- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I have Splunk 6 and Enterprise Security 3 (latest version). I'm also indexing data from our Symantec endpoints.
There is an app: "Splunk for Symantec" but also technology add-ons: "TA-sep" and "TA-sav" (depending on Symantec version).
Considering that I'm running Enterprise Security, which apps and add-ons do I really need?
This is my understanding:
- I'm assuming that I don't need the full "Splunk for Symantec" app since I have Enterprise Security and ES has the endpoint/malware dashboards that I need.
- I'm assuming that I need the TA-sep and TA-sav apps to index the Symantec data properly.
I'm a little confused between the Symantec App and the Symantec TA's and how they are different and how they affect (or don't affect) Enterprise Security so I'm just looking for some clarity. For example, if I disable the Splunk for Symantec app does that mean I will stop indexing Symantec data? And if so, then what are the TA's for? Ditto for BlueCoat... there is an app but also a technology add-on.
Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi,
ES uses data from the CIM, so you need the TA's to map the data. The Symantec app can provide Symantec specific reports in addition.
Jack
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi,
ES uses data from the CIM, so you need the TA's to map the data. The Symantec app can provide Symantec specific reports in addition.
Jack
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks, that's what I thought... I'll disable the Symantec App and then run a test to see if it affected the indexing/data in any way.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Where do I download Symantec 12 Technology Add-on?????
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The TA is included with the app - try here: $SPLUNK_HOME/etc/apps/SplunkforSymantec/appserver/addons/TA-sepapp12
