icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Symantec EDR App for Splunk
SHA256 checksum (symantec-edr-app-for-splunk_109.tgz) 2f2ad66fd76d057bfdda27f531e38894029e4940023c7e7445c6d6426b2f4f05 SHA256 checksum (symantec-edr-app-for-splunk_108.tgz) c5406624a323edba065f52ec17b575eeb832061b0522b4e39c4ead162856c6ca SHA256 checksum (symantec-edr-app-for-splunk_106.tgz) 87e5bb9b5bff82cf10807412b54a173dda237d3641a333bad466ab8d07bb54d5 SHA256 checksum (symantec-edr-app-for-splunk_105.tgz) 2dc04658395b39298f29fbfa6361afc4b6eece2bac45779158b19a46891c717f SHA256 checksum (symantec-edr-app-for-splunk_104.tgz) 8f9ae3cb3481ec3d57edcc7d90172aedf06792e5fe70130487d8b9f81bd41edc SHA256 checksum (symantec-edr-app-for-splunk_103.tgz) adc4306d4e0539669fd250428910c845ab6a29d9a10aaf44a6548d4a10d35c5c SHA256 checksum (symantec-edr-app-for-splunk_101.tgz) ccd225d15599cc21f059e17e273eb13d0250997e087109d1d3da81e5ff6643a2 SHA256 checksum (symantec-edr-app-for-splunk_100.tgz) 0a005b818048879f8115fd6d0c78dbee369d0ee86a3ebc123e5d40d5e40e0999
To install your download
For instructions specific to your download, click the Details tab after closing this window.
To install apps and add-ons from within Splunk Enterprise
  1. Log into Splunk Enterprise.
  2. On the Apps menu, click Manage Apps.
  3. Click Install app from file.
  4. In the Upload app window, click Choose File.
  5. Locate the .tar.gz file you just downloaded, and then click Open or Choose.
  6. Click Upload.
  7. Click Restart Splunk, and then confirm that you want to restart.
To install apps and add-ons directly into Splunk Enterprise
  1. Put the downloaded file in the $SPLUNK_HOME/etc/apps directory.
  2. Untar and ungzip your app or add-on, using a tool like tar -xvf (on *nix) or WinZip (on Windows).
  3. Restart Splunk.
After you install a Splunk app, you will find it on Splunk Home. If you have questions or need more information, see Manage app and add-on objects.

Flag As Inappropriate

Symantec EDR App for Splunk

Splunk AppInspect Passed
Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
Symantec Endpoint Detection & Response (EDR) helps you to uncover, prioritize, investigate, remediate complex attacks across endpoint, email, network, and web from one console. Symantec EDR App for Splunk utilizes power of Splunk and provides you an aggregated as well as individual visualizations for Network, Endpoint and Email by collecting data from Symantec EDR and Symantec Email Security.cloud.

This App contains the dashboard visualization and requires https://splunkbase.splunk.com/app/3454/ to provide the data.

By clicking on the “Download” or “Install” button or using the licensed software, you agree to the terms and conditions of the Symantec Software License Agreement located at https://www.symantec.com/content/en/us/enterprise/eulas/splunk-app-eula-1-0.pdf.

The administrator guide is available on http://www.symantec.com/docs/TECH239938

Release Notes

Version 1.0.9
March 8, 2020

• Fixed AppInspect Failures

Version 1.0.8
Feb. 26, 2020

Version 1.0.6
April 17, 2017

- Changed Label of dropdown "IP Address" to "Source IP Address" in "Email Investigation" Dashboard.
- Renamed panel name from "Outbound CnC" to "Infected Systems" in "Network and Roaming Protection at a glance" dashboard.
- Changed savedsearch queries for Local Hosts by Conviction, Remote Hosts by Conviction, Outbound CnC, Web Traffic, Network Traffic panels.
- Changed savedsearch queries for "Sender Email/Domain" and "Recipient Email/Domain" dropdown in Email Investigation dashboard.
- Removed the logging of vulnerable fields in log files.
- Removed Panel "Hit counted by affected IP" from "Network and Roaming Protection at a glance" Dashboard.
- Changed labels of "Web Traffic" and "Network Traffic" panels line charts of "Network and Roaming Protection at a glance" dashboard.
- Fixed issue in "Adaptive Response" dashboard, "Top Actions by Name" drill down from "Search Name" and "User".

Version 1.0.5
March 27, 2017

* Version 1.0.5
- Removed TA installation feature on app install, administrator must install TA separately even for an all-in-one installation. This is due to certification requirement.

Version 1.0.4
Feb. 13, 2017

* Version 1.0.4
Version change to manage dependency with Symantec ATP Add-on for Splunk.

Version 1.0.3
Feb. 5, 2017

- Added drill down for "Attacks timeline" in "Email Protection" dashboard.
- Modified drill down for "Malicious File" in "Email Investigation" dashboard.
- Added "Delivery Time" and "Delivery Status" columns for "Malicious Email Traffic" in "Email Investigation" dashboard.
- Added filters of "Detection Type" and "Subject" in "Email Investigation" Dashboard.
- Added drill down in charts to "Email Investigation" dashboard from "Email Protection" dashboard.
- Added filter of Device UID in "Endpoint Investigation" dashboard.
- Resolved issue of the MD5 filter in "Email Investigation" dashboard.- Resolved issue of Troubleshooting Log panel not populating logs from index other than _internal.
- Removed drill down from fields other than "IP Address" and "Host Name" from "Seen on Endpoints" panel of "File Investigation" dashboard.
- Resolved issue of MD5 drill down not working in Email Investigation.
- Added domains of "Header From", "Envelope From" and "Header Reply To" values in the dropdown of "Domain" in "Domain

Version 1.0.1
Jan. 26, 2017

Version 1.0.0
Jan. 23, 2017


Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2020 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.