Hi, I dealt with the identical issue. The only viable solution is to call an API. Or purchase Symantec's log parser exchange with a syslog output for SIEMS. This is purposely done. You can do so by following these steps: https://apidocs.securitycloud.symantec.com/#/doc?id=ses auth Generate an OAuth Key from the Symantec console in order to generate a bearer token with an expiration time for API calls. You have multiple alternatives, including Export Events and Export Stream Events, among others. The "Heavy Forwarder" server was what I used to execute these orders. The data can then be saved in a text file and parsed as desired. You can also design the Add-On yourself, but then you're responsible for its maintenance and updates... so it's not worth it. ... View more