Dashboards & Visualizations

Splunk Integration with ATP (EDR) logs

Explorer

Hi All,
Currently, we are facing issue while integrating the Symantec EDR (ATP) logs to Splunk.
I tried to refer the Splunk Add-on for EDR (https://splunkbase.splunk.com/app/3454/) and Splunk App for EDR (https://splunkbase.splunk.com/app/3453). But, these Apps and add-ons are no more supported by Splunk.

We were referring the Symantec Splunk connector Integration document and followed the steps as per the document. (https://support.symantec.com/us/en/article.doc11188.html)

  • Created a new HEC Token and enabled the token.
  • On the Symantec connector side, we configured this token and when we tested it, it displays a message as:

"Splunk telemetry notification sent : [SPLUNK_UPLOAD_FAILURE: cause=Splunk event upload failed. Http code [403], reason [Exception occurred while parsing response]" due to which we are unable to send the logs to Splunk

They are getting a token error on Symantec connector though I confirmed that we are using the same connector that was created on Splunk Heavy Forwarder. We performed this steps multiple times but no luck.

Kindly check the issue and guide us. regards, Santosh

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!