https://community.splunk.com/t5/Getting-Data-In/How-to-get-Cisco-AMP-events-in-Splunk-Cloud/m-p/596295#M104121 <P>Run your Python input script on a heavy forwarder in your on-prem network.&nbsp; Download the "Universal Forwarder" app from your Splunk Cloud instance to configure the HF to send events to the Cloud.</P><P>If your Splunk Cloud stack is on the Victoria experience, then you can put your Python script into a custom app and install that on your search head.&nbsp; That assumes, of course, your Cisco AMP devices can be accessed from the Cloud.</P> Tue, 03 May 2022 20:22:50 GMT richgalloway 2022-05-03T20:22:50Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Cisco-AMP-events-in-Splunk-Cloud/m-p/596285#M104120 <P>Have a requirement to get Cisco AMP events into Splunk Cloud.&nbsp; For Splunk Enterprise, I use python, but with no access to the back-end, how is it done in Cloud?&nbsp; Their is no "Cisco AMP" TA, so at a loss (for the moment).&nbsp;</P> Tue, 03 May 2022 19:17:53 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Cisco-AMP-events-in-Splunk-Cloud/m-p/596285#M104120 tlmayes 2022-05-03T19:17:53Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Cisco-AMP-events-in-Splunk-Cloud/m-p/596295#M104121 <P>Run your Python input script on a heavy forwarder in your on-prem network.&nbsp; Download the "Universal Forwarder" app from your Splunk Cloud instance to configure the HF to send events to the Cloud.</P><P>If your Splunk Cloud stack is on the Victoria experience, then you can put your Python script into a custom app and install that on your search head.&nbsp; That assumes, of course, your Cisco AMP devices can be accessed from the Cloud.</P> Tue, 03 May 2022 20:22:50 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Cisco-AMP-events-in-Splunk-Cloud/m-p/596295#M104121 richgalloway 2022-05-03T20:22:50Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Cisco-AMP-events-in-Splunk-Cloud/m-p/596298#M104123 <P>Didn't think of it that way, treat the SH as a receiver, not a collector.&nbsp; I tried the second option previously and support stumbled "bad" so reluctant to burn hours (really, days) on that again</P> Tue, 03 May 2022 20:32:58 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Cisco-AMP-events-in-Splunk-Cloud/m-p/596298#M104123 tlmayes 2022-05-03T20:32:58Z