I am seeing this message in 3.4.1.  Trying to work with ePO DLP. ... View more

I know this is an old post...but just trying to get in to the MontorNoHandle running for DNS Debugging and I saw a mention that the driver needs to be installed (even with the latest version) _if_ you installed the Universal Forwarder from a zip file.  I suspect that may be related to some of the other issues that are in Answers that have been sitting out there. https://docs.splunk.com/Documentation/Forwarder/8.1.1/Forwarder/InstallaWindowsuniversalforwarderfromaZIPfile -Tony ... View more

I have been fighting this battle for a while now off and on. ePO has different places to configure logging depending on the product and it's still not totally clear to me.  But from what I have found standard McAfee syslog (registered syslog server) and App Control (registered SolidCore syslog appear) to be CEF TLS Syslog.  The "default" port is 6514 as you mention.  That means that you need to have a certificate on your syslog server on 6514TCP.  For further information check out some light reading of standards IETF 5424 + 5425.  DLP is different, but looks like it may work with the same setup.  That's because it can be UDP (which can be without TLS) or TCP. Then you need to have some form to monitor the syslog collection to get it to your Splunk server.  The easiest way to do that is to have the forwarder monitor on the system and send it over.  If that's the case you probably want to add the Splunk Add-on for McAfee ePO Syslog on to your forwarder along with the sourcetype to ease the burden on your indexer. We use a product called NXLog for now, and with the app McAfee ePO Syslog app, we are able to collect and parse with the sourcetype mcafee:epo:syslog.  It looks kind of ugly in the raw event, but the fields seem to be parsed perfectly, which is the important thing. For DLP we are going to see what's best DBConnect or syslog.  If you use DBConnect you have to basically reverse engineer the fields using querys provided by ePO as the fields change from version to version.  Hopefully they will standardize that in the coming releases because seems to be awfully tedious. -Tony ... View more

For the record, in the year 2019 this resolved this Windows Server corner issue for us. I tried with the above verbatim, but it only worked when I removed the delimiting slash in the inputs.conf stanza in the nix_TA. This may be due to improvements with the way Windows handles *nix inputs (mentioned in the release notes at some point over the last few years). [script://$SPLUNK_HOME/bin/scripts/sh $SPLUNK_HOME/etc/apps/Splunk_TA_nix/bin/cpu.sh] [script://$SPLUNK_HOME/bin/scripts/sh $SPLUNK_HOME/etc/apps//bin/] We also set the permissions on the scripts locally on the system. If we update, then we will have to go back through and verify the permissions are proper per client unless we choose to modify our approach. 😕 ... View more