Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-mcafeeepo-setup

Integrate McAfee ePO

You can integrate McAfee ePO with Sophos XDR so that it sends data to Sophos for analysis. The integration uses a data collector, which receives third-party data and sends it to the Sophos Data Lake.

Key steps

The key steps in a McAfee ePO integration are as follows:

  • Install and configure a data collector if you haven't already done so.
  • Register a syslog server.
  • Configure McAfee ePO to send data to the data collector.

Requirements

The following is required for McAfee ePO configuration:

  • Check the requirements for the data collector you're using by reviewing the guides at Data collectors.

Add a McAfee ePO integration

To integrate McAfee ePO, you must first install a Sophos XDR data collector, then configure McAfee to send logs to it.

Install and configure a data collector

McAfee ePO must be configured to send logs to the Sophos XDR data collector. Logs are filtered and correlated in real-time for various security event observations. Go to Data collectors and follow the guide for creating a data collector if you haven't already done so.

Configure logging and enable monitoring

When the data collector is ready, you can configure McAfee ePO to send us data.

To set up event forwarding via syslog, do as follows:

  1. Register a syslog server by following the steps in McAfee's own guide: Register syslog servers. Be sure to configure the following data collector details:

    • IP address: Enter the Sophos XDR data collector's server IP address.
    • Port: Enter 6514.
    • Enable event forwarding: Turn on.

  2. Choose which events get forwarded to the Sophos XDR data collector by following the steps in McAfee's own guide: Determine which events are forwarded to the server.

    Select All events to the server and Events from any source.

Your McAfee ePO data should now appear in the Sophos Data Lake after validation.

Configuration notes

Keep the following in mind during McAfee ePO configuration:

  • You can configure multiple instances of McAfee to send data to Sophos via the same data collector. After you finish integration, repeat the steps in this section for your other instances of McAfee.

Additional resources

For more information on configuring McAfee ePO, see the following documents: