Some events do not appear in your SIEM from SEDR syslog

Products

• Endpoint Detection and Response

Issue/Introduction

You have integrated Symantec EDR with your SIEM, configured the syslog server and enabled event activity on the EDR but you notice that some events such as 8001: Process Event, and other 8xxx events have not been forwarded to your SIEM.

Environment

Release : 4.6.0 and later

Component : Syslog

Cause

ECC, endpoint activity recorder, and search data are not forwarded to syslog.

 

See Forwarding events and incidents to third-party SIEMs for an explanation of what data is forwarded via SEDR sylog.

Resolution

Event forwarding, Splunk and other connectors are provided to enable the forwarding of all events.