Dashboards & Visualizations

Splunk Integration with ATP (EDR) logs

santosh_scb
Path Finder

Hi All,
Currently, we are facing issue while integrating the Symantec EDR (ATP) logs to Splunk.
I tried to refer the Splunk Add-on for EDR (https://splunkbase.splunk.com/app/3454/) and Splunk App for EDR (https://splunkbase.splunk.com/app/3453). But, these Apps and add-ons are no more supported by Splunk.

We were referring the Symantec Splunk connector Integration document and followed the steps as per the document. (https://support.symantec.com/us/en/article.doc11188.html)

  • Created a new HEC Token and enabled the token.
  • On the Symantec connector side, we configured this token and when we tested it, it displays a message as:

"Splunk telemetry notification sent : [SPLUNK_UPLOAD_FAILURE: cause=Splunk event upload failed. Http code [403], reason [Exception occurred while parsing response]" due to which we are unable to send the logs to Splunk

They are getting a token error on Symantec connector though I confirmed that we are using the same connector that was created on Splunk Heavy Forwarder. We performed this steps multiple times but no luck.

Kindly check the issue and guide us. regards, Santosh

0 Karma

muralimadhavan
Explorer

Hi Santosh,

Were you able to solve this problem.

Regards

Murali

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...