Splunk MVISION EPO App

The MVISION EPO App for Splunk leverages a script to collect MVISION ePO threat events and DLP Incidents. This raw data can then be composed into a dashboard displaying Threat Events and DLP Incidents detected, trends in detections, hostnames and severity ratings. Additional views can be created from the raw data through Splunk’s Search and Visualization engine.

Link to Splunkbase: https://splunkbase.splunk.com/app/5675/

Requirements:
MVISION EPO Tenant
MVISION EPO Tenant Username and Password (e.g. seperate service account)

Part 1: Install and Configure Application

Download the MVISION EPO Splunk App.

Navigate to the Apps Menu | Manage Apps | Install app from file. Select Browse and select the .tgz application file to upload. Select Upload.

To setup the app go to Managed Apps | MVISION EPO | Set Up.

GoTo MVISION EPO Setup:

Enter the MVISION EPO Username, Password and the TenantID (optional).

!The TenantID is set to "Default". In case multiple tenants are assigned to the same MVISION Login credentials, please specifiy the correct TenantID.

GoTo Script Configuration:##

Select the script execution interval.
Ensure that the check box “Disable Script Execution” is not checked otherwise the app will not run!

!The check box “Disable” should only be unchecked on heavy forwarders. Leave the script disabled on Indexers.

GoTo Index Configuration:

Select the index.

GoTo Proxy Configuration: (optional)

Configure proxy settings if applicable.

Navigate to Settings | Data Inputs | Scripts to verify that the mvepo_events.py script is enabled.

Part 2: Verify

Open the MVISION EPO App by navigating to the Apps Menu and selecting MVISION EPO. Under the Search tab, search the index with the query “sourcetype="mcafee:mvepo:events”.

!The initial pull of the app will start pulling events from the last 5 minutes. After the first successfully pull the last detection timestamp will be written into the key value store for the next execution interval.

Part 3: Logging

Application and data is stored under the following directories:
%SPLUNKHOME%\etc\apps\mvepo
%SPLUNKHOME%\var\log\splunk\mveepo_logger.txt

MVISION EPO

0