From abd72fd288c58f410f19fbf3316f8ebf4bba1161 Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Thu, 20 Jun 2024 16:46:52 +0530 Subject: [PATCH 01/10] Symantec Endpoint Security C2C doc --- blog-service/2024-06-24-collection.md | 13 +++ cid-redirects.json | 1 + .../index.md | 6 + .../symantec-endpoint-security-source.md | 109 ++++++++++++++++++ sidebars.ts | 1 + .../symantec-endpoint-security/example.json | 23 ++++ .../c2c/symantec-endpoint-security/example.tf | 21 ++++ 7 files changed, 174 insertions(+) create mode 100644 blog-service/2024-06-24-collection.md create mode 100644 docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md create mode 100644 static/files/c2c/symantec-endpoint-security/example.json create mode 100644 static/files/c2c/symantec-endpoint-security/example.tf diff --git a/blog-service/2024-06-24-collection.md b/blog-service/2024-06-24-collection.md new file mode 100644 index 0000000000..7fc8fc8602 --- /dev/null +++ b/blog-service/2024-06-24-collection.md @@ -0,0 +1,13 @@ +--- +title: Symantec Endpoint Security C2C Source (Collection) +image: https://help.sumologic.com/img/sumo-square.png +keywords: + - collection + - symantec-endpoint-security +hide_table_of_contents: true +authors: + - url: https://help.sumologic.com/release-notes-service/rss.xml + image_url: /img/release-notes/rss-orange.png +--- + +We're excited to announce the release of our new cloud-to-cloud source for Symantec Endpoint Security. This source collects incident and incident event data from the Symantec Endpoint Security platform using the [Incidents API](https://apidocs.securitycloud.symantec.com/#/doc?id=edr_incidents). [Learn more](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source). \ No newline at end of file diff --git a/cid-redirects.json b/cid-redirects.json index 064ca93b4e..5931288342 100644 --- a/cid-redirects.json +++ b/cid-redirects.json @@ -1744,6 +1744,7 @@ "/cid/1964": "/docs/integrations/security-threat-detection/f5-big-ip-ltm", "/cid/1965": "/docs/integrations/security-threat-detection/netskope", "/cid/1966": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/carbon-black-cloud-source", + "/cid/1987": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source", "/cid/1967": "/docs/integrations/web-servers/iis-10", "/cid/1968": "/docs/integrations/partner-ecosystem-apps/", "/cid/1969": "/docs/integrations/saas-cloud/opsgenie", diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md index 9c54e1d720..cb956203e5 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md @@ -432,6 +432,12 @@ In this section, we'll introduce the following concepts:

Learn to receive authentication logs from the Sophos Central APIs.

+
+
+ icon

Symantec Endpoint Security

 +

Learn to collect incident and incident events using the Symantec Incidents API.

+
+
icon

Symantec Web Security Service

 diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md new file mode 100644 index 0000000000..b9e7d7412f --- /dev/null +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md @@ -0,0 +1,109 @@ +--- +id: symantec-endpoint-security-source +title: Symantec Endpoint Security Source +sidebar_label: Symantec Endpoint Security +tags: + - cloud-to-cloud + - symantec-endpoint-security +description: Learn how to collect incident and incident events from the Symantec Endpoint Security source. +--- + +import CodeBlock from '@theme/CodeBlock'; +import MyComponentSource from '!!raw-loader!/files/c2c/symantec-endpoint-security/example.json'; +import TerraformExample from '!!raw-loader!/files/c2c/symantec-endpoint-security/example.tf'; +import useBaseUrl from '@docusaurus/useBaseUrl'; + +icon + +Symantec Endpoint Protection is a client-server solution that protects laptops, desktops, and servers in network against malware, risks, and vulnerabilities. Symantec Endpoint Protection combines virus protection with advanced threat protection to proactively secure the client computers against known and unknown threats. This integration collects these informations using the [Symantec Incidents API](https://apidocs.securitycloud.symantec.com/#/doc?id=edr_incidents) and ingests them into Sumo Logic. + +## Data collected + +| Polling Interval | Data Source | Description | +| :--- | :--- | :--- | +| 5 min | [Token](https://api.sep.securitycloud.symantec.com/v1/oauth2/tokens)| Used to generate a bearer token to subsequent API calls. | +| 5 min | [Incidents](https://api.sep.securitycloud.symantec.com/v1/incidents)| Used to retrieve incidents and incident events. | +| 5 min | [Incident Events](https://api.sep.securitycloud.symantec.com/v1/incidents/events)| Used to retrieve incident related events based on time range filter. | + +## Setup + +### Vendor configuration + +The Symantec Endpoint Security source requires you to provide an authentication token. To obtain the token, follow the steps below. +1. Sign in to the [Symantec Endpoint Security](https://login.broadcom.com/) platform. +1. Go to **Integration** and select **Client Applications**. +1. Click on **Add Client Application**. +1. Enter any name for the application and press the **Add** button. The client application details screen appears. +1. Select required privileges for the client application and click **Save**. +1. Click on **More Options icon** and select **Client Secret**. +1. Copy the **OAuth Credentials** value. +1. Run the below curl command with the required headers to generate the bearer token: + ``` + curl -X POST https://api.sep.securitycloud.symantec.com/v1/oauth2/tokens + -H “accept: application/json” + -H “authorization: {{OAuth Credentials value}}" + -H “content-type: application/x-www-form-urlencoded” + ``` + +### Source configuration + +When you create a Symantec Endpoint Security Source, you add it to a Hosted Collector. Before creating the source, identify the Hosted Collector you want to use or create a new Hosted Collector. For instructions, see [Configure a Hosted Collector](/docs/send-data/hosted-collectors/configure-hosted-collector). + +To configure a Symantec Endpoint Security Source, follow the steps below: +1. In the main Sumo Logic menu, select **Manage Data > Collection > Collection**. +1. On the Collection page, click **Add Source** next to a Hosted Collector. +1. Search for and select **Symantec Endpoint Security**. +1. Enter a **Name** for the Source. The description is optional. +1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`. +1. (Optional) **Fields**. Click the **+Add** button to define the fields you want to associate. Each field needs a name (key) and value. + * ![green check circle.png](/img/reuse/green-check-circle.png) A green circle with a check mark is shown when the field exists in the Fields table schema. + * ![orange exclamation point.png](/img/reuse/orange-exclamation-point.png) An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo Logic that does not exist in the Fields schema, it is ignored, also known as dropped. +1. In **Client ID**, enter the Client ID you generated from the Symantec Endpoint Security platform. +2. In **Client Secret**, enter the Client Secret you generated from the Symantec Endpoint Security platform. +3. (Optional) In **Initial LookBack**, enter the first collection start time. Default is 1 day and maximum is 30 days. +4. **Include Events**. Select this checkbox if you want to collect events from incidents. +5. (Optional) The **Polling Interval** is set for 24 hours by default. You can adjust it based on your needs. +6. (Optional) **Processing Rules for Logs**. Configure any desired filters, such as allowlist, denylist, hash, or mask, as described in Create a Processing Rule. +7. When you are finished configuring the Source, click **Save**. + +## JSON schema + +Sources can be configured using UTF-8 encoded JSON files with the Collector Management API. See [how to use JSON to configure Sources](/docs/send-data/use-json-configure-sources) for details.  + +| Parameter | Type | Value | Required | Description | +|:--|:--|:--|:--|:--| +| schemaRef | JSON Object | `{"type":"Symantec Endpoint Security"}` | Yes | Define the specific schema type. | +| sourceType | String | `"Universal"` | Yes | Type of source. | +| config | JSON Object | [Configuration object](#configuration-object) | Yes | Source type specific values. | + +### Configuration Object + +| Parameter | Type | Required | Default | Description | Example | +|:---|:---|:---|:---|:---|:---| +| name | String | Yes | `null` | Type a desired name of the source. The name must be unique per Collector. This value is assigned to the [metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) field `_source`. | `"mySource"` | +| description | String | No | `null` | Type a description of the source. | `"Testing source"` +| category | String | No | `null` | Type a category of the source. This value is assigned to the [metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) field `_sourceCategory`. See [best practices](/docs/send-data/best-practices) for details. | `"mySource/test"` +| fields | JSON Object | No | `null` | JSON map of key-value fields (metadata) to apply to the Collector or Source. Use the boolean field `_siemForward` to enable forwarding to SIEM.|`{"_siemForward": false, "fieldA": "valueA"}` | +| clientID | String | No | `null`| Client ID generated from the Symantec Endpoint Security platform. | | +| clientSecret | String | No | `null`| Client Secret generated from the Symantec Endpoint Security platform. | | +| incidentsIncludeEvents | String | No | false | Select the checkbox to include the incident events. | `5 minutes` | +| incidentsInitialLookback | Integer | No | 1 day | First collection start time. | | +| pollingInterval | String | No | 5 minutes | This sets how often the Source checks for data. | `5 minutes` | + +### JSON example + +{MyComponentSource} + +Download example + +### Terraform example + +{TerraformExample} + +Download example + +## FAQ + +:::info +Click [here](/docs/c2c/info) for more information about Cloud-to-Cloud sources. +::: \ No newline at end of file diff --git a/sidebars.ts b/sidebars.ts index 39fbc1a815..963ed4afac 100644 --- a/sidebars.ts +++ b/sidebars.ts @@ -313,6 +313,7 @@ module.exports = { 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/sentinelone-mgmt-api-source', 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/slack-source', 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/sophos-central-source', + 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source', 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-web-security-service-source', 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/tenable-source', 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/trellix-mvisio-epo-source', diff --git a/static/files/c2c/symantec-endpoint-security/example.json b/static/files/c2c/symantec-endpoint-security/example.json new file mode 100644 index 0000000000..249250a23c --- /dev/null +++ b/static/files/c2c/symantec-endpoint-security/example.json @@ -0,0 +1,23 @@ +{ + "api.version":"v1", + "source":{ + "config":{ + "name":"Symantec Endpoint Security Test", + "clientID":"********", + "incidentsIncludeEvents":true, + "incidentsInitialLookback":"1d", + "fields":{ + "_siemForward":false + }, + "clientSecret":"********", + "pollingInterval":"5m" + }, + "schemaRef":{ + "type":"Symantec Endpoint Security" + }, + "state":{ + "state":"Collecting" + }, + "sourceType":"Universal" + } + } \ No newline at end of file diff --git a/static/files/c2c/symantec-endpoint-security/example.tf b/static/files/c2c/symantec-endpoint-security/example.tf new file mode 100644 index 0000000000..adf0e02d6a --- /dev/null +++ b/static/files/c2c/symantec-endpoint-security/example.tf @@ -0,0 +1,21 @@ +resource "sumologic_cloud_to_cloud_source" "symantec-endpoint-security-source" { + collector_id = sumologic_collector.collector.id + schema_ref = { + type = "Symantec Endpoint Security" + } + config = jsonencode({ + "name":"Symantec Endpoint Security Test", + "clientID":"********", + "incidentsIncludeEvents":true, + "incidentsInitialLookback":"1d", + "fields":{ + "_siemForward":false + }, + "clientSecret":"********", + "pollingInterval":"5m" + }) +} +resource "sumologic_collector" "collector" { + name = "my-collector" + description = "Just testing this" +} \ No newline at end of file From 41d1de3fd1dbeb80bdd80ae8dd0477b4e44d4d1e Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Thu, 20 Jun 2024 17:28:05 +0530 Subject: [PATCH 02/10] minor fix --- docs/integrations/product-list.md | 2 +- .../symantec-endpoint-security-source.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/integrations/product-list.md b/docs/integrations/product-list.md index 3dbe11c236..3cf6c8acff 100644 --- a/docs/integrations/product-list.md +++ b/docs/integrations/product-list.md @@ -572,7 +572,7 @@ Types of integrations: | Thumbnail icon | [Stripe](https://stripe.com/) | Webhook: [Stripe](/docs/integrations/webhooks/stripe/) | | Thumbnail icon | [Sumo Logic](https://www.sumologic.com/) | Apps:
- [Enterprise Audit - Cloud SIEM](/docs/integrations/sumo-apps/cse/)
- [Sumo Logic Audit App](/docs/integrations/sumo-apps/audit/)
- [Sumo Logic Data Volume App](/docs/integrations/sumo-apps/data-volume/)
- [Sumo Logic Enterprise Audit Apps](/docs/integrations/sumo-apps/enterprise-audit/) (multiple apps)
- [Sumo Logic Enterprise Search Audit App](/docs/integrations/sumo-apps/enterprise-search-audit/)
- [Sumo Logic Infrequent Data Tier App](/docs/integrations/sumo-apps/infrequent-data-tier/)
- [Sumo Logic Log Analysis QuickStart App](/docs/integrations/sumo-apps/log-analysis-quickstart/)
- [Sumo Logic Security Analytics App](/docs/integrations/sumo-apps/security-analytics/)
Automation integrations:
- [Basic Tools](/docs/platform-services/automation-service/app-central/integrations/basic-tools/)
- [ESMTP](/docs/platform-services/automation-service/app-central/integrations/esmtp/)
- [HTTP Tools](/docs/platform-services/automation-service/app-central/integrations/http-tools/)
- [Incident Tools](/docs/platform-services/automation-service/app-central/integrations/incident-tools/)
- [IMAP](/docs/platform-services/automation-service/app-central/integrations/imap/)
- [Mail Tools](/docs/platform-services/automation-service/app-central/integrations/mail-tools/)
- [POP3](/docs/platform-services/automation-service/app-central/integrations/pop3/)
- [SMTP V3](/docs/platform-services/automation-service/app-central/integrations/smtp-v3/)
- [Sumo Logic Cloud SIEM](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-cloud-siem/)
- [Sumo Logic Cloud SIEM Internal](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-cloud-siem-internal/)
- [Sumo Logic Log Analytics](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-log-analytics/)
- [Sumo Logic Log Analytics Internal](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-log-analytics-internal/)
- [Sumo Logic Notifications](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-notifications/)
- [Triage Tools](/docs/platform-services/automation-service/app-central/integrations/triage-tools/)
- [ZIP Tools](/docs/platform-services/automation-service/app-central/integrations/zip-tools/) | | Thumbnail icon | [Superwise](https://superwise.ai/) | Webhook: [Superwise](/docs/integrations/webhooks/superwise/) | -| Thumbnail icon | [Symantec](https://sep.securitycloud.symantec.com/v2/landing) | App: [Symantec Web Security Service](/docs/integrations/saas-cloud/symantec-web-security-service/)
Automation integrations:
- [Javelin AD Protect](/docs/platform-services/automation-service/app-central/integrations/javelin-ad-protect/)
- [Symantec DeepSight](/docs/platform-services/automation-service/app-central/integrations/symantec-deepsight/)
- [Symantec EDR](/docs/platform-services/automation-service/app-central/integrations/symantec-edr/)
- [Symantec Endpoint Protection](/docs/platform-services/automation-service/app-central/integrations/symantec-endpoint-protection/)
- [Symantec Endpoint Protection Cloud](/docs/platform-services/automation-service/app-central/integrations/symantec-endpoint-protection-cloud/)
- [Symantec Secure Web Gateway (Bluecoat)](/docs/platform-services/automation-service/app-central/integrations/symantec-secure-web-gateway-bluecoat/)
- [Symantec WebPulse](/docs/platform-services/automation-service/app-central/integrations/symantec-webpulse/)
Collectors:
- [Symantec Web Security Service Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-web-security-service-source/)
- [Symantec Proxy Secure Gateway - Cloud SIEM](/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway/)
- [Symantec Proxy Secure Gateway (Blue Coat Proxy) - Cloud SIEM](/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway-blue-coat-proxy/) | +| Thumbnail icon | [Symantec](https://sep.securitycloud.symantec.com/v2/landing) | App: [Symantec Web Security Service](/docs/integrations/saas-cloud/symantec-web-security-service/)
Automation integrations:
- [Javelin AD Protect](/docs/platform-services/automation-service/app-central/integrations/javelin-ad-protect/)
- [Symantec DeepSight](/docs/platform-services/automation-service/app-central/integrations/symantec-deepsight/)
- [Symantec EDR](/docs/platform-services/automation-service/app-central/integrations/symantec-edr/)
- [Symantec Endpoint Protection](/docs/platform-services/automation-service/app-central/integrations/symantec-endpoint-protection/)
- [Symantec Endpoint Protection Cloud](/docs/platform-services/automation-service/app-central/integrations/symantec-endpoint-protection-cloud/)
- [Symantec Secure Web Gateway (Bluecoat)](/docs/platform-services/automation-service/app-central/integrations/symantec-secure-web-gateway-bluecoat/)
- [Symantec WebPulse](/docs/platform-services/automation-service/app-central/integrations/symantec-webpulse/)
Collectors:
- [Symantec Endpoint Security Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source/)
- [Symantec Web Security Service Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-web-security-service-source/)
- [Symantec Proxy Secure Gateway - Cloud SIEM](/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway/)
- [Symantec Proxy Secure Gateway (Blue Coat Proxy) - Cloud SIEM](/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway-blue-coat-proxy/) | | Thumbnail icon | [syslog-ng](https://www.syslog-ng.com/) | Automation integration: [Syslog-NG](/docs/platform-services/automation-service/app-central/integrations/syslog-ng/)
Collector: [syslog-ng](/docs/send-data/hosted-collectors/cloud-syslog-source/syslog-ng/) | ## T diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md index b9e7d7412f..66a13d9265 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md @@ -15,7 +15,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; icon -Symantec Endpoint Protection is a client-server solution that protects laptops, desktops, and servers in network against malware, risks, and vulnerabilities. Symantec Endpoint Protection combines virus protection with advanced threat protection to proactively secure the client computers against known and unknown threats. This integration collects these informations using the [Symantec Incidents API](https://apidocs.securitycloud.symantec.com/#/doc?id=edr_incidents) and ingests them into Sumo Logic. +Symantec Endpoint Protection is a client-server solution that protects laptops, desktops, and servers in network against malware, risks, and vulnerabilities. Symantec Endpoint Protection combines virus protection with advanced threat protection to proactively secure the client computers against known and unknown threats. This integration collects these information using the [Symantec Incidents API](https://apidocs.securitycloud.symantec.com/#/doc?id=edr_incidents) and ingests them into Sumo Logic. ## Data collected From 207820c9f46127d186751433f348cd3858b99ef9 Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Fri, 21 Jun 2024 11:23:51 +0530 Subject: [PATCH 03/10] Update docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md Co-authored-by: John Pipkin (Sumo Logic) --- .../symantec-endpoint-security-source.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md index 66a13d9265..5045b27044 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md @@ -15,7 +15,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; icon -Symantec Endpoint Protection is a client-server solution that protects laptops, desktops, and servers in network against malware, risks, and vulnerabilities. Symantec Endpoint Protection combines virus protection with advanced threat protection to proactively secure the client computers against known and unknown threats. This integration collects these information using the [Symantec Incidents API](https://apidocs.securitycloud.symantec.com/#/doc?id=edr_incidents) and ingests them into Sumo Logic. +Symantec Endpoint Protection is a client-server solution that protects laptops, desktops, and servers in networks against malware, risks, and vulnerabilities. Symantec Endpoint Protection combines virus protection with advanced threat protection to proactively secure client computers against known and unknown threats. This integration collects this information using the [Symantec Incidents API](https://apidocs.securitycloud.symantec.com/#/doc?id=edr_incidents) and ingests it into Sumo Logic. ## Data collected From f5cd06be993babe599174eb369659b23f8d27142 Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Fri, 21 Jun 2024 11:23:56 +0530 Subject: [PATCH 04/10] Update docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md Co-authored-by: John Pipkin (Sumo Logic) --- .../symantec-endpoint-security-source.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md index 5045b27044..58b0139e47 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md @@ -35,7 +35,7 @@ The Symantec Endpoint Security source requires you to provide an authentication 1. Click on **Add Client Application**. 1. Enter any name for the application and press the **Add** button. The client application details screen appears. 1. Select required privileges for the client application and click **Save**. -1. Click on **More Options icon** and select **Client Secret**. +1. Click the **More Options** icon and select **Client Secret**. 1. Copy the **OAuth Credentials** value. 1. Run the below curl command with the required headers to generate the bearer token: ``` From e318cf892484ff180e14ce97ea7e007dd58c38ee Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Fri, 21 Jun 2024 11:24:02 +0530 Subject: [PATCH 05/10] Update docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md Co-authored-by: John Pipkin (Sumo Logic) --- .../symantec-endpoint-security-source.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md index 58b0139e47..7e301c5c51 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md @@ -68,7 +68,7 @@ To configure a Symantec Endpoint Security Source, follow the steps below: ## JSON schema -Sources can be configured using UTF-8 encoded JSON files with the Collector Management API. See [how to use JSON to configure Sources](/docs/send-data/use-json-configure-sources) for details.  +Sources can be configured using UTF-8 encoded JSON files with the Collector Management API. See [Use JSON to Configure Sources](/docs/send-data/use-json-configure-sources) for details.  | Parameter | Type | Value | Required | Description | |:--|:--|:--|:--|:--| From affac4697182e9d89243ed4a8becd1e7a6460d9d Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Fri, 21 Jun 2024 15:13:35 +0530 Subject: [PATCH 06/10] Update docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md Co-authored-by: Paulina Kruczek <131657663+paulina-kruczek-sumo@users.noreply.github.com> --- .../symantec-endpoint-security-source.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md index 7e301c5c51..7f3fa00672 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md @@ -29,7 +29,7 @@ Symantec Endpoint Protection is a client-server solution that protects laptops, ### Vendor configuration -The Symantec Endpoint Security source requires you to provide an authentication token. To obtain the token, follow the steps below. +The Symantec Endpoint Security source requires you to provide credentials. To obtain the client secret, follow the steps below. 1. Sign in to the [Symantec Endpoint Security](https://login.broadcom.com/) platform. 1. Go to **Integration** and select **Client Applications**. 1. Click on **Add Client Application**. From 60c036e5b8fd0a544e3ce377fbdc565f1a122e8e Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Fri, 21 Jun 2024 15:13:47 +0530 Subject: [PATCH 07/10] Update docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md Co-authored-by: Paulina Kruczek <131657663+paulina-kruczek-sumo@users.noreply.github.com> --- .../symantec-endpoint-security-source.md | 8 -------- 1 file changed, 8 deletions(-) diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md index 7f3fa00672..8b0e015e30 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md @@ -36,14 +36,6 @@ The Symantec Endpoint Security source requires you to provide credentials. To ob 1. Enter any name for the application and press the **Add** button. The client application details screen appears. 1. Select required privileges for the client application and click **Save**. 1. Click the **More Options** icon and select **Client Secret**. -1. Copy the **OAuth Credentials** value. -1. Run the below curl command with the required headers to generate the bearer token: - ``` - curl -X POST https://api.sep.securitycloud.symantec.com/v1/oauth2/tokens - -H “accept: application/json” - -H “authorization: {{OAuth Credentials value}}" - -H “content-type: application/x-www-form-urlencoded” - ``` ### Source configuration From 792f2a9aecbdf06e7285a03faaef28bd460f3b99 Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Fri, 21 Jun 2024 15:14:23 +0530 Subject: [PATCH 08/10] Update symantec-endpoint-security-source.md --- .../symantec-endpoint-security-source.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md index 8b0e015e30..3c4512a805 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md @@ -21,7 +21,6 @@ Symantec Endpoint Protection is a client-server solution that protects laptops, | Polling Interval | Data Source | Description | | :--- | :--- | :--- | -| 5 min | [Token](https://api.sep.securitycloud.symantec.com/v1/oauth2/tokens)| Used to generate a bearer token to subsequent API calls. | | 5 min | [Incidents](https://api.sep.securitycloud.symantec.com/v1/incidents)| Used to retrieve incidents and incident events. | | 5 min | [Incident Events](https://api.sep.securitycloud.symantec.com/v1/incidents/events)| Used to retrieve incident related events based on time range filter. | @@ -98,4 +97,4 @@ Sources can be configured using UTF-8 encoded JSON files with the Collector Ma :::info Click [here](/docs/c2c/info) for more information about Cloud-to-Cloud sources. -::: \ No newline at end of file +::: From 6689e099cd363948c0b76ef1a88d3c6378c518bb Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Wed, 26 Jun 2024 12:14:26 +0530 Subject: [PATCH 09/10] converted to beta --- blog-service/2024-06-24-collection.md | 13 ------------- .../cloud-to-cloud-integration-framework/index.md | 6 ------ .../symantec-endpoint-security-source.md | 9 +++++++-- sidebars.ts | 1 - 4 files changed, 7 insertions(+), 22 deletions(-) delete mode 100644 blog-service/2024-06-24-collection.md diff --git a/blog-service/2024-06-24-collection.md b/blog-service/2024-06-24-collection.md deleted file mode 100644 index 7fc8fc8602..0000000000 --- a/blog-service/2024-06-24-collection.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -title: Symantec Endpoint Security C2C Source (Collection) -image: https://help.sumologic.com/img/sumo-square.png -keywords: - - collection - - symantec-endpoint-security -hide_table_of_contents: true -authors: - - url: https://help.sumologic.com/release-notes-service/rss.xml - image_url: /img/release-notes/rss-orange.png ---- - -We're excited to announce the release of our new cloud-to-cloud source for Symantec Endpoint Security. This source collects incident and incident event data from the Symantec Endpoint Security platform using the [Incidents API](https://apidocs.securitycloud.symantec.com/#/doc?id=edr_incidents). [Learn more](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source). \ No newline at end of file diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md index cb956203e5..9c54e1d720 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md @@ -432,12 +432,6 @@ In this section, we'll introduce the following concepts:

Learn to receive authentication logs from the Sophos Central APIs.

-
-
- icon

Symantec Endpoint Security

 -

Learn to collect incident and incident events using the Symantec Incidents API.

-
-
icon

Symantec Web Security Service

 diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md index 3c4512a805..3983e4e4ed 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source.md @@ -1,12 +1,17 @@ --- id: symantec-endpoint-security-source -title: Symantec Endpoint Security Source -sidebar_label: Symantec Endpoint Security +title: Symantec Endpoint Security Source (Beta) +sidebar_label: Symantec Endpoint Security tags: - cloud-to-cloud - symantec-endpoint-security description: Learn how to collect incident and incident events from the Symantec Endpoint Security source. --- + + + + +

Closed Beta

import CodeBlock from '@theme/CodeBlock'; import MyComponentSource from '!!raw-loader!/files/c2c/symantec-endpoint-security/example.json'; diff --git a/sidebars.ts b/sidebars.ts index 963ed4afac..39fbc1a815 100644 --- a/sidebars.ts +++ b/sidebars.ts @@ -313,7 +313,6 @@ module.exports = { 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/sentinelone-mgmt-api-source', 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/slack-source', 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/sophos-central-source', - 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source', 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-web-security-service-source', 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/tenable-source', 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/trellix-mvisio-epo-source', From 880a069f023b124f0bc748a54a4cfe4351c4d98d Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Wed, 26 Jun 2024 12:48:39 +0530 Subject: [PATCH 10/10] Update product-list.md --- docs/integrations/product-list.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/integrations/product-list.md b/docs/integrations/product-list.md index 3cf6c8acff..3dbe11c236 100644 --- a/docs/integrations/product-list.md +++ b/docs/integrations/product-list.md @@ -572,7 +572,7 @@ Types of integrations: | Thumbnail icon | [Stripe](https://stripe.com/) | Webhook: [Stripe](/docs/integrations/webhooks/stripe/) | | Thumbnail icon | [Sumo Logic](https://www.sumologic.com/) | Apps:
- [Enterprise Audit - Cloud SIEM](/docs/integrations/sumo-apps/cse/)
- [Sumo Logic Audit App](/docs/integrations/sumo-apps/audit/)
- [Sumo Logic Data Volume App](/docs/integrations/sumo-apps/data-volume/)
- [Sumo Logic Enterprise Audit Apps](/docs/integrations/sumo-apps/enterprise-audit/) (multiple apps)
- [Sumo Logic Enterprise Search Audit App](/docs/integrations/sumo-apps/enterprise-search-audit/)
- [Sumo Logic Infrequent Data Tier App](/docs/integrations/sumo-apps/infrequent-data-tier/)
- [Sumo Logic Log Analysis QuickStart App](/docs/integrations/sumo-apps/log-analysis-quickstart/)
- [Sumo Logic Security Analytics App](/docs/integrations/sumo-apps/security-analytics/)
Automation integrations:
- [Basic Tools](/docs/platform-services/automation-service/app-central/integrations/basic-tools/)
- [ESMTP](/docs/platform-services/automation-service/app-central/integrations/esmtp/)
- [HTTP Tools](/docs/platform-services/automation-service/app-central/integrations/http-tools/)
- [Incident Tools](/docs/platform-services/automation-service/app-central/integrations/incident-tools/)
- [IMAP](/docs/platform-services/automation-service/app-central/integrations/imap/)
- [Mail Tools](/docs/platform-services/automation-service/app-central/integrations/mail-tools/)
- [POP3](/docs/platform-services/automation-service/app-central/integrations/pop3/)
- [SMTP V3](/docs/platform-services/automation-service/app-central/integrations/smtp-v3/)
- [Sumo Logic Cloud SIEM](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-cloud-siem/)
- [Sumo Logic Cloud SIEM Internal](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-cloud-siem-internal/)
- [Sumo Logic Log Analytics](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-log-analytics/)
- [Sumo Logic Log Analytics Internal](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-log-analytics-internal/)
- [Sumo Logic Notifications](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-notifications/)
- [Triage Tools](/docs/platform-services/automation-service/app-central/integrations/triage-tools/)
- [ZIP Tools](/docs/platform-services/automation-service/app-central/integrations/zip-tools/) | | Thumbnail icon | [Superwise](https://superwise.ai/) | Webhook: [Superwise](/docs/integrations/webhooks/superwise/) | -| Thumbnail icon | [Symantec](https://sep.securitycloud.symantec.com/v2/landing) | App: [Symantec Web Security Service](/docs/integrations/saas-cloud/symantec-web-security-service/)
Automation integrations:
- [Javelin AD Protect](/docs/platform-services/automation-service/app-central/integrations/javelin-ad-protect/)
- [Symantec DeepSight](/docs/platform-services/automation-service/app-central/integrations/symantec-deepsight/)
- [Symantec EDR](/docs/platform-services/automation-service/app-central/integrations/symantec-edr/)
- [Symantec Endpoint Protection](/docs/platform-services/automation-service/app-central/integrations/symantec-endpoint-protection/)
- [Symantec Endpoint Protection Cloud](/docs/platform-services/automation-service/app-central/integrations/symantec-endpoint-protection-cloud/)
- [Symantec Secure Web Gateway (Bluecoat)](/docs/platform-services/automation-service/app-central/integrations/symantec-secure-web-gateway-bluecoat/)
- [Symantec WebPulse](/docs/platform-services/automation-service/app-central/integrations/symantec-webpulse/)
Collectors:
- [Symantec Endpoint Security Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source/)
- [Symantec Web Security Service Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-web-security-service-source/)
- [Symantec Proxy Secure Gateway - Cloud SIEM](/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway/)
- [Symantec Proxy Secure Gateway (Blue Coat Proxy) - Cloud SIEM](/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway-blue-coat-proxy/) | +| Thumbnail icon | [Symantec](https://sep.securitycloud.symantec.com/v2/landing) | App: [Symantec Web Security Service](/docs/integrations/saas-cloud/symantec-web-security-service/)
Automation integrations:
- [Javelin AD Protect](/docs/platform-services/automation-service/app-central/integrations/javelin-ad-protect/)
- [Symantec DeepSight](/docs/platform-services/automation-service/app-central/integrations/symantec-deepsight/)
- [Symantec EDR](/docs/platform-services/automation-service/app-central/integrations/symantec-edr/)
- [Symantec Endpoint Protection](/docs/platform-services/automation-service/app-central/integrations/symantec-endpoint-protection/)
- [Symantec Endpoint Protection Cloud](/docs/platform-services/automation-service/app-central/integrations/symantec-endpoint-protection-cloud/)
- [Symantec Secure Web Gateway (Bluecoat)](/docs/platform-services/automation-service/app-central/integrations/symantec-secure-web-gateway-bluecoat/)
- [Symantec WebPulse](/docs/platform-services/automation-service/app-central/integrations/symantec-webpulse/)
Collectors:
- [Symantec Web Security Service Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-web-security-service-source/)
- [Symantec Proxy Secure Gateway - Cloud SIEM](/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway/)
- [Symantec Proxy Secure Gateway (Blue Coat Proxy) - Cloud SIEM](/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway-blue-coat-proxy/) | | Thumbnail icon | [syslog-ng](https://www.syslog-ng.com/) | Automation integration: [Syslog-NG](/docs/platform-services/automation-service/app-central/integrations/syslog-ng/)
Collector: [syslog-ng](/docs/send-data/hosted-collectors/cloud-syslog-source/syslog-ng/) | ## T