Symantec Endpoint Protection🔗
The following instructions are for configuring Symantec Endpoint Protection (SEP) for log ingestion into Secureworks® Taegis™ XDR.
XDR normalizes the following SEP log types:
- Intrusion Prevention System
- Antivirus
- Browser Protection
Connectivity Requirements🔗
| Source | Destination | Port/Protocol |
|---|---|---|
| SEP Manager | Taegis™ XDR Collector (mgmt IP) | UDP/514 |
Taegis IP Address Ranges🔗
If you have an existing firewall or API gateway IP allow list configured for this integration, or are planning to configure one, add the following XDR IP address ranges for your Taegis region.
| Taegis Region | IP Address Range |
|---|---|
| Charlie | 216.9.204.0/24 |
| Delta | 216.9.204.0/24 |
| Echo | 216.9.205.0/24 |
| Foxtrot | 216.9.206.0/24 |
| Golf | 216.9.207.0/24 |
| Hotel | 208.89.40.0/24 |
| India | 208.89.42.0/24 |
| Juliet | 208.89.41.0/24 |
| Kilo | 208.89.43.0/24 |
| Quebec | 208.89.44.0/24 |
Note
These would be the only IP ranges required for XDR integrations. If you previously configured older IP addresses, we recommend removing them after 30 days.
Data Provided from Integration🔗
| Normalized Data | Out-of-the-Box Detections | Vendor-Specific Detections | |
|---|---|---|---|
| Symantec Endpoint Protection | Antivirus, NIDS |
Note
XDR detectors are not guaranteed to be triggered, even if a data source's logs are normalized to a schema associated with a given detector. However, you can create Custom Detection Rules to generate detections based on normalized data from a data source.
Configure the Symantec Endpoint Protection Platform🔗
Register a Syslog Server🔗
Follow the instructions in the Symantec Endpoint Protection - Exporting data to a Syslog server article to configure log forwarding.
| Field | Required Value |
|---|---|
| Syslog Server | XDR Collector (mgmt IP) |
| Destination Port | 514 |
| Log Facility | Default |
Advanced Search using the Query Language🔗
Example Query Language Searches🔗
To search for antivirus events from the last 24 hours:
FROM antivirus WHERE sensor_type = 'Symantec Endpoint Protection' and EARLIEST=-24h
To search for nids events where the process was blocked:
FROM nids WHERE sensor_type = 'Symantec Endpoint Protection' and blocked = 1
To search for nids events associated with a specific host:
FROM nids WHERE sensor_type='Symantec Endpoint Protection' AND host_id = 'foo'
Event Details🔗
