Support for user-defined data sources

Products

• Information Centric Analytics

Issue/Introduction

Information Centric Analytics (ICA) uses security event and entity data gathered by your organization's management and monitoring tools to provide an up-to-date, unified view of the prioritized risks and threats to your organization. The data are imported into ICA using predefined integration packs, user-defined integration packs, and solution accelerators. The imported data are then compared to and analyzed with data already collected in ICA.

Data import is configured using the Integration section within the administration section of the Risk Fabric console. The Integration section contains the following sub-sections:

• Integration Packs: Allows you to import predefined integration packs for a variety of Symantec products and third-party products, like Microsoft Active Directory
• Data Sources: Defines sources of data and the queries used to retrieve data
• Data Integrations: Maps data from data source tables to ICA's core tables
• Job Status: Lists the status of integration jobs including run times and outcomes

Together, the Data Sources and Data Integrations sections are known as the Integration Wizard (IW). If your organization uses sources that are not included in the Symantec set of predefined integration packs, you can create integration packs using the IW.

Many third-party products are integrated through the IW, which provides methods for ingesting data from flat files, SQL queries, and certain APIs (for example, Splunk and Elasticsearch). For those products that must be integrated through the IW, what level of support does Broadcom offer for creating these integrations?

Resolution

Broadcom supports the use of the IW and will assist with troubleshooting errors that arise in the course of creating a user-defined integration; however, Broadcom does not provide consultative services or support for selecting and configuring the data to be ingested from these data sources. This includes the creation of SQL statements and API queries. Best-effort support may be offered at a support engineer's discretion to troubleshoot errors returned by user-defined queries and scripts, but with no warranty explicit or implied as to the suitability of any potential solutions for your particular use cases.

For guidance on the use of the IW, please refer to the Symantec ICA Integration and Solution Accelerator Guides.

If you require additional consultative assistance, you must engage professional services. Contact your account team for more information. Additional information can also be found on the Symantec Professional Services website.