SOLVED
Home

How to configure Symantec endpoint protection manager logs using azure sentinel data connectors?

%3CLINGO-SUB%20id%3D%22lingo-sub-682820%22%20slang%3D%22en-US%22%3EHow%20to%20configure%20Symantec%20endpoint%20protection%20manager%20logs%20using%20azure%20sentinel%20data%20connectors%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-682820%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20team%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20not%20able%20to%20add%20Symantec%20Endpoint%20Protection%20Manager%20logs%20to%20Sentinel.%20Can%20anyone%20help%20me%20on%20this.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-686364%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20configure%20Symantec%20endpoint%20protection%20manager%20logs%20using%20azure%20sentinel%20data%20connectors%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-686364%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F357536%22%20target%3D%22_blank%22%3E%40dkjagadabi%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ESymantec%20have%20instructions%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fsupport.symantec.com%2Fen_US%2Farticle.HOWTO130011.html%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.symantec.com%2Fen_US%2Farticle.HOWTO130011.html%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20need%20to%20select%20the%20same%20Log%20analytics%20workspace%20to%20copy%20the%20logs%20to%20that%20you%20open%20with%20Sentinel.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-693910%22%20slang%3D%22en-US%22%3ERE%3A%20How%20to%20configure%20Symantec%20endpoint%20protection%20manager%20logs%20using%20azure%20sentinel%20data%20connectors%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-693910%22%20slang%3D%22en-US%22%3EYou%20might%20also%20want%20to%20check%20the%20Dashboards%20in%20Github%20as%20these%20appear%20to%20have%20been%20updated%20in%20the%20last%20week%3A%20%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2FAzure%2FAzure-Sentinel%2Ftree%2Fmaster%2FDashboards%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgithub.com%2FAzure%2FAzure-Sentinel%2Ftree%2Fmaster%2FDashboards%3C%2FA%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Hi team,

 

I am not able to add Symantec Endpoint Protection Manager logs to Sentinel. Can anyone help me on this.

2 Replies
Highlighted
Solution

@dkjagadabi 

 

Symantec have instructions: https://support.symantec.com/en_US/article.HOWTO130011.html 

 

You need to select the same Log analytics workspace to copy the logs to that you open with Sentinel.

Highlighted
You might also want to check the Dashboards in Github as these appear to have been updated in the last week: https://github.com/Azure/Azure-Sentinel/tree/master/Dashboards