--- id: symantec-endpoint-security-service title: Symantec Endpoint Security sidebar_label: Symantec Endpoint Security description: The Sumo Logic app for Symantec Web Security provides real-time insights into the log data by leveraging the Symantec Endpoint Security Service. slug: /help/docs/integrations/saas-cloud/symantec-endpoint-security-service/ canonical: https://www.sumologic.com/help/docs/integrations/saas-cloud/symantec-endpoint-security-service/ --- import useBaseUrl from '@docusaurus/useBaseUrl'; Symantec icon Symantec Endpoint Security safeguards organizations from various network threats and risks. The Sumo Logic app for Symantec Endpoint Security provides visibility into log data by using the Symantec Endpoint Security Service. This service collects and forwards the Symantec Endpoint Security data to Sumo Logic for analysis, offering a comprehensive view of the endpoint security statuses through various widgets. These widgets present essential information, including the number of incidents categorised by type, impacted hosts, malicious files, threat details, and critical or high-severity incidents. The dashboard also highlights potential security vulnerabilities, such as the top 10 affected hosts, IP addresses, and malicious files. This allows administrators to monitor and manage endpoint security in real time, enhancing quick responses to threats. By utilizing the Symantec Endpoint Security Service, organizations can protect their employees' endpoints and enhance their defenses against emerging threats. :::info This app includes [built-in monitors](#symantec-endpoint-security-monitors). For details on creating custom monitors, refer to [Create monitors for Symantec Endpoint Security app](#create-monitors-for-symantec-endpoint-security-app). ::: ## Log types This app uses [Symantec Endpoint Security Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source/) to collect the incidents and event logs from the Symantec Endpoint Security platform. ### Sample log message
Incident Log ```json { "customer_uid": "TEST-JvOsaJktSS-eyL-dXhxOvA", "incident_uid": "afb07d00-89dd-4813-8e1e-3ed5fa83444d", "type": "INCIDENT_UPDATE", "conclusion": "Suspicious Activity", "remediation": "Change the credentials for accounts which have accessed this endpoint. Employ software whitelisting tools to prevent unauthorized access to the LSASS process and the Windows Registry Security Accounts Manager. Mandate that administrator accounts have unique passwords per system to limit the exposure caused by the theft of credentials. Similarly, avoid the inclusion of user or domain accounts in local administrator groups to limit exposure due to credential theft associated with such accounts.", "priority_id": 4, "category_id": 1, "modified": "2023-04-26T23:38:48.634+00:00", "state_id": 1, "id": 4, "product_uid": "31B0C880-0229-49E8-94C5-48D56B1BD7B9", "device_time": 1682552328634, "ref_incident_uid": 102106, "rule_name": "Advanced Attack Technique", "created": "2023-04-26T15:44:19.345+00:00", "type_id": 8076, "incident_url": "https://sep.securitycloud.symantec.com/v2/incidents/incidentListing/afb07d00-89dd-4813-8e1e-3ed5fa83444d/details", "message": "OS Credential Dumping", "version": "1.0", "product_name": "Symantec Integrated Cyber Defense Manager", "event_id": 80760004, "domain_uid": "TEST-ZBg_IqnyTAijNjP2BOOcuw", "detection_type": "Advanced Analytics", "severity_id": 4, "time": 1682552328634, "suspected_breach": "Yes" } ```
Event Log ```json { "customer_uid": "TEST-JvOsaJktSS-eyL-dXhxOvA", "incident_uid": "6af35ed1-ee4a-463a-a40d-dde000dead84", "type": "INCIDENT_CREATION", "conclusion": "Malicious File", "remediation": "You can isolate the endpoint(s), remove the file(s) and/or clean the system(s).", "priority_id": 4, "category_id": 1, "modified": "2023-04-26T21:01:13.426+00:00", "state_id": 1, "id": 4, "product_uid": "31B0C880-0229-49E8-94C5-48D56B1BD7B9", "events": [ { "type_id": 8031, "type": "sandbox_file_detection", "id": 14, "message": "Sandbox result for the 'Chrome.exe' file is malicious.", "user_name": "SYSTEM", "device_uid": "KLXOjk4ET-CeJZBA3iipkw", "device_name": "Victim-1", "device_time": "2023-04-26T21:01:09.003Z", "severity_id": 5, "category_id": 1, "feature_uid": "3F3DC574-02A7-11E9-8EB2-F2801F1B9FD1", "product_uid": "E3A8F790-52A2-4BE3-87D7-93698CDDD021", "status_detail": "File is malicious", "command_uid": "365f1e54-8cb6-4d6c-9478-078e456709e3", "status_id": 1, "device_ip": "172.28.53.29", "device_os_name": "Windows 10 Professional Edition", "device_domain": "evilcorp.com", "product_ver": "14.3.9513.7000", "customer_uid": "TEST-JvOsaJktSS-eyL-dXhxOvA", "domain_uid": "TEST-ZBg_IqnyTAijNjP2BOOcuw", "ref_uid": "2e080e9a-791f-33fd-90b7-de575f267025", "threat": { "provider": "Cynic", "type_id": 5, "name": "Threat Detected By Cynic", "risk_id": 100, "id": 0 }, "file": { "path": "C:\\Users\\edradmin\\Desktop\\Chrome.exe", "name": "Chrome.exe", "sha2": "39fff7c11c59ce946cfec471d99baaa832266a07ab6f30cd123e385ca9436efa" }, "version": "1.0", "product_name": "Symantec Endpoint Detection and Response", "feature_name": "Endpoint Detection and Response", "feature_ver": "1.0", "edr_event_data_type": "malicious", "event_data_type": "sep", "user": { "name": "SYSTEM" }, "time": "2023-04-26T21:01:09.003Z", "timezone": 0, "log_time": "2023-04-26T21:01:11.285Z", "uuid": "8031:77c48db0-e475-11ed-d50e-0000633d5a56", "log_name": "event_service_6_t2_2023-04-26" } ], "device_time": 1682542873426, "ref_incident_uid": 102108, "rule_name": "Critical Cynic Detections", "created": "2023-04-26T21:01:13.426+00:00", "type_id": 8075, "incident_url": "https://sep.securitycloud.symantec.com/v2/incidents/incidentListing/6af35ed1-ee4a-463a-a40d-dde000dead84/details", "message": "Sandbox detection: Chrome.exe", "version": "1.0", "product_name": "Symantec Integrated Cyber Defense Manager", "event_id": 80750004, "domain_uid": "TEST-ZBg_IqnyTAijNjP2BOOcuw", "detection_type": "Sandbox", "severity_id": 5, "time": 1682542873426, "suspected_breach": "No" } ```
### Sample queries ```sumo title="Incidents by Severity" _sourceCategory="Labs/SES" !device_uid | json "incident_uid", "type", "severity_id", "priority_id", "category_id", "conclusion", "detection_type", "state_id", "suspected_breach", "created", "modified", "message", "incident_url", "rule_name", "product_name", "remediation" as incident_uid, type, severity, priority, category, conclusion, detection_type, state, suspected_breach, created_timestamp, modified_timestamp, message, incident_url, rule_name, product_name, remediation nodrop | if (severity in ("1", "2", "6") , "Reserved", if (severity matches "3", "Minor", if (severity matches "4", "Major", if (severity matches "5", "Critical", "Other")))) as severity | if (category matches "1", "Security", "Other") as category | if (state matches "0" , "Unknown", if (state matches "1", "New", if (state matches "2", "In Progress", if (state matches "3", "On Hold", if (state matches "4", "Resolved", if (state matches "5", "Closed", "Other")))))) as state // global filters | where severity matches "{{severity}}" | where category matches "{{category}}" | where type matches "{{type}}" | where state matches "{{state}}" | where conclusion matches "{{conclusion}}" | count by incident_uid, severity | count by severity | sort by _count, severity ``` ```sumo title="Incidents Over Time" _sourceCategory="Labs/SES" !device_uid | json "incident_uid", "type", "severity_id", "priority_id", "category_id", "conclusion", "detection_type", "state_id", "suspected_breach", "created", "modified", "message", "incident_url", "rule_name", "product_name", "remediation" as incident_uid, type, severity, priority, category, conclusion, detection_type, state, suspected_breach, created_timestamp, modified_timestamp, message, incident_url, rule_name, product_name, remediation nodrop | if (severity in ("1", "2", "6") , "Reserved", if (severity matches "3", "Minor", if (severity matches "4", "Major", if (severity matches "5", "Critical", "Other")))) as severity | if (category matches "1", "Security", "Other") as category | if (state matches "0" , "Unknown", if (state matches "1", "New", if (state matches "2", "In Progress", if (state matches "3", "On Hold", if (state matches "4", "Resolved", if (state matches "5", "Closed", "Other")))))) as state // global filters | where severity matches "{{severity}}" | where category matches "{{category}}" | where type matches "{{type}}" | where state matches "{{state}}" | where conclusion matches "{{conclusion}}" | timeslice 1d | count by incident_uid, state, _timeslice | count as frequency by _timeslice, state | fillmissing timeslice, values all in state | transpose row _timeslice column state ``` ```sumo title="Top 10 Devices by Events" _sourceCategory="Labs/SES" device_uid | json "events", "incident_uid", "type", "conclusion", "rule_name", "message", "suspected_breach", "detection_type", "product_name", "incident_url" as events, incident_uid, incident_type, incident_conclusion, incident_rule_name, incident_message, suspected_breach, detection_type, incident_product_name, incident_url | parse regex field=events "(?\{(?:[^\{\}]|\{[^\{\}]*\})*\})" multi | json field=event "uuid", "severity_id", "category_id", "type", "edr_event_data_type", "device_name", "user_name", "file.name", "file.path", "file.sha2", "device_uid", "device_ip", "device_os_name", "device_domain", "threat.id", "threat.type_id", "threat.name", "threat.risk_id", "threat.provider", "message", "type_id", "status_detail", "product_name", "feature_name" as uuid, severity, category, type, edr_event_type, device_name, user_name, file_name, file_path, file_sha2, device_uid, device_ip, device_os_name, device_domain, threat_id, threat_type_id, threat_name, threat_risk_id, threat_provider, message, type_id, status_detail, product_name, feature_name nodrop | if (severity in ("1", "2", "6") , "Reserved", if (severity matches "3", "Minor", if (severity matches "4", "Major", if (severity matches "5", "Critical", "Other")))) as severity | if (category matches "1", "Security", "Other") as category // global filters | where severity matches "{{severity}}" | where category matches "{{category}}" | where type matches "{{type}}" | where user_name matches "{{user_name}}" | where device_name matches "{{device_name}}" | where !isBlank(device_name) | count by device_name, uuid | count as frequency by device_name | sort by frequency, device_name | limit 10 ``` ## Collection configuration and app installation import CollectionConfiguration from '../../reuse/apps/collection-configuration.md'; :::important Use the [Cloud-to-Cloud Integration for Symantec Endpoint Security Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source/) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Symantec Endpoint Security app is properly integrated and configured to collect and analyze your Symantec Endpoint Security data. ::: ### Create a new collector and install the app import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md'; ### Use an existing collector and install the app import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md'; ### Use an existing source and install the app import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md'; ## Viewing the Symantec Endpoint Security dashboards import ViewDashboards from '../../reuse/apps/view-dashboards.md'; ### Incidents Overview The **Symantec Endpoint Security - Incidents Overview** dashboard provides details on security incidents, their severity, priority, and current status across your endpoint environment. Use this dashboard to: * Quickly assess the overall security posture by viewing the number of total, open, high severity, and high priority incidents. * Identify trends in incident types and categories to focus on areas requiring immediate attention or process improvements. * Monitor incident resolution times and track the progress of open incidents to ensure timely response and remediation. * Prioritize incidents by severity and priority to allocate resources effectively and address the most critical threats first. * Analyze the distribution of incidents across different states and detection types to understand the lifecycle of security events in your environment. Symantec Endpoint Security - Incidents Overview ### Events Overview The **Symantec Endpoint Security - Events Overview** dashboard provides details on security events, their severity, types, and geographical distribution across the protected endpoints. Use this dashboard to: * Quickly assess the overall security posture by viewing the total events, high severity events, and suspicious files counts at the top of the dashboard. * Analyze event trends over time and identify peak periods of security incidents using the Events Over Time graph. * Identify the most affected devices, allowing for targeted investigation and remediation of compromised assets. * Visualize the geographical distribution of affected devices and event locations to detect potential regional attack patterns or vulnerabilities. Symantec Endpoint Security - Events Overview ## Create monitors for Symantec Endpoint Security app import CreateMonitors from '../../reuse/apps/create-monitors.md'; ### Symantec Endpoint Security monitors | Name | Description | Trigger Type (Critical / Warning / MissingData) | Alert Condition | |:--|:--|:--|:--| | `Devices With Multiple Incidents` | This alert is triggered when a device is associated with multiple incidents. It helps you to monitor and stop potentially harmful devices, enhancing your ability to identify suspicious activity. | Critical | Count > 0 | | `File Execution in Suspicious Path` | This alert is triggered when some file activity happens from the suspicious file path. It helps you to monitor activity from unusual or suspicious file paths, enhancing your ability to identify suspicious activity. | Critical | Count > 0 | | `High Priority or Severity Incidents Detected` | This alert is triggered when an incident is created with high priority or severity. It helps you to monitor and stop potentially harmful events that could compromise endpoint security. | Critical | Count > 0 | | `High-Risk Threat Detected by Cynic` | This alert is triggered when a high-risk threat is detected by the cynic. It allows you to quickly identify endpoints with a high concentration of threat activity, enabling swift action to contain and remediate potential infections. | Critical | Count > 0 | | `Hight-Severity Malicious File Detected` | This alert is triggered when a known malicious file with high severity is detected running on a device. It helps you to monitor and stop potentially harmful files that could compromise device security and network integrity. | Critical | Count > 0 | | `Incidents Detected from Embargoed Locations` | This alert is triggered when an incident is detected from a location identified as high-risk. This helps you to monitor incidents from unusual or restricted geographic locations, enhancing your ability to identify suspicious activity. | Critical | Count > 0 | | `Sandbox Malicious File Detected` | This alert is triggered when a known malicious file is detected by the sandbox. It helps you to monitor and stop potentially harmful files that could compromise device security and network integrity. | Critical | Count > 0 | | `Spike in Impacted Devices Count` | This alert is triggered when a spike is detected in the number of impacted devices. It helps you to monitor and stop potentially harmful devices, enhancing your ability to identify suspicious activity. | Critical | Count > 0 | | `Unresolved Incident Aging Beyond 7 days` | This alert is triggered when an incident is created and remains unresolved for 7 days. It helps you to monitor pending incidents for an extended period, enhancing your ability to identify suspicious activity. | Critical | Count > 0 | ## Upgrade/Downgrade the Symantec Endpoint Security app (Optional) import AppUpdate from '../../reuse/apps/app-update.md'; ## Uninstalling the Symantec Endpoint Security app (Optional) import AppUninstall from '../../reuse/apps/app-uninstall.md';