How to Ingest Trellix ePO Logs into Splunk

[refahiati]

Hi everyone,

I'm currently working on integrating Trellix ePolicy Orchestrator (ePO) logs into Splunk for better monitoring and analysis. I would like to know the best approach to configure Splunk to collect and index logs from the Trellix ePO server.

Specifically, I’m looking for details on:

• Recommended methods (e.g., syslog, API, or other tools/add-ons)
• Any Splunk add-ons or apps that facilitate ePO log ingestion
• Best practices for configuration and parsing these logs in Splunk

Any guidance or references to documentation would be greatly appreciated!

Thank you!

[refahiati]

Thank you for the information!

Currently, I'm receiving logs from the ePO server via Syslog, but the logs aren’t being received in full. To improve this, I’m considering using the ePO API for more reliable log collection. Could you guide me on how to configure log ingestion from the ePO server using its API instead of Syslog?

I would appreciate details on:

• Steps for setting up ePO API integration with Splunk
• Any authentication requirements or best practices for secure data transfer
• Example scripts or configurations, if available

Thank you in advance for any guidance!

[PickleRick]

Can't help you here beyond advising again to check the docs. Haven't dealt with ePO for several years now.

If by "logs aren't received in full" you mean that events are truncated, you're probably trying to send them over UDP and then you are limited by the maximum UDP datagram length. Switch to TCP (again - as far as I remember, ePO requires TLS encryption over TCP so it might be a little more tricky to configure) and you're all set.

[PickleRick]

There is a Splunk-supported TA for McAfee ePO

https://splunkbase.splunk.com/app/5085

The log ingestion is via syslog (as far as I remember from few years back, ePO exports event over TLS-protected TCP stream). The rest you'll find in the docs - it's a Splunk-supported app so it has relatively good docs.