Symantec Endpoint Reporting App (SEP) Installation

hcorbett_ — Fri, 15 Apr 2011 14:31:15 GMT

Hello, I'm new to Splunk and I'm having some difficulty getting the SEP app working correctly.

(replace the dashes below with underscores..)

I do not see any data when I go to App -> Symantec Endpoint Protection Reporting, although I know that SEP logs are being indexed in prod-sep-logs because I can go to the search app and search for index="prod-sep-logs" and get results

Back on the SEP app, under 'Top Infections By Type,' if I click More Info (beside No Results Found) I see the following.. This search has completed and found 12,205 matching events. However, the transforming commands in the highlighted portion of the following search: search eventtype="sep-virusfound" | top limit=50 sep-riskname (top limit=50 sep-riskname is the part that is highlighted)

Back on the Search app ,if i search index="prod-sep-logs" I see that my logs currently contain 10 eventtypes including sep-virusfound, sep-management-downloadcontent, sep-management-receivelog, and so on.. so it appears that the eventtypes are working correctly

On the Search app, if I search - index="prod-sep-logs" eventtype="sep-virusfound" - I see all of the logs for this eventtype, but I do not see under 'Selected fields' or 'Other interesting fields' entries for sep-computername or sep-riskname, and if I append - | top sep-computername - or - | top sep-riskname - to my search I receive no results. So from my limited experience it looks like maybe the field extractions are not working correctly.

So I went to Manager and the Field Transformations and grabbed the regular expression for sep-virusfound.. I went to the Search app and searched for - index="prod-sep-logs" eventtype="sep-virusfound" -, then I selected Extract fields and under Generated pattern i clicked Edit and pasted the regex for sep-virusfound and clicked Apply.. Under Sample Extractions it appears to pull data correctly for sep-actualaction, sep-computername, sep-domainname, sep-endtime, ..., sep-username.. so the regex appears to be working correctly

Any idea why the regex is working correctly, but Splunk does not appear to know about the Fields?

Thanks for any help you can provide

Heath

Re: Symantec Endpoint Reporting App (SEP) Installation

dmceccoli — Mon, 28 Sep 2020 09:46:49 GMT

We just had the same problem. Check props.conf for the app. The delivered sourcetype "prod_sep_logs" did not match the sourcetype for our SEP logs. Once we matched them up it started working as expected.

Cheers, Dave

Re: Symantec Endpoint Reporting App (SEP) Installation

Brian_Osburn — Thu, 04 Aug 2011 16:09:52 GMT

Updated the documentation - thanks!

Re: Symantec Endpoint Reporting App (SEP) Installation

BP9906 — Mon, 28 Sep 2020 12:24:52 GMT

copying props.conf to 'local' and editing the [prod_sep_log] to match the inputs.conf sourcetype and restarting splunk didnt fix it. Whats wrong?

Re: Symantec Endpoint Reporting App (SEP) Installation

BP9906 — Mon, 17 Sep 2012 16:14:32 GMT

Discovered the SEP12 syslog is different than SEP11. I'm going to suggest a transformation change to support either.

topic Re: Symantec Endpoint Reporting App (SEP) Installation in Splunk Search

Symantec Endpoint Reporting App (SEP) Installation

Re: Symantec Endpoint Reporting App (SEP) Installation

Re: Symantec Endpoint Reporting App (SEP) Installation

Re: Symantec Endpoint Reporting App (SEP) Installation

Re: Symantec Endpoint Reporting App (SEP) Installation