All Apps and Add-ons

Questions about Add on for Symantec Endpoint Security (Cloud based- API integration required)?

New Member

Hi Team

Currently Splunk offers the 3.3.0 Add on for Symantec Endpoint Protection (aka SEP), this is an onpremise product, but Symantec also has a completely Cloud based solution called Endpoint Security  (aka SES) that requires an integration with an API, I would like to know how Splunk is managing this kind of integration, my questions are:

1. Is there an Add on available that enables Splunk to collect data from the SES Cloud-API?

2. If not,  What is the recommendation from Splunk to address the SES logs into the SIEM?

3. When is going to be available an agent even for a intermediate connection?

Best Regards

Labels (1)
0 Karma

Loves-to-Learn Lots


I dealt with the identical issue. The only viable solution is to call an API. Or purchase Symantec's log parser exchange with a syslog output for SIEMS. This is purposely done.

You can do so by following these steps: auth

Generate an OAuth Key from the Symantec console in order to generate a bearer token with an expiration time for API calls. You have multiple alternatives, including Export Events and Export Stream Events, among others. The "Heavy Forwarder" server was what I used to execute these orders. The data can then be saved in a text file and parsed as desired.

You can also design the Add-On yourself, but then you're responsible for its maintenance and updates... so it's not worth it.

0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...