All Apps and Add-ons

Collecting Data from McAfee Web Gateway: 7.3.2.8.0

wdeoliveira_spl
Splunk Employee
Splunk Employee

Hello all,

Any experiences around collecting data from McAfee Web Gateway: 7.3.2.8.0 ?

WHich inputs.conf configuration should I use?

Any specific source Type?

Thanks-

Wellington

0 Karma

sbattista09
Contributor

i added two files to /opt/splunk/etc/apps/AppForMcAfeeWebGateway/local/ and then added an inputs.conf and indexes.conf file and my stuff started to work. hope this helps.

0 Karma

PavelP
Motivator

Hello,

you can get the logs via syslog, using the splunk forwarder oder reading local files - it depends on your setup.

In any case you have to define the sourcetype manually, see the step #4 of the install instruction:
From the App, go to Settings > Data inputs and configure Log Input; click "More settings", select drop down "Set the source type" to "Manual" and type in "MWGaccess3". (see one of the screenshots).

best regards
Pavel

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...