Splunk for Symantec SEP

[vleung]

Is anyone using Splunk for Symantec? Does it replaces the Symantec SEP management console?

[markteicherhp]

I installed Symantec for Splunk and SEP Management Server on a separate machine, it does not appear the logs are being received, there must be a trick to get logs being sent correctly

thanks

[astatrial]

Hi,
Did you installed everything properly ?
You need to configure the forwarder in order to send symantec logs.
Please refer to the next manual
https://docs.splunk.com/Documentation/AddOns/released/SymantecEP/About

[o_calmels]

I,

In reporting, Splunk For Symantec add more features than the reporting in the SEPM console. Nevertheless, the SEPM console is absolutely indispensable to manage the SEP Solution.
Splunk For Symantec is best for:

• Get all the logs from a single client (the console just display a category of log for a client, not all at the same time)
• Associate SEPM logs with other security products of your compagny, like FireWall Gateways, DNS, proxy Etc ... in a way that you can make relations between these events and find relevent risk.
• Make your own reports, SEPM do not allow you to create your reports, just using the proposed one.
• List item

Cheers
Olivier.