Purpose
This guide explains how to configure Logsign USO to ingest Symantec Data Loss Prevention (DLP) incidents from an on-premises Enforce Server through its Incident Reporting and Update REST API, for security analytics and forensic purposes.
This is a separate integration from Symantec DLP Syslog Configuration Format. That article covers the legacy syslog forwarding method (a different field schema, PrefixID 4151). This guide covers the REST API poller (PrefixID 4516), which reads structured incident records directly from the Enforce Server database rather than parsing forwarded syslog lines. Use whichever collection method matches how your Enforce Server is set up; the two are not meant to run against the same incidents at the same time.
Prerequisites
- Symantec DLP Enforce Server 16.0 or later. The Incident Reporting and Update REST API is not available on earlier versions.
- A DLP user account with the "Incidents: API > Incident Reporting" privilege. Logsign authenticates to the API with this account's username and password (HTTP Basic auth); an account without the privilege will authenticate but every incident query will fail with a 403.
- Network connectivity from Logsign USO to the Enforce Server's REST endpoint (HTTPS, or HTTP if your Enforce Server is not TLS-terminated at that path).
Step 1: Prepare a DLP User Account
- In the Enforce Server administration console, create or choose a service account for the integration.
- Grant it the Incidents: API > Incident Reporting privilege. This is the only privilege the poller needs; it does not create, modify, or remediate incidents.
- Note the account's username and password. Logsign stores the password in its own credential store; it is not written anywhere in Enforce Server configuration.
Step 2: Configure the Integration in Logsign USO
Add a new Symantec DLP API data source in Logsign USO and provide:
| Field | Value |
|---|---|
| Host | The Enforce Server's hostname or IP address |
| Protocol | http or https, matching how the Enforce Server's web services are exposed |
| Username | The DLP account created in Step 1 |
| Password | The DLP account's password |
Logsign calls /ProtectManager/webservices/v2/incidents to retrieve incidents and /ProtectManager/webservices/v2/incidents/protectOrPreventStatuses to resolve each incident's status name. Polling advances on creationDate, so incidents are collected in creation order and none are skipped or duplicated across polling cycles.
What Gets Collected
Each incident is normalized into a Logsign event carrying, where present: incident ID, creation and detection timestamps, policy ID/name, match count, quarantine status, the associated user, and channel-specific detail: endpoint device name/IP, application name/path, and file name/path for endpoint incidents; file owner and discovered URL for Discover (data-at-rest) incidents; sender IP and port for network incidents; and request URL and user for cloud/CASB incidents. A single incident only populates the fields relevant to the channel it came from.
Notes and Limits
- This integration requires DLP 16.0+. Earlier Enforce Server versions do not expose this REST API and will return 404 for every request. If you see this, confirm the Enforce Server version before treating it as a connectivity issue.
- A 401 response means the username or password is wrong or has been changed on the DLP side. A 403 means the account is missing the "Incidents: API > Incident Reporting" privilege.
- The poller only reads incident data through this API. It cannot remediate, quarantine, or update incidents in DLP; that requires a separate Response-type integration, not this one.
- Numeric reference fields such as severity ID and incident status ID are resolved by Logsign into the severity/status names shown in Enforce and are not exposed as raw numbers in search.