Symantec SOCView ICDx App for Splunk proxy support.

Products

• Endpoint Protection

Issue/Introduction

ICDx software had ability to set up a proxy for each collector. This is not applicable for the new Symantec SOCView ICDx App for Splunk.

Environment

Symantec SOCView ICDx App for Splunk deployment with multiple events sources.

Cause

Symantec SOCView ICDx App for Splunk does not support multiple per-input proxy settings.

This implementation was designed to make this settings universal.

Resolution

You can set up a proxy per instance of Symantec SOCView ICDx App.

The recommended in such scenario is to create a separate Splunk instance and make all instances to write data to common index.

For more information on Splunk proxy configuration reach the Splunk support directly.