Splunk Add-on for Symantec Endpoint Protection misindexes Endpoint Protection Manager 14.2 RU1 external logging

Products

• Endpoint Protection

Issue/Introduction

The Splunk Add-on for Symantec Endpoint Protection (SEP) allows a Splunk platform administrator to collect data from Symantec Endpoint Protection Manager (SEPM) external logging dump files agt_security.log and agt_risk.log. After the events are indexed, the data can be consumed using Splunk's pre-built dashboard panels, which are included with the add-on. This add-on provides the inputs and CIM-compatible knowledge to use with other Splunk Enterprise apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance.

After an upgrade to SEPM 14.2 RU1 (14.2.3332.1000), the Splunk Add-on for Symantec Endpoint Protection misindexes the dump files..

Environment

• SEPM 14.2 RU1
• Splunk Add-on for Symantec Endpoint Protection Version 2.3.0

Cause

In 14.2 RU1, the external logging of agt_risk.log and agt_security.log was restructured:

agt_risk.log 14.2 MP1 (14.2.1015.0100) 14.2 RU1 (14.2.3332.1000) Time Stamp  Time Stamp Risk Action Risk Action IP Address IP Address Computer name Computer name Intensive Protection Level Source Certificate issuer Risk name Certificate signer Occurrences Certificate thumbprint File Path Signing timestamp Description Certificate serial number Actual action Source Requested action Risk name Secondary action Occurrences Event time File Path Event Insert Time Description End Time Actual action Last update time Requested action Domain Name Secondary action Group Name Event time Server Name Event Insert Time User Name End Time Source Computer Name Last Update Time Source Computer IP Domain Name Disposition Group Name Download site Server Name Web domain User Name Downloaded by Source Computer Name Prevalence Source Computer IP Confidence Disposition URL Tracking Status Download site First Seen Web domain Sensitivity Downloaded by Permitted Application Reason Prevalence Application hash Confidence Hash type URL Tracking Status Company name [Extra Blank column(Unused)] Application name First Seen Application version Sensitivity Application type Permitted Application Reason File size (bytes) Application hash Category set Hash type Category type Company name Location Application name Intensive Protection Level Application version Certificate issuer Application type Certificate signer File size (bytes) Certificate thumbprint Category set Signing timestamp Category type Certificate serial number Location

agt_security.log  14.2 MP1 (14.2.1015.0100) 14.2 RU1 (14.2.3332.1000) 14.3 RU1 Event Time Event Time Event Time Severity Severity Severity Host Name Host Name Host Name SHA-256 Event Description Event Description MD-5 Local Host IP Local Host IP Event Description Local Host MAC Local Host MAC Local Host IP Remote Host Name Remote Host Name Local Host MAC Remote Host IP Remote Host IP Remote Host Name Remote Host MAC Remote Host MAC Remote Host IP Traffic Direction Traffic Direction Remote Host MAC Network Protocol Network Protocol Traffic Direction Hack Type Hack Type Network Protocol Begin Time Begin Time Hack Type End Time End Time Begin Time Occurrences Occurrences End Time Application Name Application Name Occurrences Location Location Application Name User Name User Name Location Domain Name Domain Name User Name Local Port Local Port Domain Name Remote Port Remote Port Local Port  CIDS Signature ID CIDS Signature ID Remote Port  CIDS Signature string CIDS Signature string CIDS Signature ID CIDS Signature SubID CIDS Signature SubID CIDS Signature string Intrusion URL  Intrusion URL CIDS Signature SubID Intrusion Payload URL Intrusion Payload URL Intrusion URL SHA-256 SHA-256 Intrusion Payload URL  MD-5 MD-5     Browser Protection

Resolution

This change is by design. Please check with the vendor for instructions on performing these modifications.