Getting Data In

How can Trellix/Epo on a windows server send data to indexers or HF?

domino30
Path Finder

As stated by the Title

We have a test env for learning but at some point it will be a larger production deployment

with that said we have a Clustered Env on a vsphere server and one of the boxes is a win2019 server with EPO/Trellix on it.

So I would really like to know what best practice step by step on sending that data over rom the EPO server to Splunk whether that be to a indexer or to a heavy forwarder?

Do I need to put up some kind of syslog server somewhere or since its a Windows server should I just put a forwarder on it and use that to send data?

 

 

Labels (3)
Tags (1)
0 Karma

Doreluss
Loves-to-Learn Lots

Good day - 

The Splunk Engineer recommended ePO as the HF 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

https://splunkbase.splunk.com/app/5085 this is an addon for ePO. See the docs for installation instructions.

0 Karma

domino30
Path Finder

Thanks Pickle Rick

 I am aware of the Apps, and I think I know the answer but I want to make sure because there is a lot of documentation about splunk for syslog and what not but I figured since McAfee was on a Windows box I would ask if it would be easier to  just put a forwarder on that box and send data to an indexer.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

As far as I remember (but I haven't touched ePO for several years), you just configure it to send syslog to some receiver, right?

Receiving raw network stream by UF of HF is not recommended. You can do that in lab environment but generally the recommended solution is to either use a syslog daemon which will write the events to files and have a forwarder read those files or - recently - use an intermediate "syslog gateway" like SC4S.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...