Splunk Search

how to retrive data from symantec end point protection

johnbenayun
New Member

Hi,

Does any one know how to get data from symantec endpoint protection server, so the "Symantec Endpoint Protection Reporting" app will work?

Best regards & Thanks, John.

Tags (1)
0 Karma

imarks004
Path Finder

From the SEP management console, click on Admin, then select Local Site. You should then see an option for Configure External Logging. From the Configure External Logging option you should be able specify a syslog server or send directly to your Splunk server.

Brian_Osburn
Builder

Did you set it up to send it to the splunk machine itself or just a flat file?

I found it easier to set up Splunk to listen on a port (I used 42096) and configure Symantec to talk to the server (in my case, plsplunk01:42096).

Brian

0 Karma

johnbenayun
New Member

great that worked now files are created ,
now i need to get splunk to read them (they are not on the same machine),
Any one?

0 Karma

o_calmels
Communicator

Hi, you ve got two solutions :
- Tell SEPM to send logs to syslog server, this server being your splunk instance (be carefull if your instance is distributed and you are using universal forwarder, the sourtype association will no work properly because universal forwarder doesn't modify any data, it just forward to indexers.)
- So the second solution is to install a universal fowarder on your SEPM server directly, install the Splunk For Symantec TA on it and configure the props.conf to match each file created by SEPM.

.
Cheers,
Olivier

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...