Security

How to capture attack signature of Symantec EPO server in Splunk?

Aleena
Explorer

Hi Team,

I need to create a use case with the field "attack signature" from Symantec logs. i already have Symantec log but that does not have attack signature field.

Do i need to enable anything in logging? How can i achieve the above scenario?

Thanks in Advance🙏

 

 

Labels (1)
Tags (1)
0 Karma

shivanshu1593
Builder

Is it not under the interesting fields or is it not even in the raw events? If it is under raw events, please share some sample data, and I'll help you to extract it, both at search time or Index time, depending upon your requirement.

If it never came, even in the raw events, then you may need to contact your Symantec AV admin. As far as my experience goes with AVs, this field should at least be in the raw events.

Thank you,

S

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

Aleena
Explorer

Hi S,

Thanks for getting back to me. We don't have attack signature field in raw log.. we only receive the following raw log from Symantec. Please let me know what log we have to pull from Symantec to get attack signature field.

2020-10-08T07:20:42+08:00     Abc(ip address)      Oct 8 07:30:15     xyz (hostname) SymantecServer:    Site: My Site,   Server Name: xxxx,    Domain Name: Default,The management server received the client log successfully     Xxx(username)

Thankyou,

A

Tags (1)
0 Karma

shivanshu1593
Builder

Hey Aleena,

Apologies for coming back to this so late. These are the audit logs of the management server of the Symantec AV, and not the threat logs.

Were you able to resolve this? If not, what are you using to get the logs to Splunk? A UF, Splunk DB connect, syslog? 

Thank you,

S

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

Aleena
Explorer

hi Shivanshu,

Thanks for getting back to me. I will check whether we have enable audit log from Mgmt server. And we are using UF/HF for forwarding logs to Splunk.

 

Thankyou,

Aleena

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...