Getting Data In

How can Trellix/Epo on a windows server send data to indexers or HF?

domino30
Path Finder

As stated by the Title

We have a test env for learning but at some point it will be a larger production deployment

with that said we have a Clustered Env on a vsphere server and one of the boxes is a win2019 server with EPO/Trellix on it.

So I would really like to know what best practice step by step on sending that data over rom the EPO server to Splunk whether that be to a indexer or to a heavy forwarder?

Do I need to put up some kind of syslog server somewhere or since its a Windows server should I just put a forwarder on it and use that to send data?

 

 

Labels (3)
Tags (1)
0 Karma

Doreluss
Loves-to-Learn Lots

Good day - 

The Splunk Engineer recommended ePO as the HF 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

https://splunkbase.splunk.com/app/5085 this is an addon for ePO. See the docs for installation instructions.

0 Karma

domino30
Path Finder

Thanks Pickle Rick

 I am aware of the Apps, and I think I know the answer but I want to make sure because there is a lot of documentation about splunk for syslog and what not but I figured since McAfee was on a Windows box I would ask if it would be easier to  just put a forwarder on that box and send data to an indexer.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

As far as I remember (but I haven't touched ePO for several years), you just configure it to send syslog to some receiver, right?

Receiving raw network stream by UF of HF is not recommended. You can do that in lab environment but generally the recommended solution is to either use a syslog daemon which will write the events to files and have a forwarder read those files or - recently - use an intermediate "syslog gateway" like SC4S.

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...