ArcSight Ideas

Idea ID: 2879555

Symantec protection engine Integration with ArcSight Product Development

Mutheeb Ahmed khan

Status: Needs Clarification

Given the comment and reference to the SmartConnector for Microsoft Windows Event Log - Native guide, does this resolve your issue?

See status update history

3 months ago

We have Symantec protection engine application in our environment. we are trying to pull the application logs from the windows event viewer.

We are unbale to pull the logs from the event viewer.

I saw the grand list of smart connectors. There is nowhere mentioned about "Symantec Protection Engine Managed Components"

To let you know these logs are capture under event viewer and the event id's we wanted to pull are 101,103,104,105.

which our windows native smart connector is unbale to pull.

We apricate if we can get an solution for this type of integration with ArcSight.

I have attached snapshot from the event viewer for better understanding.

Tags:

connectors

Prentice Hayes 1 month ago

Hello Mutheeb Ahmed Khan,

Although the Symantec Protection Engine can log through the Microsoft Windows Event Viewer, it is not one of the supported application by the . Please see the Additional Connector Configurations section of the SmartConnector for Microsoft Windows Event Log - Native. You will need to write a FlexConnector parser for this log source (Symantec).

Apologies for the delay in responding to you. As you apparently filed this in the wrong area (thank you Dominique Kaiser ), it was not properly tagged for ArcSight Connectors. I am updating this ticket accordingly.

--
Prentice S. Hayes
Principal Product Manager | Cybersecurity Enterprise, Security Analytics
OpenText Cybersecurity

LinkedIn: https://www.linkedin.com/in/prenticeshayes/

Website: https://www.opentext.com/
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel
Dominique Kaiser 3 months ago

moved to ArcSight Idea Exchange (was created in AccuRev community).
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel

Resources

Learning Services

Partner Programs

Privacy

Compliance

Help

Company

Privacy Policy
Terms of Use
Cookies Preferences

Accessibility
Anti-Slavery Statement

Support
Contact Us

Careers
Code of Business Conduct and Ethics

The opinions expressed above are the personal opinions of the authors, not of OpenText. By using this site, you accept the Terms of Use. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.), Hewlett Packard Enterprise Company, or Micro Focus. As of January 31, 2023, the Material is now offered by OpenText, a separately owned and operated company. Any reference to the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks is historical in nature and the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks are the property of their respective owners.