Symantec Endpoint Solutions

EventLog Analyzer collects log data from Symantec Endpoint Solutions and presents it in the form of graphical reports. For the solution to start collecting this log data from, it has to be added as a threat source.

Adding a Symantec Endpoint Solutions device as a threat source:

To add a Symnatec Endpoint Solutions device as a threat source, the syslog service has to be configured.

1. Login to the Symantec Endpoint Protection device as an administrator.
2. Navigate to Admin > Servers. Select the local site or remote site from which log data must be exported.
3. Click Configure External Logging.
4. In the General tab, from the Update Frequency list, choose how often log data should be sent to the file.
5. In the Master Logging Server list, select the management server to which the logs should be sent.
6. Check the Enable Transmission of Logs to a Syslog Server option.
7. Enter the following details in the given fields.
• Syslog Server- Enter the EventLog Analyzer IP address or domain name .
• Destination Port - Select the protocol to use and enter the destination port that the Syslog server should use to listen for Syslog messages.
• Log Facility - Enter the number of the log facility that you want the Syslog configuration file to use. Valid values range from 0 to 23. Alternatively, you could use the default values.
8. Click on OK.

1. In the EventLog Analyzer console, navigate to Settings > Log Source Configurations > Applications > Security Applications > Add Security Applications
2. Select Add-on type as Symantec
3. Expand the list by clicking the "+" icon to add a new device.
4. Choose from the drop-down menu to add Configured devices, Workgroup devices, domain devices, etc.
5. To add new devices manually, click on Configure Manually and enter Log Source >Select and click on Add.

Once the threat source is added, EventLog Analyzer will start parsing the fields in the logs. This log data can now be viewed in the form of reports.

The reports provide information on:

• Security risks
• Virus detected
• Port cans
• Installation of commercial applications
• Threat activities
• HIPS activities

EventLog Analyzer also provides reports on the top:

• Affected devices
• Source devices
• Risks
• Problems