Hi All,
Currently, we are facing issue while integrating the Symantec EDR (ATP) logs to Splunk.
I tried to refer the Splunk Add-on for EDR (https://splunkbase.splunk.com/app/3454/) and Splunk App for EDR (https://splunkbase.splunk.com/app/3453). But, these Apps and add-ons are no more supported by Splunk.
We were referring the Symantec Splunk connector Integration document and followed the steps as per the document. (https://support.symantec.com/us/en/article.doc11188.html)
- Created a new HEC Token and enabled the token.
- On the Symantec connector side, we configured this token and when we tested it, it displays a message as:
"Splunk telemetry notification sent : [SPLUNK_UPLOAD_FAILURE: cause=Splunk event upload failed. Http code [403], reason [Exception occurred while parsing response]" due to which we are unable to send the logs to Splunk
They are getting a token error on Symantec connector though I confirmed that we are using the same connector that was created on Splunk Heavy Forwarder. We performed this steps multiple times but no luck.
Kindly check the issue and guide us. regards, Santosh
