Impelix IMPACT Integration
with Trellix ePolicy Orchestrator
The Impelix IMPACT platform ingests telemetry from your all your security products as well as third-party feeds (threat intelligence, cybersecurity risk, business resilience intelligence, etc.) and delivers event correlation, security control efficacy, and compliance monitoring.
We believe that the more data ingested into IMPACT, the more context you will have regarding security incidents, which will allow effective and efficient incident response and compliance management. Therefore, we encourage and facilitate connecting vendor products telemetry with Impelix IMPACT platform.
Trellix ePolicy Orchestrator
Syslog Forwarding from McAfee ePO
On the ePO server:
- Configure your ePO server to use the newly created syslog server:
- Add a new Registered Server and select Syslog for the type.
- Enter the FQDN of the IMPACT Appliance.
- Enter 6514 for the port
- Select Enable event forwarding.
- Click Test Connection.
- Flip back over to the IMPACT “Search” interface and search for the IP address of the McAfee ePO server. An entry should be listed on the Syslog tab.
- On the ePO server, click Save to save the syslog Registered Server.
Reference: https://kc.mcafee.com/corporate/index?page=content&id=KB87927
