Security

Symantec Endpoint Protection (SEP) firewall logs

fervin
Path Finder

Hello All,

Has anyone figured out a good way to perform field extractions on the data contained in SEP firewall logs? The SEP firewall syslog is pretty messy in how it presents the data and although we've gotten some usable results, it's far from polished. This is due mainly to the unpredictability of the way it logs events, with a variable number of fields depending on the nature of the firewall event. Thanks in advance,

-Frank

Tags (1)
0 Karma

Splunker
Communicator

Try using a forwarder on your SEP server as SEP puts logs in various files.

It might be easier parsing the logs if you know what logs to expect in each file (input).

I ran across the same problem trying to sort the logs from SEP that are being sent via syslog (their missing event codes such as the Cisco PIX uses).

As an aside, the Splunk ESS suite understands SEP logs, but i'm not sure how exactly.

Hoe it helps.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...