How to configure Symantec endpoint protection manager logs using azure sentinel data connectors?

[dkjagadabi]

Hi team,

I am not able to add Symantec Endpoint Protection Manager logs to Sentinel. Can anyone help me on this.

[#2 · Accepted solution]

@dkjagadabi 

Symantec have instructions: https://support.symantec.com/en_US/article.HOWTO130011.html 

You need to select the same Log analytics workspace to copy the logs to that you open with Sentinel.

[#3]

You might also want to check the Dashboards in Github as these appear to have been updated in the last week: https://github.com/Azure/Azure-Sentinel/tree/master/Dashboards

[#4]

@CliveWatson This is a 404 link, I can't even access this doc when logged into the broadcom site. Do you have an updated link by any change?

[#5]

Does this work? https://github.com/Azure/Azure-Sentinel

[#6]

No this did not give me much. I am trying to figure out how to actually forward the logs. I also noticed you do not have a SEP connector yet. I see one in the repo but it's not active on our instance.

[#7]

Is there any work around to forward Symantec end point protection manager to Azure Sentinel t2@paulhoff