Symantec Endpoint Detection and Response (EDR)

Connection Requirements

1 - IP or Hostname

IP address or Hostname of the Symantec EDR host.

2 - Client Secret

Generated Client Secret for a user that has the permissions to fetch asset details.

3 - Client ID

Generated Client Id for a user that has the permissions to fetch asset details.

The value provided in the Client ID and Client Secret must be matched to a user read with access to the devices.

The user must have atp_view_entities permission.

The create an OAuth:

1. In the Symantec EDR device console, select Settings > Data Sharing.

2. In the OAuth Clients section, select Add Application.

3. In the App Name field, type the name of application.

4. Select the API version.

5. Select your user role for the application.

6. Click Generate.

The Client ID and Client Secret are created.

Please note that to create "Client Secret" and "Client ID" you will need admin rights.

For more information please check the connection.

4 - Port

Port number (optional, default: 443)

5 - SSL

Use SSL for connection (optional, default: Unencrypted)

Attention

Please perform a connection test to ensure there is a valid connection to the Symantec EDR host. When the discovery operation finalized you will be able to see the details on Assets page.