cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

Sending WGCS logs to on premise Splunk

Jump to solution

We have on-premises Splunk and would like to send the WGCS logs to it.  I read the community post at the link below, but is the Powershell script required if I'm running CSR 2.6 in EPO and I'm already pulling the logs into EPO?  We currently post process those off to our CASB and had hoped we could do the same type of thing by configuring a job to post process the WGCS logs off to Splunk.  Is that possible rather than following the instructions at the link below?

 

https://community.mcafee.com/t5/Documents/Web-Gateway-Cloud-Service-Cloud-Log-Puller-for-Windows/ta-...

1 Solution

Accepted Solutions
McAfee Employee aloksard
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: Sending WGCS logs to on premise Splunk

Jump to solution

Hi,

Hope you are doing well.

Example Bash Script for Log Pull from Web Gateway Cloud Service so that they can be imported into other reporting tools:-

 

https://community.mcafee.com/t5/Web-Gateway/Example-Bash-Script-for-Log-Pull-from-Web-Gateway-Cloud-...

 

 

SaaS Web Protection is our cloud web service also known as Web Gateway Cloud Service.It is a log pull from the cloud, it is not syslog enabled.Content Security Reporter can be used to schedule downloads and place them in a local directory or an http/https/ftp file share.There is an API that can be accessed via HTTPS to selectively pull logs. The API is documented in the WGCS product documentation there are multiple articles on community about pulling logs via API including one.

 

Rest API to pull logs to the SIEM or other device. There are 4 levels of data that can be pulled. Documentation is provided in the WGCS documentation “Using your own on-premise reporting solution”

 

https://docs.mcafee.com/bundle/web-gateway-cloud-service-product-guide/page/GUID-B24F5DAE-F9BB-44F7-...


CSR reference :-

https://community.mcafee.com/t5/Web-Gateway/WGCS-web-activity-logs-to-on-prem-CSR-ePO/td-p/583160


Powershell Script

 

https://community.mcafee.com/t5/Documents/Web-Gateway-Cloud-Service-Cloud-Log-Puller-for-Windows/ta-...

 

 

Regards

Alok Sarda

View solution in original post

2 Replies
McAfee Employee aloksard
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: Sending WGCS logs to on premise Splunk

Jump to solution

Hi,

Hope you are doing well.

Example Bash Script for Log Pull from Web Gateway Cloud Service so that they can be imported into other reporting tools:-

 

https://community.mcafee.com/t5/Web-Gateway/Example-Bash-Script-for-Log-Pull-from-Web-Gateway-Cloud-...

 

 

SaaS Web Protection is our cloud web service also known as Web Gateway Cloud Service.It is a log pull from the cloud, it is not syslog enabled.Content Security Reporter can be used to schedule downloads and place them in a local directory or an http/https/ftp file share.There is an API that can be accessed via HTTPS to selectively pull logs. The API is documented in the WGCS product documentation there are multiple articles on community about pulling logs via API including one.

 

Rest API to pull logs to the SIEM or other device. There are 4 levels of data that can be pulled. Documentation is provided in the WGCS documentation “Using your own on-premise reporting solution”

 

https://docs.mcafee.com/bundle/web-gateway-cloud-service-product-guide/page/GUID-B24F5DAE-F9BB-44F7-...


CSR reference :-

https://community.mcafee.com/t5/Web-Gateway/WGCS-web-activity-logs-to-on-prem-CSR-ePO/td-p/583160


Powershell Script

 

https://community.mcafee.com/t5/Documents/Web-Gateway-Cloud-Service-Cloud-Log-Puller-for-Windows/ta-...

 

 

Regards

Alok Sarda

View solution in original post

Re: Sending WGCS logs to on premise Splunk

Jump to solution

Thanks for the detailed response.

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community