Configuring Symantec Endpoint Protection V2 on Cortex XSOAR

As a security administrator, you need to ensure that your organization's endpoints are protected from potential threats. One way to do this is by integrating Symantec Endpoint Protection V2 with Cortex XSOAR, a comprehensive threat hunting and incident response platform. In this article, we will explore the process of configuring Symantec Endpoint Protection V2 on Cortex XSOAR.

Prerequisites

Before you begin, make sure that you have the necessary permissions to configure the integration. A System Administrator (sysadmin) role is required for this integration. Additionally, ensure that your organization has a valid license for Symantec Endpoint Protection V2.

Step 1: Add Instance

To add an instance of Symantec Endpoint Protection V2 on Cortex XSOAR, navigate to Settings > Integrations > Servers & Services. Click on 'Add instance' and select the 'Symantec Endpoint Protection V2' option.

Step 2: Configure API

Once you have added the instance, configure the API by clicking on the 'Click Test' button to validate the URLs, token, and connection. This will ensure that your Symantec Endpoint Protection V2 instance is connected successfully to Cortex XSOAR.

Step 3: Query API

To query the Symantec Endpoint Protection Manager using the official REST API, you can use various parameters such as hostname, hardware key, group name, and page size. For example, you can use a wild card search by adding '*' at the end of your query. The possible values for operating system are: CentOs, Debian, Fedora, MacOSX, Oracle, OSX, RedHat, SUSE, Ubuntu, Win10, Win2K, Win7, Win8, WinEmb7, WinEmb8, WinEmb81, WinFundamental, WinNT, Win2K3, Win2K8, Win2K8R2, WinVista, WinXP, and WinXPEmb.

Step 4: Execute Commands

After configuring the API and querying it successfully, you can execute various commands such as moving a client's hardware key to a new group or updating the endpoint's status. These commands can be executed from the Cortex XSOAR CLI, as part of an automation, or in a playbook.

Post-Execution

Once you have successfully executed a command, a DBot message will appear in the War Room with the command details. This allows you to monitor and track the execution of your commands and ensures that your endpoints are properly configured and protected.

In conclusion, configuring Symantec Endpoint Protection V2 on Cortex XSOAR is a straightforward process that requires careful planning and attention to detail. By following these steps, you can ensure that your organization's endpoints are well-protected from potential threats and that your security team has the tools they need to respond quickly and effectively to security incidents.

Sep endpoint