Details

The Trellix (McAfee) ePO Splunk Technology Add-on is designed to collect, normalize, and visualize endpoint security telemetry from Trellix ePolicy Orchestrator (ePO). This section explains how to use the app after installation, including configuration, daily operation, dashboards, and best practices.

How the App Works

The add-on uses Splunk modular inputs to securely connect to the Trellix ePO REST API (and optionally syslog) at scheduled intervals. Retrieved data is parsed, enriched, and normalized to the Splunk Common Information Model (CIM), making it immediately usable for:

• Splunk Enterprise Security
• Security Essentials
• Custom correlation searches
• SOC dashboards and reporting

Initial Usage Workflow

1. Install the app and complete the Setup page.
2. Create and enable one or more Trellix ePO Inputs.
3. Verify that data is being indexed.
4. Use the built-in dashboards or create your own searches and alerts.
5. (Optional) Integrate with Splunk Enterprise Security for advanced detections.

Configuring and Using Inputs

Creating Inputs

1. Go to Settings → Data Inputs → Trellix ePO Input.
2. Click New.
3. Provide a unique Input Name.
4. Select the Data Source Type.
5. Configure polling interval, index, and batch size.
6. Save and enable the input.

Supported Data Sources and Usage

Threat Events

• Near–real-time visibility into detected threats
• Used for SOC triage, alerts, and correlation
• CIM model: Intrusion_Detection

Example search:

index=security sourcetype=trellix_epo:threat_events
| stats count by severity, threatName

Malware Detections

• Detailed malware detection and file context
• Supports hash-based IOC analysis
• CIM model: Malware

Example search:

index=security sourcetype=trellix_epo:malware_detections
| stats count by malwareName, host

Host Status

• Endpoint inventory and health visibility
• Useful for asset management and hygiene checks
• CIM model: Endpoint

Example search:

index=security sourcetype=trellix_epo:host_status
| stats latest(datVersion) by host

Agent Status

• Monitor agent connectivity and health
• Identify offline or outdated agents
• CIM model: Endpoint

Policy Compliance

• Track policy violations and compliance state
• Useful for audits and security posture reviews
• CIM model: Change

Quarantine Events

• Visibility into quarantined files and actions
• Supports incident investigation workflows
• CIM model: Malware

Updates

• DAT and engine version tracking
• Identify outdated or failing endpoints
• CIM model: Endpoint

User Actions

• Audit trail of administrative and user actions
• Supports security auditing and investigations
• CIM model: Audit

Dashboards

Trellix ePO Security Overview (REST API)

This is the primary dashboard for data collected via the REST API.

Key Use Cases

• SOC monitoring and daily review
• Threat trend analysis
• Endpoint health and coverage checks
• Compliance and audit reporting

Main Sections

• Security overview and threat trends
• Endpoint and agent health
• Threat intelligence and IOC analysis
• Policy compliance status
• User activity and audit actions

How to Use

• Apply global filters (time range, host, severity)
• Drill down into panels to investigate incidents
• Pivot from dashboards to raw events

Trellix ePO Syslog Threat Events Dashboard

This dashboard is intended for environments where ePO sends threat events via syslog.

Key Use Cases

• Analyze syslog-based threat events
• Correlate syslog data with REST API data
• Investigate IOC activity from logs

Usage Notes

• Configure the correct syslog sourcetype
• Use dashboard filters to refine searches
• Review raw syslog messages for validation

Working with CIM and Enterprise Security

Because all supported data sources are CIM-normalized:

• Data automatically appears in Splunk Enterprise Security dashboards
• You can build correlation searches without custom field mapping
• Risk-based alerting (RBA) can be applied to Trellix events

Example CIM-based search:

| datamodel Malware search
| stats count by malware_name, dest_host

Alerts and Correlation Searches

Common alert use cases include:

• High-severity malware detections
• Repeated infections on the same host
• Agents offline for extended periods
• Policy violations exceeding thresholds
• Suspicious administrative activity

Example alert search:

index=security sourcetype=trellix_epo:threat_events severity=High
| stats count by host, threatName

Best Practices

• Use incremental collection to avoid duplicates.
• Separate high-volume and low-volume inputs.
• Use a dedicated security index.
• Align polling intervals with operational needs.
• Regularly review dashboards and alerts.
• Keep CIM and the add-on updated.

Typical User Roles

• SOC Analysts: Monitor threats, investigate incidents, review dashboards.
• Security Engineers: Tune inputs, dashboards, and alerts.
• Splunk Administrators: Manage performance, indexes, and upgrades.
• Compliance Teams: Review policy and audit data.

Upgrade and Maintenance

• Disable inputs before upgrading.
• Upgrade the app via Splunkbase or manual install.
• Restart Splunk after upgrades.
• Re-enable inputs and validate data ingestion.

Notes and Limitations

• This is a non-official, community-maintained add-on.
• API availability and fields depend on ePO version and configuration.
• Very large environments may require tuning of intervals and batch sizes.

By following these usage instructions, users can quickly operationalize Trellix ePO data in Splunk for monitoring, investigation, compliance, and security analytics.