https://community.splunk.com/t5/Splunk-Enterprise-Security/SCCM-2012-Endpoint-Protection-Reporting-in-Splunk-ES/m-p/195123#M988 <P>hi, that will need some add-on work to model the data (field extractions and tags). Here's the endpoint model: <A href="http://docs.splunk.com/Documentation/CIM/latest/User/Malware">http://docs.splunk.com/Documentation/CIM/latest/User/Malware</A></P> <P>Here's some TA-building advice: <A href="http://blogs.splunk.com/2014/01/01/building-technology-add-ons/">http://blogs.splunk.com/2014/01/01/building-technology-add-ons/</A></P> Tue, 10 Jun 2014 20:59:22 GMT jcoates_splunk 2014-06-10T20:59:22Z https://community.splunk.com/t5/Splunk-Enterprise-Security/SCCM-2012-Endpoint-Protection-Reporting-in-Splunk-ES/m-p/195122#M987 <P>Hi Everyone,</P> <P>I have been unsuccessful in getting Microsoft System Center 2012 Endpoint Protection events into Splunk ES. The Endpoint Protection deployment is currently reporting in SCCM without an issue, as alerts have been configured correctly in SCCM.</P> <P>The SCCM servers have the Universal Forwarder installed and has the following configuration in inputs.conf to monitor the SCCM logs:</P> <P>[monitor://D:\Program Files\Microsoft Configuration Manager\Logs*.log]<BR /> disabled = 0<BR /> current_only=0</P> <P>I have restarted the service for the Universal forwarder on the SCCM servers and have verified that I am in fact receivng logs from the servers, however I am not receiving any Endpoint Protection events. </P> <P>Am I missing something? Thanks in advance!</P> <P>Splunk version: 6.1<BR /> Splunk ES version: 3.0<BR /> Universal forwarder version on SCCM servers: 5.0.2</P> Tue, 10 Jun 2014 20:55:32 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/SCCM-2012-Endpoint-Protection-Reporting-in-Splunk-ES/m-p/195122#M987 dxmiller 2014-06-10T20:55:32Z https://community.splunk.com/t5/Splunk-Enterprise-Security/SCCM-2012-Endpoint-Protection-Reporting-in-Splunk-ES/m-p/195123#M988 <P>hi, that will need some add-on work to model the data (field extractions and tags). Here's the endpoint model: <A href="http://docs.splunk.com/Documentation/CIM/latest/User/Malware">http://docs.splunk.com/Documentation/CIM/latest/User/Malware</A></P> <P>Here's some TA-building advice: <A href="http://blogs.splunk.com/2014/01/01/building-technology-add-ons/">http://blogs.splunk.com/2014/01/01/building-technology-add-ons/</A></P> Tue, 10 Jun 2014 20:59:22 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/SCCM-2012-Endpoint-Protection-Reporting-in-Splunk-ES/m-p/195123#M988 jcoates_splunk 2014-06-10T20:59:22Z