Integrating Symantec Endpoint Protection

Transcription

1 Integrating Symantec Endpoint Protection EventTracker Version 7.x Publication Date: Nov 8, 2013 EventTracker 8815 Centre Park Drive Columbia MD

2 About this Guide This guide provides instructions to configure Symantec Endpoint Protection to send the syslog events to EventTracker Enterprise. Scope The configurations detailed in this guide are consistent with EventTracker Enterprise version 7.X and later, and Symantec Endpoint Protection 11.0 and later. Audience Symantec Endpoint Protection users, who wish to forward syslog messages to EventTracker manager. The information contained in this document represents the current view of Prism Microsystems Inc. on the issues discussed as of the date of publication. Because Prism Microsystems must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Prism Microsystems, and Prism Microsystems cannot guarantee the accuracy of any information presented after the date of publication. This document is for informational purposes only. Prism Microsystems MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, this paper may be freely distributed without permission from Prism, as long as its content is unaltered, nothing is added to the content and credit to Prism is provided. Prism Microsystems may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Prism Microsystems, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. The example companies, organizations, products, people and events depicted herein are fictitious. No association with any real company, organization, product, person or event is intended or should be inferred Prism Microsystems Corporation. All rights reserved. The names of actual companies and products mentioned herein may be the trademarks of their respective owners. 1

3 Contents Introduction to Symantec Endpoint Protection... 3 Prerequisites... 3 Configuration... 3 Import SEP knowledge pack into EventTracker Import Category Import Alerts Import Tokens Verify SEP knowledge pack in EventTracker Verify SEP categories Verify SEP alerts Verify SEP tokens

4 Introduction to Symantec Endpoint Protection EventTracker support for Symantec s Antivirus and IDS/IPS events is now available. Symantec s security policy will consist of specific rules enabled with logging used to capture and send to EventTracker. These events will be auto-identified, if enabled, and parsed into the EventTracker report tables for later review. Prerequisites Prior to configuring Symantec Endpoint Protection and EventTracker, ensure that you meet the following prerequisites: Symantec Endpoint Protection 11.0 is installed. Proper access permissions to make configuration changes. Administrative user on Symantec Endpoint Protection Server. EventTracker v7.0 or later should be installed. Administrative access on EventTracker. Configuration You must enable and configure Syslog on Symantec Endpoint Protection prior to configuring EventTracker. To specify events log settings: 1. To login to Symantec Endpoint Protection Manager console, select the Start button, select All Programs, and then select Symantec Endpoint Protection Manager. 3

5 Figure 1 Login page of Symantec Endpoint Protection Manager Console displays. 4

6 Figure 2 2. Enter valid User name: and Password: and then click the Log On button. Symantec Endpoint Protection Manager displays. 3. In left pane, select Admin, select Servers node, and then select respective site node. 5

7 Figure 3 4. In Tasks pane, select Servers, and then select Configure External Logging. 6

8 Figure 4 External Logging for Local Site window displays. 7

9 Figure 5 5. Click Enable Transmission of Logs to a Syslog Server option. 6. Enter EventTracker information. 7. Click Export Logs to a Dump File option, and then click Limit Dump File Records option. 8. Enter the required limit entries. 9. Click Log Filter tab; check the required log types that have to be sent to EventTracker. 8

10 Figure 6 9

11 Import SEP knowledge pack into EventTracker 1. Launch EventTracker Control Panel. 2. Double click Export Import Utility. 3. Click Import tab. 4. Import Category/Alert/Tokens as given below. Import Category 1. Click Category option, and then click the browse button. Figure 7 2. Locate All SEP group categories.iscat file, and then click the Open button. 10

12 3. To import categories, click the Import button. EventTracker displays success message. Figure 8 4. Click OK, and then click the Close button. Import Alerts 1. Click Alert option, and then click the browse button. 11

13 Figure 9 2. Locate the All SEP group alerts.isalt file, and then click the Open button. 3. To import alerts, click the Import button. EventTracker displays success message. Figure Click OK, and then click the Close button. 12

14 Import Tokens 1. Click Token value option, and then click the browse button. Figure Locate the All SEP group tokens.istoken file, and then click the Open button. 3. To import tokens, click the Import button. EventTracker displays success message. 13

15 Figure Click OK, and then click the Close button. 14

16 Verify SEP knowledge pack in EventTracker Verify SEP categories 1. Logon to EventTracker Enterprise. 2. Click Admin dropdown, and then click Categories. 3. In Category Tree to view imported categories, scroll down and expand Symantec Endpoint Protection group folder to view the imported categories. Figure 13 15

17 Verify SEP alerts 1. Logon to EventTracker Enterprise. 2. Click Admin dropdown, and then click Alerts. 3. In Search field, type SEP ', and then click the Go button. Alert Management page will display all the imported Symantec Endpoint Protection alerts. Figure To activate the imported alerts, select the respective checkbox in the Active column. EventTracker displays message box. Figure Click OK, and then click the Activate Now button. NOTE: You can select alert notification such as Beep, , and Message etc. For this, select the respective checkbox in the Alert management page, and then click the Activate Now button. 16

18 Verify SEP tokens 1. Logon to EventTracker Enterprise. 2. Click the Admin dropdown, and then click Parsing rule. Imported Symantec Endpoint Protection tokens are added in Token-Value Groups list. Figure 16 17