Symantec Endpoint Security Integration via API

Purpose

This guide explains how to generate the credentials Logsign USO needs, a Client ID/Client Secret pair and an Event Stream GUID, in the Symantec Endpoint Security (SES) cloud console (ICDm), and how to enter them into Logsign USO to ingest SES events for security analytics and forensic purposes.

Symantec Endpoint Security (SES) is not the same product as Symantec Endpoint Protection (SEP). SES is Broadcom's newer, fully cloud-managed endpoint product, administered through the ICDm cloud console. SEP is the older, on-premises product managed through a local SEPM server. The two have separate consoles, separate APIs, and separate Logsign documentation. This guide covers SES only. If your organization uses on-premises SEP/SEPM, see the separate Symantec Endpoint Protection integration document instead.

SES exposes an Event Stream API rather than syslog. This API poller is the supported way to bring SES event data into Logsign USO in near real time.

Prerequisites

You need administrator access to the SES cloud console (ICDm) with permission to view Integration settings, specifically the Client Applications and Event Stream pages.

Your organization's SES tenant is hosted in a specific region (for example, US or EU). You will need to know this to construct the correct API base URL in Step 4.

Step 1: Create a Client Application (Client ID and Client Secret)

1. Sign in to the SES cloud console (ICDm), for example at https://sep.securitycloud.symantec.com or your tenant's regional equivalent.
2. Go to Integration > Client Applications.
3. Click Add to create a new client application.
4. Enter a name for the application (for example, "Logsign USO integration") and click Add.
5. Select the Client Secret tab at the top of the application's detail view.
6. Copy the Client ID and Client Secret shown there. Store them securely; this is the credential pair Logsign uses to obtain an OAuth2 access token.

Step 2: Create an Event Stream and Note the Stream GUID

1. In the SES cloud console, go to Integration > Event Stream.
2. Click Add to create a new event stream.
3. Set Stream Type to API (the other options, Data Bucket and External Kafka, are not used by this integration).
4. Enter a name for the stream.
5. In the Query Filter section, select at least one Event Type ID to stream. An event stream cannot be enabled without at least one event type filter.
6. Review the Channels and Total Capacity fields. SES auto-recommends a channel count based on your device count and event load (one channel covers up to 1,000 events per second; up to 25 channels are supported for larger environments).
7. Toggle API State on to activate streaming, then click Create.
8. Open the stream you just created and copy its GUID. This is the Stream GUID Logsign needs.

Step 3: Identify Your Channel Number

Each event stream has one or more channels, numbered starting at 0. If your stream was created with a single channel (the default for most organizations), use 0 as the Channel ID. If SES has scaled your stream to multiple channels, configure one Logsign data source per channel you want to poll.

Step 4: Identify Your Base URL and Customer ID

SES API access is region-specific. Your API base URL follows the pattern https://api.sep.<region>.securitycloud.symantec.com (for example, an EU tenant uses api.sep.eu.securitycloud.symantec.com). Confirm the exact host for your tenant's region from your console login URL or with Broadcom support if you are unsure.

Your Customer ID identifies your organization to the SES API and is required on every request. If it is not visible on a profile/account page in your console, contact Broadcom support to confirm it.

Step 5: Configure the Integration in Logsign USO

After completing Steps 1-4, log in to Logsign USO and add a new Symantec Endpoint Security data source. You will be asked for:

Logsign exchanges the Client ID and Client Secret for a short-lived Bearer access token automatically (OAuth2 client-credentials grant) on the first poll, and re-exchanges it whenever it expires or is rejected. You do not need to generate or refresh a token yourself. Logsign then opens a streaming connection to your event stream's channel, using SES's own cursor token (returned with each batch of events) to resume exactly where it left off on every subsequent poll, so events are neither skipped nor duplicated across polling cycles.

Notes and Limits

• Each channel can stream up to 1,000 events per second. Logsign processes up to 1,000 stream lines per poll cycle before yielding, matching this per-channel limit.
• If polling stops and the source logs repeated authorization errors, check whether the Client Application was deleted or its secret was rotated in the SES console, and generate a fresh Client ID/Secret pair if needed.
• SES retains a limited backlog of streamable events (Broadcom documents roughly 30 days for related SES data collection scenarios). If a data source in Logsign USO is left disabled for an extended period, its saved cursor may no longer be valid when re-enabled; if polling does not resume normally, delete and recreate the data source rather than reusing the old one.
• This poller covers the Event Stream API only (real-time endpoint, application, audit, system, security, license, and diagnostic events, depending on the Event Type IDs you selected in Step 2). It does not cover the separate EDR Incidents REST API or SES's cloud-storage export options (AWS S3/SQS, Azure Blob, GCS); those would require a separate connector if needed.
• Make sure the Base URL you enter matches your tenant's actual region. Using the wrong region's host will cause every request to fail authentication or return no data, even with valid credentials.