topic Re: Symantec email security.cloud to Splunk Cloud in Splunk Cloud Platform

Symantec email security.cloud to Splunk Cloud

cnuguri_ncc — Fri, 06 Nov 2020 12:03:26 GMT

Hello,

I am looking to onboard Symantec email security.cloud data to Splunk cloud, but the add-on seems not compatible/available on Splunk Cloud ( https://splunkbase.splunk.com/app/3830/ ), could someone please advise if there is another way ?

I suppose using an on-prem HF for the add-on and forward data Splunk could work, although trying to avoid on-prem components if it is possible to onboard directly from IDM.

Thanks in advance.
Chaith

Re: Symantec email security.cloud to Splunk Cloud

richgalloway — Fri, 06 Nov 2020 13:59:30 GMT

The standard practice for onboarding data when a TA cannot be installed in Splunk Cloud is to use an on-prem heavy forwarder.

Re: Symantec email security.cloud to Splunk Cloud

cnuguri_ncc — Fri, 06 Nov 2020 14:33:42 GMT

Thanks @richgalloway 👍

I was hoping to hear that Symantec supports HEC or another way of forwarding logs, before taking the on-prem HF route.

Re: Symantec email security.cloud to Splunk Cloud

richgalloway — Fri, 06 Nov 2020 15:39:40 GMT

AFAIK, Symantec does not support HEC, but you could write your own program/script that reads Symantec data and converts it to HEC.