Symantec Integrated Cyber Defense Exchange
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | Symantec |
| Publisher | Symantec |
| Used in Solutions | Symantec Integrated Cyber Defense |
| Collection Method | REST Pull API |
| Connector Definition Files | SymantecICDX.JSON |
| Ingestion API | HTTP Data Collector API — Connector definition requires workspace key (SharedKey pattern) |
| Custom Log V1 Tables | Yes 🔶 — ingests into tables with type-suffixed columns |
| Microsoft Learn | View on Learn |
Symantec ICDx connector allows you to easily connect your Symantec security solutions logs with Microsoft Sentinel, to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization’s network and improves your security operation capabilities.
Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
SymantecICDx_CL 🔶 |
✗ | ✓ | ✗ |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace (Workspace): read and write permissions.
- Keys (Workspace): read permissions to shared keys for the workspace. See the documentation to learn more about workspace keys.
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Configure and connect Symantec ICDx
- On the ICDx navigation bar, click Configuration.
- At the top of the Configuration screen, click Forwarders, and next to Microsoft Sentinel (Log Analytics), click Add.
- In the Microsoft Sentinel (Log Analytics) window that opens, click Show Advanced. See the documentation to set advanced features.
- Make sure that you set a name for the forwarder and under Azure Destination, set these required fields:
- Workspace ID: Paste the Workspace ID from the Microsoft Sentinel portal connector page.
- Primary Key: Paste the Primary Key from the Microsoft Sentinel portal connector page.
- Custom Log Name: Type the custom log name in the Microsoft Azure portal Log Analytics workspace to which you are going to forward events. The default is SymantecICDx.
- Click Save and to start the forwarder, go to Options > More and click Start.
- Workspace ID:
WorkspaceIdNote: The value above is dynamically provided when these instructions are presented within Microsoft Sentinel.
- Primary Key:
PrimaryKeyNote: The value above is dynamically provided when these instructions are presented within Microsoft Sentinel.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊