topic Re: Trellix/Epo on a windows server sending data to indexers or HF? in Getting Data In

How can Trellix/Epo on a windows server send data to indexers or HF?

domino30 — Wed, 12 Apr 2023 16:37:00 GMT

As stated by the Title

We have a test env for learning but at some point it will be a larger production deployment

with that said we have a Clustered Env on a vsphere server and one of the boxes is a win2019 server with EPO/Trellix on it.

So I would really like to know what best practice step by step on sending that data over rom the EPO server to Splunk whether that be to a indexer or to a heavy forwarder?

Do I need to put up some kind of syslog server somewhere or since its a Windows server should I just put a forwarder on it and use that to send data?

Re: Trellix/Epo on a windows server sending data to indexers or HF?

PickleRick — Mon, 10 Apr 2023 22:40:55 GMT

https://splunkbase.splunk.com/app/5085 this is an addon for ePO. See the docs for installation instructions.

Re: Trellix/Epo on a windows server sending data to indexers or HF?

domino30 — Tue, 11 Apr 2023 14:34:42 GMT

Thanks Pickle Rick

I am aware of the Apps, and I think I know the answer but I want to make sure because there is a lot of documentation about splunk for syslog and what not but I figured since McAfee was on a Windows box I would ask if it would be easier to just put a forwarder on that box and send data to an indexer.

Re: Trellix/Epo on a windows server sending data to indexers or HF?

PickleRick — Tue, 11 Apr 2023 17:07:59 GMT

As far as I remember (but I haven't touched ePO for several years), you just configure it to send syslog to some receiver, right?

Receiving raw network stream by UF of HF is not recommended. You can do that in lab environment but generally the recommended solution is to either use a syslog daemon which will write the events to files and have a forwarder read those files or - recently - use an intermediate "syslog gateway" like SC4S.

Re: Trellix/Epo on a windows server sending data to indexers or HF?

Doreluss — Tue, 11 Apr 2023 21:37:55 GMT

Good day -

The Splunk Engineer recommended ePO as the HF