePolicy Orchestrator (ePO) logs into Splunk for better monitoring and analysis. I would like to know the best approach to configure Splunk to collect and index logs from the Trellix ePO server.

Specifically, I’m looking for details on:

Recommended methods (e.g., syslog, API, or other tools/add-ons)
Any Splunk add-ons or apps that facilitate ePO log ingestion
Best practices for configuration and parsing these logs in Splunk

Any guidance or references to documentation would be greatly appreciated!

Thank you!

Re: How to Ingest Trellix ePO Logs into Splunk

PickleRick — Fri, 01 Nov 2024 21:53:57 GMT

There is a Splunk-supported TA for McAfee ePO

https://splunkbase.splunk.com/app/5085

The log ingestion is via syslog (as far as I remember from few years back, ePO exports event over TLS-protected TCP stream). The rest you'll find in the docs - it's a Splunk-supported app so it has relatively good docs.

Re: How to Ingest Trellix ePO Logs into Splunk

refahiati — Tue, 05 Nov 2024 10:52:01 GMT

Thank you for the information!

Currently, I'm receiving logs from the ePO server via Syslog, but the logs aren’t being received in full. To improve this, I’m considering using the ePO API for more reliable log collection. Could you guide me on how to configure log ingestion from the ePO server using its API instead of Syslog?

I would appreciate details on:

Steps for setting up ePO API integration with Splunk
Any authentication requirements or best practices for secure data transfer
Example scripts or configurations, if available

Thank you in advance for any guidance!

Re: How to Ingest Trellix ePO Logs into Splunk

PickleRick — Tue, 05 Nov 2024 11:30:51 GMT

Can't help you here beyond advising again to check the docs. Haven't dealt with ePO for several years now.

If by "logs aren't received in full" you mean that events are truncated, you're probably trying to send them over UDP and then you are limited by the maximum UDP datagram length. Switch to TCP (again - as far as I remember, ePO requires TLS encryption over TCP so it might be a little more tricky to configure) and you're all set.