SOLVED
Home

How to configure Symantec endpoint protection manager logs using azure sentinel data connectors?

%3CLINGO-SUB%20id%3D%22lingo-sub-682820%22%20slang%3D%22en-US%22%3EHow%20to%20configure%20Symantec%20endpoint%20protection%20manager%20logs%20using%20azure%20sentinel%20data%20connectors%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-682820%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20team%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20not%20able%20to%20add%20Symantec%20Endpoint%20Protection%20Manager%20logs%20to%20Sentinel.%20Can%20anyone%20help%20me%20on%20this.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-686364%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20configure%20Symantec%20endpoint%20protection%20manager%20logs%20using%20azure%20sentinel%20data%20connectors%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-686364%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F357536%22%20target%3D%22_blank%22%3E%40dkjagadabi%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ESymantec%20have%20instructions%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fsupport.symantec.com%2Fen_US%2Farticle.HOWTO130011.html%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.symantec.com%2Fen_US%2Farticle.HOWTO130011.html%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20need%20to%20select%20the%20same%20Log%20analytics%20workspace%20to%20copy%20the%20logs%20to%20that%20you%20open%20with%20Sentinel.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-693910%22%20slang%3D%22en-US%22%3ERE%3A%20How%20to%20configure%20Symantec%20endpoint%20protection%20manager%20logs%20using%20azure%20sentinel%20data%20connectors%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-693910%22%20slang%3D%22en-US%22%3EYou%20might%20also%20want%20to%20check%20the%20Dashboards%20in%20Github%20as%20these%20appear%20to%20have%20been%20updated%20in%20the%20last%20week%3A%20%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2FAzure%2FAzure-Sentinel%2Ftree%2Fmaster%2FDashboards%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgithub.com%2FAzure%2FAzure-Sentinel%2Ftree%2Fmaster%2FDashboards%3C%2FA%3E%3C%2FLINGO-BODY%3E
dkjagadabi
New Contributor

Hi team,

 

I am not able to add Symantec Endpoint Protection Manager logs to Sentinel. Can anyone help me on this.

2 Replies
Solution

@dkjagadabi 

 

Symantec have instructions: https://support.symantec.com/en_US/article.HOWTO130011.html 

 

You need to select the same Log analytics workspace to copy the logs to that you open with Sentinel.

You might also want to check the Dashboards in Github as these appear to have been updated in the last week: https://github.com/Azure/Azure-Sentinel/tree/master/Dashboards
Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
46 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
29 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies