Symantec Endpoint Protection Integration via API

Purpose

This guide explains how to generate the OAuth2 Client ID and Client Secret needed for Logsign USO to ingest Symantec Endpoint Protection (SEP) endpoint security events, and how to configure the integration once you have them.

Important: this is not the same product as "Symantec Endpoint Security" (SES). Symantec Endpoint Protection (SEP) is Broadcom's on-premises, Symantec Endpoint Protection Manager (SEPM)-based legacy endpoint protection product. Symantec Endpoint Security (SES) is the newer, cloud-native successor product with its own separate API and its own separate Logsign integration and documentation. If your organization has already migrated to SES, use that integration guide instead; this document covers only SEP/SEPM-originated events.

SEP itself does not expose a REST API directly from the on-premises SEPM console. Instead, this integration relies on SEPM being enrolled in hybrid management with the Symantec Endpoint Security cloud console: once your on-prem SEPM domain is linked to the cloud console, its events, policies, and client data synchronize to Broadcom's cloud, and Logsign queries a cloud-hosted Event Search API for those synchronized SEP events. If your SEPM domain is not enrolled in hybrid management, this integration will not see any events.

Prerequisites

Your on-premises SEPM domain must already be enrolled in hybrid management with the Symantec Endpoint Security cloud console. This is a one-time setup performed in the SEPM console together with your Broadcom/Symantec account team or partner if you have not already done this for another purpose (such as cloud-based policy management).

You need administrative access to the Symantec Endpoint Security cloud console, specifically to the Integrations > Client Applications section (exact menu wording may vary slightly by console version), to create the OAuth2 credentials this integration uses.

Step 1: Create a Client Application in the Cloud Console

1. Sign in to the Symantec Endpoint Security cloud console associated with your enrolled SEPM domain.
2. Go to Integrations > Client Applications (or the equivalent API/OAuth client management screen in your console version).
3. Create a new Client Application. The console generates a Client ID and a Client Secret for it.
4. Copy both values immediately and store them securely; the Client Secret is typically shown only once.

Note: menu labels for OAuth client management have changed across cloud console versions and are not identical to Broadcom's separate "SEPM OAuth Quick Start" article, which documents a different, fully on-premises OAuth flow (/sepm/oauth/authorize and /sepm/oauth/token) not used by this integration. If your console layout does not match, contact your Broadcom account team or partner for the current path to Client Applications / API client credentials.

Step 2: Build the Token Value for Logsign

Logsign authenticates using HTTP Basic authentication with your Client ID and Client Secret combined. Combine the two values with a colon and base64-encode the result:

echo -n "<client_id>:<client_secret>" | base64

The resulting string is what you will paste into the Token field in Logsign USO in Step 3. Logsign does not perform this encoding for you; the value must already be base64-encoded when entered.

Step 3: Configure the Integration in Logsign USO

Log in to Logsign USO and add a new Symantec Endpoint Protection data source. You will be asked for:

Click Check Connection to verify Logsign can authenticate before saving. Once saved, Logsign exchanges your token for a short-lived Bearer access token automatically, refreshing it before it expires, and periodically queries the cloud Event Search API for new SEP events synchronized from your enrolled SEPM domain, normalizing each event's device, user, network, and detection details into a Logsign event.

Notes and Limits

• This integration only returns events for SEPM domains enrolled in hybrid management with the Symantec Endpoint Security cloud console. If your SEPM deployment is fully standalone (never linked to the cloud console), no events will be available through this API and a different collection method (such as SEPM's own syslog/log forwarding) should be used instead.
• If the connection check or polling fails with an authorization error, first verify in the cloud console that the Client Application has not been deleted or had its secret rotated, and that the SEPM domain is still shown as enrolled/connected. Generate a new Client Secret and update the Token value in Logsign if needed.
• Make sure you are configuring this integration for Symantec Endpoint Protection (SEP/SEPM) and not Symantec Endpoint Security (SES); the two products use different API base paths, different credential types, and different Logsign data sources. Using SES credentials here, or SEP credentials in the SES data source, will fail authentication.
• Contact your Broadcom account team or partner if you are unsure whether your organization is licensed for and enrolled in hybrid cloud management for your SEPM domain, or if you need help locating the Client Applications screen in your specific console version.