107277

Support

Supported Products: Symantec Endpoint Protection 11 & 12
This app works on Splunk 4.3.x and 5.x

For setup help or any questions, please post them to answers.splunk.com
and tag it with SplunkforSymantec.

Change Log

1.0.3

Updated support information.

1.0.2

Fixed a bug in transforms.conf that caused field extractions not to work in a distributed environment

1.0.1

Fixed a bug in sep11 agent logs. Used a more consistent vocabulary across the app.

1.0

Small bug fixes

Beta 0.11

Fixed bug in TAs where log sourcetype was set as behavior instead of traffic

Beta 0.10

SEP 12 support
New Dashboards

Beta 0.9

Multiple dashboards to view firewall event data
Multiple dashbaords to view host event data
Dashboard to search for specific malware found by SEP

Installation

After downloading the app and going through the set up process, you still need to install either the Symantec 11 Technology Add-on or Symantec 12 Technology Add-on. If you are currently running both products, you should install both TAs. They are included with this app in the appserver/addons directory. For single server Splunk instances, the TAs will be on the same server as the app. For distributed Splunk instances, the TAs just needs to go on the indexers and the app just goes on the search heads.

Configuring the TAs

Data can be received via syslog or by monitoring the SEP log files on the SEP Manager. To receive data over syslog, manually set the sourcetype for the associated data input to either 'sep11:log' or 'sep12:log'. To monitor the files directly, you should install a Splunk Universal Forwarder on your management console. You'll need to set the log file location in the inputs.conf file and enable the associated file inputs. An example inputs.conf file is provided for you in the apps default directory. It's called inputs.conf.local. The default path in inputs.conf assumes that the SEP Manager is installed in C:\Program Files\Symantec\Symantec Endpoint Protection Manager. Edit this path to the actual location of the SEP Manager if necessary.

Splunk for Symantec

0