Purpose
This guide explains how to configure the Symantec Advanced Threat Protection (ATP) Response integration in Logsign USO, so that Incidents and Alarms can automatically, or an analyst can manually, look up endpoint entities, delete a file by hash, quarantine/unquarantine a device, and manage IP/domain/URL/hash block and allow lists on Symantec ATP. This is not a log collection poller: it is a Response (action) integration, configured under Settings > Integrations > Responses > +Device, that lets a Logsign correlation rule or manual incident action reach out to Symantec ATP and change its blocklist/allowlist or endpoint containment state.
Prerequisites
- A Symantec ATP management console with API access enabled for your deployment.
- An OAuth2 Client ID and Client Secret issued for API access. Symantec ATP's REST API uses OAuth2 client-credentials authentication; create a dedicated API client rather than reusing a personal admin login, so the credential can be scoped and rotated independently.
- Use least privilege. If your Symantec ATP console supports role-scoped API clients, grant only the permissions this integration needs (endpoint query, file/domain/IP blocklist management, device quarantine) rather than a full administrator role. The exact role names and where to assign them were not independently verified against a live ATP console during this research; confirm with your Symantec ATP administrator or Broadcom support before assuming a specific role name.
Step 1: Obtain OAuth2 Credentials from Symantec ATP
- Log in to the Symantec ATP management console with an administrator account.
- Navigate to the API client / integration settings area of the console (the exact menu path varies by ATP version and was not independently verified during this research; consult your Symantec ATP documentation or administrator if it is not where you expect).
- Create a new API client. Symantec ATP issues a Client ID and Client Secret for the client; copy both immediately, since the secret is typically not retrievable again after creation.
- Note the base URL of your ATP management console (the hostname you use to log in), since this is the endpoint Logsign will connect to.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Symantec Advanced Threat Protection, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this Symantec ATP device in Logsign. |
| Url | Yes | Base URL of your Symantec ATP management console. |
| Client Id | Yes | The OAuth2 Client ID from Step 1. |
| Client Secret | Yes | The OAuth2 Client Secret from Step 1. Stored encrypted at rest. |
| Insecure Skip Verify | Yes | Disables TLS certificate validation on Logsign's outbound calls to ATP when enabled. Leave this off unless you have a specific reason (for example a TLS-inspecting proxy in the path) to keep it on. |
Click Create to save the device.
Available Methods
Once configured, the following actions are available from an Incident, Alarm, or Action Rule:
- get-endpoint-entities — lists/searches endpoint device entities known to ATP.
- delete-file — remotely deletes a file by hash on a specific device.
- quarantine-device (Containment) — isolates a device from the network.
- unquarantine-device (Recovery) — releases a device from network quarantine.
- create-blacklist-policies — adds an IP, domain, URL, or hash to the ATP blocklist.
- delete-blacklist-policies — removes an entry from the ATP blocklist.
- create-whitelist-policies — adds an IP, domain, URL, or hash to the ATP allowlist.
- delete-whitelist-policies — removes an entry from the ATP allowlist.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401 Unauthorized | Wrong Client ID/Client Secret, or the OAuth token request failed. | Re-enter the Client Id and Client Secret exactly as issued, and confirm the API client is still enabled in the ATP console. |
| 403 Forbidden | The API client does not have permission for the action being called (for example, blocklist management without the corresponding role). | Confirm the API client's assigned role/permissions in the ATP console cover the methods you intend to use. |
| 429 Too Many Requests | Symantec ATP enforces API rate limits on your tenant. | Reduce the frequency of automated calls, especially in high-volume correlation rules. |
| Connection failure / timeout | Wrong Url, or network path from Logsign to the ATP console is blocked. | Confirm the Url is the correct management console base address and that outbound HTTPS from Logsign to it is allowed. |
Notes and Limits
- This integration only covers Symantec Advanced Threat Protection (ATP), a network/email/endpoint correlation product. It is a separate product from Symantec Endpoint Protection Manager (SEPM) and Symantec Endpoint Protection (SEP)/Symantec Endpoint Security (SES), which each have their own separate Logsign integrations; do not confuse them when choosing a device type.
- The exact console navigation path for creating an API client was not independently verified against a live ATP tenant during this research (not independently verified); the field names and method behavior above are taken directly from Logsign's integration code, which is the authoritative source for what Logsign actually sends and expects.