Can automated notification be sent via syslog (or directly from Enforce) if a enforce console user has manually disabled an endpoint agent ?

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Enforce

Issue/Introduction

Is it feasible in Symantec DLP to send an automated notification ( to a defined group of recipients) via Splunk (or directly from Enforce) if a DLP administrator has manually disabled an endpoint agent?

Resolution

Currently, we don't have a function to report endpoint events to Syslog.