Getting Data In

What type of data in addition to sysloag should be ingested into Splunk to help SOC team? I already have the ePO add on

SamHTexas
Builder

What type of data in addition to sysloag should be ingested into Splunk to help SOC team? I already have the ePO add on installed. Do I need additional apps or TAs?

Labels (1)
Tags (1)
0 Karma

venkatasri
Influencer

Hi @SamHTexas 

As per the installation instructions the add-on could have been installed on SH ( for knowledge management), HF / Indexer/ UF depends on your environment ( to ingest the syslogs).  Install the Splunk Add-on for McAfee ePO Syslog - Splunk Documentation

Add-on sourcetype supports these CIM compatible Intrusion Detection,
Malware datamodels  according to Splunk docs - Source types for the Splunk Add-on for McAfee ePO Syslog - Splunk Documentation.  Hence if the add-on correctly installed on SH, and syslog data is getting ingested then that is all SOC team wanted for their usecases.

---------------------------------------------

An upvote would be appreciated if it helps!

Tags (1)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!