Sending WGCS logs to on premise Splunk

[nashcoop]

We have on-premises Splunk and would like to send the WGCS logs to it.  I read the community post at the link below, but is the Powershell script required if I'm running CSR 2.6 in EPO and I'm already pulling the logs into EPO?  We currently post process those off to our CASB and had hoped we could do the same type of thing by configuring a job to post process the WGCS logs off to Splunk.  Is that possible rather than following the instructions at the link below?

https://community.mcafee.com/t5/Documents/Web-Gateway-Cloud-Service-Cloud-Log-Puller-for-Windows/ta-...

[aloksard · Accepted solution]

Hi,

Hope you are doing well.

Example Bash Script for Log Pull from Web Gateway Cloud Service so that they can be imported into other reporting tools:-

https://community.mcafee.com/t5/Web-Gateway/Example-Bash-Script-for-Log-Pull-from-Web-Gateway-Cloud-...

SaaS Web Protection is our cloud web service also known as Web Gateway Cloud Service.It is a log pull from the cloud, it is not syslog enabled.Content Security Reporter can be used to schedule downloads and place them in a local directory or an http/https/ftp file share.There is an API that can be accessed via HTTPS to selectively pull logs. The API is documented in the WGCS product documentation there are multiple articles on community about pulling logs via API including one.

Rest API to pull logs to the SIEM or other device. There are 4 levels of data that can be pulled. Documentation is provided in the WGCS documentation “Using your own on-premise reporting solution”

https://docs.mcafee.com/bundle/web-gateway-cloud-service-product-guide/page/GUID-B24F5DAE-F9BB-44F7-...

CSR reference :-

https://community.mcafee.com/t5/Web-Gateway/WGCS-web-activity-logs-to-on-prem-CSR-ePO/td-p/583160

Powershell Script

https://community.mcafee.com/t5/Documents/Web-Gateway-Cloud-Service-Cloud-Log-Puller-for-Windows/ta-...

Regards

Alok Sarda

[nashcoop]

Thanks for the detailed response.