Skip to main content

Cloud ConnectorsExabeam Cloud Connectors Configuration Guide

Table of Contents

Symantec Endpoint Protection (SEP) Mobile Cloud Connector

Broadcom’s Symantec Endpoint Protection Mobile (SEP) is a mobile threat defense solution that predicts, detects, and prevents physical, malware, network threats, and vulnerability exploits to protect mobile devices from cyberattacks via threat intelligence technology. SEP protects and alerts the mobile device from suspicious network connection, malicious apps, phishing URLs, OS vulnerabilities, and risky configurations. For more information see the product documentation.

Prerequisites to Configure the Symantec Endpoint Protection (SEP) Mobile Connector

Before you configure the Symantec Endpoint Protection Mobile (SEP) connector you must obtain the following account information to use while configuring the SEP connector:

  • Organization ID

  • API URL

  • API Token

Symantec Endpoint Protection (SEP) Mobile APIs are authenticated via application keys. To contact Broadcom Symantec support to obtain the API URL, API token, and the organization ID, log in to the Symantec Endpoint Protection Mobile Management portal and request the required information.

Configure the Symantec Endpoint Protection (SEP) Mobile Connector

Broadcom’s Symantec Endpoint Protection Mobile (SEP) is a mobile threat defense solution that predicts, detects, and prevents physical, malware, network threats, and vulnerability exploits to protect mobile devices from cyberattacks via threat intelligence technology. SEP protects and alerts the mobile device from suspicious network connection, malicious apps, phishing URLs, OS vulnerabilities, and risky configurations. For more information see the product documentation.

The following table displays audit source API and security events supported by the connector.

Audit Source: API

Service or Module Covered

Events Included

Security Events

Any

All

Table 31. Audit source API and security events supported by the connector


To configure the Symantec Endpoint Protection Mobile connector to import data into the Exabeam Cloud Connector platform:

  1. Complete the Prerequisites to Configure the Symantec Endpoint Protection (SEP) Mobile Connector.

  2. Log in to the Exabeam Cloud Connectors platform with your registered credentials.

  3. Navigate to Settings > Accounts > Add Account.

  4. Click Select Service to Add, then select Symantec EP mobile from the list.

  5. In the Accounts section, enter the required information. Required fields are indicated with a red bar.

    1. Account Name – Specify a name for the Symantec EP connector. For example, Corporate mobile threat defense solution.

    2. Description – (Optional) Describe the Symantec EP connector. For example, Symantec EP to protect mobile devices from cyber-attacks via threat intelligence technology.

    3. Organization ID – Enter the value for organization ID that you obtained while completing prerequisites.

    4. API URL – Enter the API URL that you obtained while completing prerequisites.

    5. API Token – Enter the value for the API token that you obtained while completing prerequisites.

      Note

      Symantec EP provides a set of REST APIs to integrate SEP cloud with other third-party applications. Exabeam uses the Symantec Security Alerts API to pull events. The Security Alerts API is designed to be used by only one application. You must use the Security Alerts API only for Exabeam cloud connector and not for any other application.

  6. To confirm that the Exabeam Cloud Connector platform communicates with the service, click Test Connection.

  7. Click Done to save your changes. The cloud connector is now set up on the Exabeam Cloud Connector platform.

  8. To ensure that the connector is ready to send and collect data, Start the connector and check that the status shows OK.