topic Re: McAfee epo integration with Splunk in Getting Data In

McAfee epo integration with Splunk

lohit — Tue, 16 Jul 2013 06:19:31 GMT

We have to integrate McAfee epo(full fledged) instance with splunk i.e we want logs of EPO in splunk. What is the best way to do it. Should i install Universal forwarder on the epo machine or should i use EPO extended configuration and register my splunk as a syslog server there(donot know how to do this).Also we donot want to use ESS for this. Please help !!

Re: McAfee epo integration with Splunk

MuS — Tue, 16 Jul 2013 06:31:21 GMT

Hi lohit,

both will work fine, if you can configure and/or setup it up in EPO.
Syslog has some down sides, like data can get lost if the indexer is down for example. Personally I would configure EPO to create text Log file and install a Splunk Universalforwarder to monitor the log.

Hope this helps a bit to get you started.

Cheers, MuS

Re: McAfee epo integration with Splunk

lohit — Tue, 16 Jul 2013 06:45:21 GMT

Thanks a lot MuS.

Totally agree with syslog downside. Only positive points from EPO setup is that we can actually log only a specific type of events to a syslog server from EPO console like for example based on severity instead of collecting all logs and then extracting it in splunk.

Re: McAfee epo integration with Splunk

adrianathome — Tue, 27 Aug 2013 21:47:41 GMT

Were you able to do this? If so please share a little how to.

Re: McAfee epo integration with Splunk

lukejadamec — Tue, 27 Aug 2013 21:57:29 GMT

Which part are you having trouble with?

Re: McAfee epo integration with Splunk

adrianathome — Thu, 29 Aug 2013 03:49:18 GMT

Interested in a procedure to have epo write logs to text file. Also any props/transforms for the epo data.

Re: McAfee epo integration with Splunk

AaronMoorcroft — Mon, 02 Sep 2013 11:54:36 GMT

Can anyone provide any further info on how to get EPO to export to a .txt file and then monitor with Splunk ?

Re: McAfee epo integration with Splunk

MuS — Mon, 02 Sep 2013 12:20:58 GMT

Hi Aaron, according to http://kc.mcafee.com/corporate/index?page=answerlink&url=spD2Ro8-7xeSDi5pMVrcP4NU4ttaDgfvDk2wLTCzMyuMz4oyiLGtCwXyK-df8-rTJFeDr-E2d5KAfwI6LVw1bnWuIQsNjHpp38oNnKthbAH6Wc3uAV-hNpjW3UWjKYYsGpZI9jjhwVKI1eUpoOcSUeU-qClOYC9FdHJAIZeHvnV1D7BddyGF4Wl3Dbj!5NFlu1RIhjiLdQqM2H2GOdxPHEZ0vPcJgGQP&answerid=16777216&searchid=1378124191887 you can configure the logs in a matter so it will write a txt log file. This can be monitored by Splunk, read more here http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor

Re: McAfee epo integration with Splunk

jcoates_splunk — Tue, 08 Jul 2014 18:56:53 GMT

FYI, there's now a DB Connect based way to do EPO logs too: http://apps.splunk.com/app/1819/