HOW TO CONNECT SYMANTEC ENDPOINT PROTECTION LOGS TO SENTINEL?

If you can get the data from SEP to a Syslog Server: https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/endpoint-protection/all/Monitoring-Reporting-and-Enforcing-Compliance/viewing-logs-v7522439-d37e464/exporting-data-to-a-syslog-server-v8442743-d15e1107.html you can the use the Parser in the Sentinel Github? https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/SymantecEndpointProtection/SymantecEndpointProtection.txt (you need to edit the server names in the Parser). I've never tried this in a CSP sub though. Source: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Symantec%20Endpoint%20Protection/Data%20Connectors/Connector_Syslog_SymantecEndpointProtection.json