Configure Network Security Manager to send syslog data to the Splunk Add-on for McAfee

To enable the Splunk Add-on for McAfee NSP to collect data from McAfee Network Security Manager, you need to configure McAfee Network Security Manager to send the events using syslog in custom format to the data collection node of your Splunk platform installation. Splunk best practice is to use SC4S.

Enable Syslog for Firewall Access Events

1. Navigate to Manager -> <Admin Domain> -> Setup -> Notification -> Firewall Access Events
2. Select "Yes" for the "Enable Syslog Notification" option
3. Provide all the necessary and relevant information and click Save
4. After saving the changes, "System Default" and "Customized" message body options are available. Select the "Customized" option and click on "Edit".
5. Enter the customized event format for Firewall Events and click on Save.
6. Click on "Save" again on the Firewall Access Events page for saving all the changes.

Enable Syslog for Alert Events

1. Navigate to Manager -> <Admin Domain> -> Setup -> Notification -> IPS Events -> Syslog
2. Select "Yes" for the "Enable Syslog Notification" option and click on Save
3. Create a Syslog Notification Profile by clicking on "+" and provide all the necessary and relevant information.
4. Enter the customized event format for Alert Events and click on Save

Enable Syslog for Fault Events

1. Navigate to Manager -> <Admin Domain> -> Setup -> Notification -> Faults -> Syslog
2. Select "Yes" for the "Enable Syslog Notification" option
3. Provide all the necessary and relevant information and click Save
4. After that, you are provided an option for System Default or Customized Message Preference. Select the "Customized" option and click on Edit.
5. Enter the customized event format for Fault Events and click on Save.
6. Click on "Save" on the Fault Syslog page for saving all the changes.

Enable Syslog for Audit Events

1. Navigate to Manager -> <Admin Domain> -> Setup -> Notification -> User Activity -> Syslog
2. Select "Yes" for the "Enable Syslog Notification" option
3. Provide all the necessary and relevant information
4. Click on Apply. After that, you are provided an option for System Default or Customized Message Preference. Select the "Customized" option and click on Edit.
5. Enter the customized event format for Audit Events and click on Save.
6. Click on "Save" on the Audit Syslog page for saving all the changes.

See Format specification for different types of events for a customized event format.