Splunk Add-on for Symantec Endpoint Protection

The Splunk Add-on for Symantec Endpoint Protection allows a Splunk® Enterprise administrator to collect server and client activity logs from Symantec Endpoint Protection Manager dump files. After Splunk Enterprise indexes the events, you can consume the data using the prebuilt dashboard panels included with the add-on. This add-on provides the inputs and CIM-compatible knowledge to use with other Splunk Enterprise apps, such as the Splunk App for Enterprise Security and the Splunk App for PCI Compliance. This add-on must be installed on a Windows instance of Splunk Enterprise for data collection. The add-on is platform independent for indexers and search heads.