Symantec Endpoint Protection
The Symantec Endpoint Protection connector enables automated interaction with the SEP Manager, allowing for streamlined management of security policies, blacklists, and endpoint protection measures.
Symantec Endpoint Protection is a robust security solution that provides comprehensive protection against a wide range of threats. This connector enables Swimlane Turbine users to automate critical security tasks such as managing file fingerprints, updating blacklists, and initiating content updates on endpoints. By integrating with Symantec Endpoint Protection, users can enhance their security posture, streamline endpoint management, and respond to threats with greater speed and efficiency. The connector's actions facilitate proactive threat hunting, system lockdown, and policy enforcement, directly contributing to a fortified defense against cyber threats.
Prerequisites
To effectively utilize the Symantec Endpoint Protection connector with Swimlane Turbine, ensure you have the following prerequisites:
- API Key Authentication with the following parameters:
- URL: The base URL for the SEP Manager API.
- Username: The account username with permissions to access the SEP Manager.
- Password: The corresponding password for the provided username.
- Port: The port number on which the SEP Manager API is accessible.
Capabilities
The Symantec Endpoint Protection connector has the following capabilities
- Get Groups
- Add Blacklist Fingerprint to Groups for Lockdown
- Create Blacklist
- Delete Blacklist
- Update Blacklist
- Get Domains
- Update Content Command
Configurations
API Key Authentication
Authenticates using an API Key
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
port | API port | string | Required |
username | Username | string | Required |
secret | Password | string | Required |
domain | Symantec Endpoint Protection User's domain, defaults to "Default" domain | string | Optional |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Add Fingerprint to Group
Adds a specific fingerprint to a Symantec Endpoint Protection group for system lockdown, requiring group and fingerprint IDs.
Endpoint
- URL: sepm/api/v1/groups/{{group_id}}/system-lockdown/fingerprints/{{fingerprint_id}}
- Method: PUT
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.group_id | string | Required | Parameters for the Add Fingerprint to Group action |
path_parameters.fingerprint_id | string | Required | Parameters for the Add Fingerprint to Group action |
Input Example
{"path_parameters":{"group_id":"09AF1BF50A2000C06EF0620A092A5A17","fingerprint_id":"9EC5BEEFE64E406DA0AAC2A584BEE09E"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
errorCode | string | Error message if any |
appErrorCode | string | Error message if any |
errorMessage | string | Response message |
Output Example
{"status_code":423,"response_headers":{"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'self' https://win-qdbt6mvuilc:8443","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff, nosniff","Referrer-Policy":"strict-origin-when-cross-origin","Feature-Policy":"microphone 'none'; geolocation 'none'; usb 'none'; autoplay 'none' ","Pragma":"no-cache","Expires":"Thu, 01 Jan 1970 00:00:00 GMT","Cache-Control":"no-cache, no-store","X-Rate-Limit-Limit":"50","X-Rate-Limit...
Create New Blacklist
Adds a new file fingerprint list to the blacklist in Symantec Endpoint Protection Manager using details such as name, domainId, hashType, and data.
Endpoint
- URL: sepm/api/v1/policy-objects/fingerprints
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
name | string | Optional | Name of the resource |
domainId | string | Optional | Unique identifier |
description | string | Optional | Parameter for Create New Blacklist |
hashType | string | Optional | Type of the resource |
data | array | Optional | Response data |
Input Example
{"json_body":{"name":"test","domainId":"E1B640690A2000C02F0213A4FD07BC8A","description":"a description","hashType":"MD5","data":["ac20a4ed0c586b32e80f2156188cd1a2"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
id | string | Unique identifier |
Output Example
{"status_code":200,"response_headers":{"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'self' https://win-qdbt6mvuilc:8443","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff, nosniff","Referrer-Policy":"strict-origin-when-cross-origin","Feature-Policy":"microphone 'none'; geolocation 'none'; usb 'none'; autoplay 'none' ","Pragma":"no-cache","Expires":"Thu, 01 Jan 1970 00:00:00 GMT","Cache-Control":"no-cache, no-store","X-Rate-Limit-Limit":"50","X-Rate-Limit...
Delete Blacklist
Removes a specified blacklist entry from Symantec Endpoint Protection Manager using the provided ID.
Endpoint
- URL: sepm/api/v1/policy-objects/fingerprints/{{id}}
- Method: DELETE
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Delete Blacklist action |
Input Example
{"path_parameters":{"id":"E5B43B239C334AB289CD842B09B97241"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
response_text | string | Output field: response_text |
Output Example
{"status_code":200,"response_headers":{"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'self' https://win-qdbt6mvuilc:8443","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff, nosniff","Referrer-Policy":"strict-origin-when-cross-origin","Feature-Policy":"microphone 'none'; geolocation 'none'; usb 'none'; autoplay 'none' ","Pragma":"no-cache","Expires":"Thu, 01 Jan 1970 00:00:00 GMT","Cache-Control":"no-cache, no-store","X-Rate-Limit-Limit":"50","X-Rate-Limit...
Get Blacklist Fingerprint File by Name
Retrieves the file fingerprint blacklist by name, returning a set of associated hash values in Symantec Endpoint Protection.
Endpoint
- URL: sepm/api/v1/policy-objects/fingerprints
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.name | string | Optional | Parameters for the Get Blacklist Fingerprint File by Name action |
Input Example
{"parameters":{"name":"file.txt"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
id | string | Unique identifier |
name | string | Name of the resource |
hashType | string | Type of the resource |
source | string | Output field: source |
description | string | Output field: description |
data | array | Response data |
groupIds | array | Unique identifier |
groupIds.file_name | string | Unique identifier |
groupIds.file | string | Unique identifier |
Output Example
{"status_code":200,"response_headers":{"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'self' https://win-qdbt6mvuilc:8443","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff, nosniff","Referrer-Policy":"strict-origin-when-cross-origin","Feature-Policy":"microphone 'none'; geolocation 'none'; usb 'none'; autoplay 'none' ","Pragma":"no-cache","Expires":"Thu, 01 Jan 1970 00:00:00 GMT","Cache-Control":"no-cache, no-store","X-Rate-Limit-Limit":"50","X-Rate-Limit...
Get Domains
Retrieve a list of all accessible domains from Symantec Endpoint Protection Manager.
Endpoint
- URL: sepm/api/v1/domains
- Method: GET
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'self' https://win-qdbt6mvuilc:8443","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff, nosniff","Referrer-Policy":"strict-origin-when-cross-origin","Feature-Policy":"microphone 'none'; geolocation 'none'; usb 'none'; autoplay 'none' ","Pragma":"no-cache","Expires":"Thu, 01 Jan 1970 00:00:00 GMT","Cache-Control":"no-cache, no-store","X-Rate-Limit-Limit":"50","X-Rate-Limit...
Get File Fingerprint By ID
Retrieve a list of hash values representing the file fingerprint for a specified ID in Symantec Endpoint Protection.
Endpoint
- URL: sepm/api/v1/policy-objects/fingerprints/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Get File Fingerprint By ID action |
Input Example
{"path_parameters":{"id":"25c0783596f8dc77528ff692a9dc82d1"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
id | string | Unique identifier |
name | string | Name of the resource |
hashType | string | Type of the resource |
source | string | Output field: source |
description | string | Output field: description |
data | array | Response data |
groupIds | array | Unique identifier |
groupIds.file_name | string | Unique identifier |
groupIds.file | string | Unique identifier |
Output Example
{"status_code":200,"response_headers":{"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'self' https://win-qdbt6mvuilc:8443","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff, nosniff","Referrer-Policy":"strict-origin-when-cross-origin","Feature-Policy":"microphone 'none'; geolocation 'none'; usb 'none'; autoplay 'none' ","Pragma":"no-cache","Expires":"Thu, 01 Jan 1970 00:00:00 GMT","Cache-Control":"no-cache, no-store","X-Rate-Limit-Limit":"50","X-Rate-Limit...
Get Group
Retrieves a list of groups from Symantec Endpoint Protection for further analysis or action.
Endpoint
- URL: sepm/api/v1/groups
- Method: GET
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
content | array | Response content |
content.id | string | Unique identifier |
content.name | string | Name of the resource |
content.description | string | Response content |
content.fullPathName | string | Name of the resource |
content.numberOfPhysicalComputers | number | Response content |
content.numberOfRegisteredUsers | number | Response content |
content.createdBy | string | Response content |
content.created | number | Response content |
content.lastModified | number | Response content |
content.policySerialNumber | string | Response content |
content.policyDate | number | Response content |
content.customIpsNumber | string | Response content |
content.domain | object | Response content |
content.domain.id | string | Unique identifier |
content.domain.name | string | Name of the resource |
content.policyInheritanceEnabled | boolean | Response content |
size | number | Output field: size |
number | number | Output field: number |
sort | array | Output field: sort |
sort.direction | string | Output field: sort.direction |
sort.property | string | Output field: sort.property |
sort.ascending | boolean | Output field: sort.ascending |
Output Example
{"status_code":200,"response_headers":{"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'self' https://win-qdbt6mvuilc:8443","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff, nosniff","Referrer-Policy":"strict-origin-when-cross-origin","Feature-Policy":"microphone 'none'; geolocation 'none'; usb 'none'; autoplay 'none' ","Pragma":"no-cache","Expires":"Thu, 01 Jan 1970 00:00:00 GMT","Cache-Control":"no-cache, no-store","X-Rate-Limit-Limit":"50","X-Rate-Limit...
Update Blacklist
Updates an existing blacklist in Symantec Endpoint Protection using the specified 'id'. System administrator account required.
Endpoint
- URL: sepm/api/v1/policy-objects/fingerprints/{{id}}
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Update Blacklist action |
name | string | Optional | Name of the resource |
domainId | string | Optional | Unique identifier |
description | string | Optional | Parameter for Update Blacklist |
hashType | string | Optional | Type of the resource |
data | array | Optional | Response data |
Input Example
{"json_body":{"name":"test","domainId":"E1B640690A2000C02F0213A4FD07BC8A","description":"a description","hashType":"MD5","data":["ac20a4ed0c586b32e80f2156188cd1a2"]},"path_parameters":{"id":"E5B43B239C334AB289CD842B09B97241"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
response_text | string | Output field: response_text |
Output Example
{"status_code":200,"response_headers":{"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'self' https://win-qdbt6mvuilc:8443","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff, nosniff","Referrer-Policy":"strict-origin-when-cross-origin","Feature-Policy":"microphone 'none'; geolocation 'none'; usb 'none'; autoplay 'none' ","Pragma":"no-cache","Expires":"Thu, 01 Jan 1970 00:00:00 GMT","Cache-Control":"no-cache, no-store","X-Rate-Limit-Limit":"50","X-Rate-Limit...
Update Content Command
Initiates a content update on specified Symantec Endpoint Protection endpoints using group or computer IDs. System administrator account required.
Endpoint
- URL: sepm/api/v1/command-queue/updatecontent
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.group_ids | array | Required | Parameters for the Update Content Command action |
parameters.computer_ids | array | Required | Parameters for the Update Content Command action |
Input Example
{"parameters":{"group_ids":["09AF1BF50A2000C06EF0620A092A5A17"],"computer_ids":["09AF1BF50A2000C06EF0620A092A5A17"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
errorCode | string | Error message if any |
appErrorCode | string | Error message if any |
errorMessage | string | Response message |
Output Example
{"status_code":400,"response_headers":{"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'self' https://win-qdbt6mvuilc:8443","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff, nosniff","Referrer-Policy":"strict-origin-when-cross-origin","Feature-Policy":"microphone 'none'; geolocation 'none'; usb 'none'; autoplay 'none' ","Pragma":"no-cache","Expires":"Thu, 01 Jan 1970 00:00:00 GMT","Cache-Control":"no-cache, no-store","X-Rate-Limit-Limit":"50","X-Rate-Limit...
Response Headers
Header | Description | Example |
|---|---|---|
Cache-Control | Directives for caching mechanisms | no-cache, no-store |
Connection | HTTP response header: Connection | close |
Content-Length | The length of the response body in bytes | 0 |
Content-Security-Policy | HTTP response header: Content-Security-Policy | frame-ancestors 'self' https://win-qdbt6mvuilc:8443 |
Content-Type | The media type of the resource | application/json;charset=UTF-8 |
Date | The date and time at which the message was originated | Thu, 01 Dec 2022 15:58:49 GMT |
Expires | The date/time after which the response is considered stale | Thu, 01 Jan 1970 00:00:00 GMT |
Feature-Policy | HTTP response header: Feature-Policy | microphone 'none'; geolocation 'none'; usb 'none'; autoplay 'none' |
Keep-Alive | HTTP response header: Keep-Alive | timeout=60 |
Pragma | HTTP response header: Pragma | no-cache |
Referrer-Policy | HTTP response header: Referrer-Policy | strict-origin-when-cross-origin |
Server | Information about the software used by the origin server | SEPM |
Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=31536000 ; includeSubDomains |
Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked |
X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff, nosniff |
X-Frame-Options | HTTP response header: X-Frame-Options | DENY |
X-Rate-Limit-Limit | HTTP response header: X-Rate-Limit-Limit | 50 |
X-Rate-Limit-Remaining | HTTP response header: X-Rate-Limit-Remaining | 49 |
X-Rate-Limit-Reset | HTTP response header: X-Rate-Limit-Reset | 21388 |
X-XSS-Protection | HTTP response header: X-XSS-Protection | 1; mode=block |