All Apps and Add-ons

Symantec Endpoint Cloud data - Action field

aparnajegan
New Member

In Infosec app, Malware dashboard primarily uses the field "Action". I have integrated Symantec Endpoint Protection Cloud data but it doesnot have the field action or any field values such as allowed or blocked.Is there any other field in SEP cloud data which correlates with the action?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...