How to get Cisco AMP events in Splunk Cloud?

[tlmayes]

Have a requirement to get Cisco AMP events into Splunk Cloud.  For Splunk Enterprise, I use python, but with no access to the back-end, how is it done in Cloud?  Their is no "Cisco AMP" TA, so at a loss (for the moment). 

[tlmayes]

Didn't think of it that way, treat the SH as a receiver, not a collector.  I tried the second option previously and support stumbled "bad" so reluctant to burn hours (really, days) on that again

[richgalloway · Accepted solution]

Run your Python input script on a heavy forwarder in your on-prem network.  Download the "Universal Forwarder" app from your Splunk Cloud instance to configure the HF to send events to the Cloud.

If your Splunk Cloud stack is on the Victoria experience, then you can put your Python script into a custom app and install that on your search head.  That assumes, of course, your Cisco AMP devices can be accessed from the Cloud.