App for McAfee/SkyHigh FireCore (McAfee Client Proxy MCP UCE)

This App helps to setup and maintain McAfee Client Proxy (MCP) deployment. This app allows you to collect FireCore and McAfee Client Proxy logs from one or many systems and shows which connections are being redirected to proxy and which connections bypass proxy. Discuss the Splunk App for McAfee FireCore on Splunk Answers at http://answers.splunk.com/answers/app/4763 This is the first public release, consider it Beta. REQUIREMENTS TA_McAfee_FireCore Add-On (https://splunkbase.splunk.com/app/4762/) INSTALLATION For a single desployment (to collect FireCore logs from one system only) you need to install Splunk Enterprise + TA_McAfee_FireCore Add-On + McAfee_FireCore App on the system where MCP is installed. For a distributed desploymeint (to collect FireCore logs from many systems): *install Splunk Universal Forwarder + TA_McAfee_FireCore Add-On on each client system where MCP is installed *install Splunk Enterprise + TA_McAfee_FireCore Add-On + McAfee_FireCore App on a separate server to collect logs *configure (if not yet done) input on Splunk Enterprise *configure output on each Universal Forwarder *restart Universal Forwarder to enable FireCore Logging This app tested for MCP 2.x and 3.x version on x64 Windows platform.