Getting Data In

How to get Cisco AMP events in Splunk Cloud?

tlmayes
Contributor

Have a requirement to get Cisco AMP events into Splunk Cloud.  For Splunk Enterprise, I use python, but with no access to the back-end, how is it done in Cloud?  Their is no "Cisco AMP" TA, so at a loss (for the moment). 

Labels (1)
Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Run your Python input script on a heavy forwarder in your on-prem network.  Download the "Universal Forwarder" app from your Splunk Cloud instance to configure the HF to send events to the Cloud.

If your Splunk Cloud stack is on the Victoria experience, then you can put your Python script into a custom app and install that on your search head.  That assumes, of course, your Cisco AMP devices can be accessed from the Cloud.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

tlmayes
Contributor

Didn't think of it that way, treat the SH as a receiver, not a collector.  I tried the second option previously and support stumbled "bad" so reluctant to burn hours (really, days) on that again

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Run your Python input script on a heavy forwarder in your on-prem network.  Download the "Universal Forwarder" app from your Splunk Cloud instance to configure the HF to send events to the Cloud.

If your Splunk Cloud stack is on the Victoria experience, then you can put your Python script into a custom app and install that on your search head.  That assumes, of course, your Cisco AMP devices can be accessed from the Cloud.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...