Trellix MVision EPO Add-on for Splunk
Overview
Details
Trellix MVision EPO Add-on for Splunk
Trellix MVision EPO Add-on for Splunk was developed to solve the data ingest from Trellix MVision EPO (formerly McAfee EPO) API on Splunk to use cases in Splunk Enterprise and Splunk Enterprise Security. Trellix MVision EPO Add-on for Splunk is the Technical Add-on (TA) developed for ingest or map security data collected from Trellix MVision EPO API. Trellix MVision EPO Add-on for Splunk provides common information model (CIM) knowledge, to use with other Splunk Enterprise Apps such Splunk Enterprise Security.
Release notes
- Version 1.0.0: Sep 01, 2023 App created. Creates integration between Trellix EPO and Splunk Enterprise to ingest data via API. Allows multiple accounts to create connections, and supports duplicated accounts with multiple tenants. Exclusive usage for Trellix EPO API, because Endpoint path is fixed in code. Allows to use regional-based Endpoint URL, refers to Trellix documentation in https://docs.trellix.com/bundle/epolicy-orchestrator-saas-product-guide/page/GUID-E8D5F121-7544-4302-837D-A68053C95B4D.html
- Version 1.0.1: Feb 29, 2024
Solved an issue related with timeformat that does not allow to ingest data into Splunk when receivedutc field value has not milliseconds in it. Now, timeformat function will check if the timestamp field has or not milliseconds and, with that, will apply the timeformat required. - Version 1.0.2: Mar 11, 2024
Renamed the application to correct a misunderstanding of the name, since the application only applies to Trellix MVision EPO (formerly McAfee EPO) SaaS, and not to other SaaS or On-Prem Trellix products. Updated to make it Cloud-compatible, based on new Cloud Vetting Policies from Splunk.
Contributing
Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.
Please make sure to update tests as appropriate.
License
Release Notes
Version 1.0.3
Version 1.0.3: May 01, 2024
Corrected Help on URL field in Configuration page because of length exceeds maximum characters length
Version 1.0.2
Version 1.0.2: Mar 11, 2024
Renamed the application to correct a misunderstanding of the name, since the application only applies to Trellix MVision EPO (formerly McAfee EPO) SaaS, and not to other SaaS or On-Prem Trellix products. Updated to make it Cloud-compatible, based on new Cloud Vetting Policies from Splunk.
Version 1.0.1
Version 1.0.1: Feb 29, 2024
Solved an issue related with timeformat that does not allow to ingest data into Splunk when receivedutc field value has not milliseconds in it. Now, timeformat function used will check if the timestamp field has or not milliseconds and with that will apply the timeformat required.
Version 1.0.0
Version 1.0.0: Sep 01, 2023
App created.
Creates integration between Trellix EPO and Splunk Enterprise to ingest data via API.
Allows multiple accounts to create connections, and supports duplicated accounts with multiple tenants.
Exclusive usage for Trellix EPO API, because Endpoint path is fixed in code. Allows to use regional-based Endpoint URL, refers to Trellix documentation in https://docs.trellix.com/