How can Trellix/Epo on a windows server send data to indexers or HF?

[domino30]

As stated by the Title

We have a test env for learning but at some point it will be a larger production deployment

with that said we have a Clustered Env on a vsphere server and one of the boxes is a win2019 server with EPO/Trellix on it.

So I would really like to know what best practice step by step on sending that data over rom the EPO server to Splunk whether that be to a indexer or to a heavy forwarder?

Do I need to put up some kind of syslog server somewhere or since its a Windows server should I just put a forwarder on it and use that to send data?

[Doreluss]

Good day - 

The Splunk Engineer recommended ePO as the HF 

[PickleRick]

https://splunkbase.splunk.com/app/5085 this is an addon for ePO. See the docs for installation instructions.

[domino30]

Thanks Pickle Rick

 I am aware of the Apps, and I think I know the answer but I want to make sure because there is a lot of documentation about splunk for syslog and what not but I figured since McAfee was on a Windows box I would ask if it would be easier to  just put a forwarder on that box and send data to an indexer.

[PickleRick]

As far as I remember (but I haven't touched ePO for several years), you just configure it to send syslog to some receiver, right?

Receiving raw network stream by UF of HF is not recommended. You can do that in lab environment but generally the recommended solution is to either use a syslog daemon which will write the events to files and have a forwarder read those files or - recently - use an intermediate "syslog gateway" like SC4S.