CloudSOC events are not displayed in the ICA console

Products

• Information Centric Analytics

Issue/Introduction

After creating the CloudSOCDW database and configuring the JsonImporter utility to pull events from CloudSOC, no CloudSOC events are displayed in the ICA console.

Environment

Release : 6.x

Component : CloudSOC Import Utility

Cause

The CloudSOC integration procedure provided in the Symantec ICA Integration and Solution Guide directs the administrator performing the integration to execute the stored procedure dbo.spIW_UnattendedInstallCloudSOC and provides a list of parameters to pass as part of the statement. Some of these parameters are unnecessary and may cause the statement to fail.

Resolution

To complete the CloudSOC integration, replace the example statement provided under the Configuring the Integration Wizard Components heading in the Integrating Symantec CloudSOC with Information Centric Analytics section of the Symantec ICA Integration and Solution Guide with the following:

USE RiskFabric;
GO

EXEC dbo.spIW_UnattendedInstallCloudSOC
     @i_bUpdateExisting = 1,
     @i_sLinkedServerDataSource = '<CloudSOCDW-hostname>',
     @i_sLinkedServerCatalog = 'CloudSOCDW',
     @i_nJobIntervalMinutes = 60,
     @i_bRunDataSourceQueries = 1;

NOTE: Replace <CloudSOCDW-hostname> with the hostname or IP address of the server hosting the CloudSOCDW database.