Archive
Highlighted

How to install the add-on for Symantec end point protection?

Explorer

I'm not understanding the installation instructions. I currently have a forwarder installed on the Symantec server and it is forwarding data to the indexer. I've installed the Symantec add-on on the search head but getting error when trying to open the Symantec app. Does the app have to be installed on the indexer? What files do I need to configure and where?

0 Karma
Highlighted

Re: How to install the add-on for Symantec end point protection?

SplunkTrust
SplunkTrust

What error do you get when trying to open the app?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How to install the add-on for Symantec end point protection?

Explorer

I'm getting the 404 Page not found error. It's unable to find the "app/SplunkTAsymantec-ep/setup" page. I'm not sure if everything is setup correctly. The universal forwarder is installed on the "Symantec" server, the "Symantec end point" app is installed on the "Splunk Search Head". Does the "Symantec end point" app need to be installed on both the forwarder and search head?

0 Karma
Highlighted

Re: How to install the add-on for Symantec end point protection?

New Member

Hi,

do you have return for this problem ?
I would like to receive the SEP log . I don't know if i may install an forwarder and the SEP add on , or i can to configure the SEP manager to send log ( syslog UDP 514 default) to the Splunk Indexer and in this case , has the SEP add on is necessary ?

0 Karma
Highlighted

Re: How to install the add-on for Symantec end point protection?

New Member

I managed to send logs via UniversalForwarder, and I see them on the index.

But the homepage got an error at the first access.

I re-installed the app but still the same.

Anyone have the solution ?

I didn't find any action for this.

0 Karma
Highlighted

Re: How to install the add-on for Symantec end point protection?

SplunkTrust
SplunkTrust

@arssi This is an old thread. Please post a new question.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How to install the add-on for Symantec end point protection?

Engager

After much trial and error we cleared out everything and started fresh, we did use the new app for Symantec. and edited our inputs, index conf files. seem to be getting relevant info in Splunk security essentials app as well as independent searches. Its still a work in progress

0 Karma