---
title: Symantec Endpoint Protection
slug: connectors/symantec-endpoint-protection
docTags: 
createdAt: 2026-06-09T16:30:25.047Z
---

The Symantec Endpoint Protection connector enables automated interaction with the SEP Manager, allowing for streamlined management of security policies, blacklists, and endpoint protection measures.

Symantec Endpoint Protection is a robust security solution that provides comprehensive protection against a wide range of threats. This connector enables Swimlane Turbine users to automate critical security tasks such as managing file fingerprints, updating blacklists, and initiating content updates on endpoints. By integrating with Symantec Endpoint Protection, users can enhance their security posture, streamline endpoint management, and respond to threats with greater speed and efficiency. The connector's actions facilitate proactive threat hunting, system lockdown, and policy enforcement, directly contributing to a fortified defense against cyber threats.

## Prerequisites

To effectively utilize the Symantec Endpoint Protection connector with Swimlane Turbine, ensure you have the following prerequisites:

- API Key Authentication with the following parameters:
  - URL: The base URL for the SEP Manager API.
  - Username: The account username with permissions to access the SEP Manager.
  - Password: The corresponding password for the provided username.
  - Port: The port number on which the SEP Manager API is accessible.

## Capabilities

The Symantec Endpoint Protection connector has the following capabilities

- Get Groups
- Add Blacklist Fingerprint to Groups for Lockdown
- Create Blacklist
- Delete Blacklist
- Update Blacklist
- Get Domains
- Update Content Command

# Configurations

## API Key Authentication

Authenticates using an API Key

### Configuration Parameters

| **Parameter** | **Description**                                                          | **Type** | **Required** |
| ------------- | ------------------------------------------------------------------------ | -------- | ------------ |
| url           | A URL to the target host.                                                | string   | Required     |
| port          | API port                                                                 | string   | Required     |
| username      | Username                                                                 | string   | Required     |
| secret        | Password                                                                 | string   | Required     |
| domain        | Symantec Endpoint Protection User's domain, defaults to "Default" domain | string   | Optional     |
| verify\_ssl   | Verify SSL certificate                                                   | boolean  | Optional     |
| http\_proxy   | A proxy to route requests through.                                       | string   | Optional     |

# Actions

## Add Fingerprint to Group

Adds a specific fingerprint to a Symantec Endpoint Protection group for system lockdown, requiring group and fingerprint IDs.

### Endpoint

- **URL:** `sepm/api/v1/groups/{{group_id}}/system-lockdown/fingerprints/{{fingerprint_id}}`
- **Method:** `PUT`

### Input

| **Argument Name**                | **Type** | **Required** | **Description**                                    |
| -------------------------------- | -------- | ------------ | -------------------------------------------------- |
| `path_parameters.group_id`       | string   | Required     | Parameters for the Add Fingerprint to Group action |
| `path_parameters.fingerprint_id` | string   | Required     | Parameters for the Add Fingerprint to Group action |

### Input Example

`{"path_parameters":{"group_id":"09AF1BF50A2000C06EF0620A092A5A17","fingerprint_id":"9EC5BEEFE64E406DA0AAC2A584BEE09E"}}`

### Output

| **Parameter**  | **Type** | **Description**                  |
| -------------- | -------- | -------------------------------- |
| `status_code`  | number   | HTTP status code of the response |
| `reason`       | string   | Response reason phrase           |
| `errorCode`    | string   | Error message if any             |
| `appErrorCode` | string   | Error message if any             |
| `errorMessage` | string   | Response message                 |

### Output Example

`{"status_code":423,"response_headers":{"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'self' https://win-qdbt6mvuilc:8443","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff, nosniff","Referrer-Policy":"strict-origin-when-cross-origin","Feature-Policy":"microphone 'none'; geolocation 'none'; usb 'none'; autoplay 'none' ","Pragma":"no-cache","Expires":"Thu, 01 Jan 1970 00:00:00 GMT","Cache-Control":"no-cache, no-store","X-Rate-Limit-Limit":"50","X-Rate-Limit...`

## Create New Blacklist

Adds a new file fingerprint list to the blacklist in Symantec Endpoint Protection Manager using details such as name, domainId, hashType, and data.

### Endpoint

- **URL:** `sepm/api/v1/policy-objects/fingerprints`
- **Method:** `POST`

### Input

| **Argument Name** | **Type** | **Required** | **Description**                    |
| ----------------- | -------- | ------------ | ---------------------------------- |
| `name`            | string   | Optional     | Name of the resource               |
| `domainId`        | string   | Optional     | Unique identifier                  |
| `description`     | string   | Optional     | Parameter for Create New Blacklist |
| `hashType`        | string   | Optional     | Type of the resource               |
| `data`            | array    | Optional     | Response data                      |

### Input Example

`{"json_body":{"name":"test","domainId":"E1B640690A2000C02F0213A4FD07BC8A","description":"a description","hashType":"MD5","data":["ac20a4ed0c586b32e80f2156188cd1a2"]}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |
| `id`          | string   | Unique identifier                |

### Output Example

`{"status_code":200,"response_headers":{"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'self' https://win-qdbt6mvuilc:8443","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff, nosniff","Referrer-Policy":"strict-origin-when-cross-origin","Feature-Policy":"microphone 'none'; geolocation 'none'; usb 'none'; autoplay 'none' ","Pragma":"no-cache","Expires":"Thu, 01 Jan 1970 00:00:00 GMT","Cache-Control":"no-cache, no-store","X-Rate-Limit-Limit":"50","X-Rate-Limit...`

## Delete Blacklist

Removes a specified blacklist entry from Symantec Endpoint Protection Manager using the provided ID.

### Endpoint

- **URL:** `sepm/api/v1/policy-objects/fingerprints/{{id}}`
- **Method:** `DELETE`

### Input

| **Argument Name**    | **Type** | **Required** | **Description**                            |
| -------------------- | -------- | ------------ | ------------------------------------------ |
| `path_parameters.id` | string   | Required     | Parameters for the Delete Blacklist action |

### Input Example

`{"path_parameters":{"id":"E5B43B239C334AB289CD842B09B97241"}}`

### Output

| **Parameter**   | **Type** | **Description**                  |
| --------------- | -------- | -------------------------------- |
| `status_code`   | number   | HTTP status code of the response |
| `reason`        | string   | Response reason phrase           |
| `response_text` | string   | Output field: response\_text     |

### Output Example

`{"status_code":200,"response_headers":{"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'self' https://win-qdbt6mvuilc:8443","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff, nosniff","Referrer-Policy":"strict-origin-when-cross-origin","Feature-Policy":"microphone 'none'; geolocation 'none'; usb 'none'; autoplay 'none' ","Pragma":"no-cache","Expires":"Thu, 01 Jan 1970 00:00:00 GMT","Cache-Control":"no-cache, no-store","X-Rate-Limit-Limit":"50","X-Rate-Limit...`

## Get Blacklist Fingerprint File by Name

Retrieves the file fingerprint blacklist by name, returning a set of associated hash values in Symantec Endpoint Protection.

### Endpoint

- **URL:** `sepm/api/v1/policy-objects/fingerprints`
- **Method:** `GET`

### Input

| **Argument Name** | **Type** | **Required** | **Description**                                                  |
| ----------------- | -------- | ------------ | ---------------------------------------------------------------- |
| `parameters.name` | string   | Optional     | Parameters for the Get Blacklist Fingerprint File by Name action |

### Input Example

`{"parameters":{"name":"file.txt"}}`

### Output

| **Parameter**        | **Type** | **Description**                  |
| -------------------- | -------- | -------------------------------- |
| `status_code`        | number   | HTTP status code of the response |
| `reason`             | string   | Response reason phrase           |
| `id`                 | string   | Unique identifier                |
| `name`               | string   | Name of the resource             |
| `hashType`           | string   | Type of the resource             |
| `source`             | string   | Output field: source             |
| `description`        | string   | Output field: description        |
| `data`               | array    | Response data                    |
| `groupIds`           | array    | Unique identifier                |
| `groupIds.file_name` | string   | Unique identifier                |
| `groupIds.file`      | string   | Unique identifier                |

### Output Example

`{"status_code":200,"response_headers":{"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'self' https://win-qdbt6mvuilc:8443","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff, nosniff","Referrer-Policy":"strict-origin-when-cross-origin","Feature-Policy":"microphone 'none'; geolocation 'none'; usb 'none'; autoplay 'none' ","Pragma":"no-cache","Expires":"Thu, 01 Jan 1970 00:00:00 GMT","Cache-Control":"no-cache, no-store","X-Rate-Limit-Limit":"50","X-Rate-Limit...`

## Get Domains

Retrieve a list of all accessible domains from Symantec Endpoint Protection Manager.

### Endpoint

- **URL:** `sepm/api/v1/domains`
- **Method:** `GET`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":200,"response_headers":{"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'self' https://win-qdbt6mvuilc:8443","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff, nosniff","Referrer-Policy":"strict-origin-when-cross-origin","Feature-Policy":"microphone 'none'; geolocation 'none'; usb 'none'; autoplay 'none' ","Pragma":"no-cache","Expires":"Thu, 01 Jan 1970 00:00:00 GMT","Cache-Control":"no-cache, no-store","X-Rate-Limit-Limit":"50","X-Rate-Limit...`

## Get File Fingerprint By ID

Retrieve a list of hash values representing the file fingerprint for a specified ID in Symantec Endpoint Protection.

### Endpoint

- **URL:** `sepm/api/v1/policy-objects/fingerprints/{{id}}`
- **Method:** `GET`

### Input

| **Argument Name**    | **Type** | **Required** | **Description**                                      |
| -------------------- | -------- | ------------ | ---------------------------------------------------- |
| `path_parameters.id` | string   | Required     | Parameters for the Get File Fingerprint By ID action |

### Input Example

`{"path_parameters":{"id":"25c0783596f8dc77528ff692a9dc82d1"}}`

### Output

| **Parameter**        | **Type** | **Description**                  |
| -------------------- | -------- | -------------------------------- |
| `status_code`        | number   | HTTP status code of the response |
| `reason`             | string   | Response reason phrase           |
| `id`                 | string   | Unique identifier                |
| `name`               | string   | Name of the resource             |
| `hashType`           | string   | Type of the resource             |
| `source`             | string   | Output field: source             |
| `description`        | string   | Output field: description        |
| `data`               | array    | Response data                    |
| `groupIds`           | array    | Unique identifier                |
| `groupIds.file_name` | string   | Unique identifier                |
| `groupIds.file`      | string   | Unique identifier                |

### Output Example

`{"status_code":200,"response_headers":{"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'self' https://win-qdbt6mvuilc:8443","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff, nosniff","Referrer-Policy":"strict-origin-when-cross-origin","Feature-Policy":"microphone 'none'; geolocation 'none'; usb 'none'; autoplay 'none' ","Pragma":"no-cache","Expires":"Thu, 01 Jan 1970 00:00:00 GMT","Cache-Control":"no-cache, no-store","X-Rate-Limit-Limit":"50","X-Rate-Limit...`

## Get Group

Retrieves a list of groups from Symantec Endpoint Protection for further analysis or action.

### Endpoint

- **URL:** `sepm/api/v1/groups`
- **Method:** `GET`

### Output

| **Parameter**                       | **Type** | **Description**                  |
| ----------------------------------- | -------- | -------------------------------- |
| `status_code`                       | number   | HTTP status code of the response |
| `reason`                            | string   | Response reason phrase           |
| `content`                           | array    | Response content                 |
| `content.id`                        | string   | Unique identifier                |
| `content.name`                      | string   | Name of the resource             |
| `content.description`               | string   | Response content                 |
| `content.fullPathName`              | string   | Name of the resource             |
| `content.numberOfPhysicalComputers` | number   | Response content                 |
| `content.numberOfRegisteredUsers`   | number   | Response content                 |
| `content.createdBy`                 | string   | Response content                 |
| `content.created`                   | number   | Response content                 |
| `content.lastModified`              | number   | Response content                 |
| `content.policySerialNumber`        | string   | Response content                 |
| `content.policyDate`                | number   | Response content                 |
| `content.customIpsNumber`           | string   | Response content                 |
| `content.domain`                    | object   | Response content                 |
| `content.domain.id`                 | string   | Unique identifier                |
| `content.domain.name`               | string   | Name of the resource             |
| `content.policyInheritanceEnabled`  | boolean  | Response content                 |
| `size`                              | number   | Output field: size               |
| `number`                            | number   | Output field: number             |
| `sort`                              | array    | Output field: sort               |
| `sort.direction`                    | string   | Output field: sort.direction     |
| `sort.property`                     | string   | Output field: sort.property      |
| `sort.ascending`                    | boolean  | Output field: sort.ascending     |

### Output Example

`{"status_code":200,"response_headers":{"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'self' https://win-qdbt6mvuilc:8443","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff, nosniff","Referrer-Policy":"strict-origin-when-cross-origin","Feature-Policy":"microphone 'none'; geolocation 'none'; usb 'none'; autoplay 'none' ","Pragma":"no-cache","Expires":"Thu, 01 Jan 1970 00:00:00 GMT","Cache-Control":"no-cache, no-store","X-Rate-Limit-Limit":"50","X-Rate-Limit...`

## Update Blacklist

Updates an existing blacklist in Symantec Endpoint Protection using the specified 'id'. System administrator account required.

### Endpoint

- **URL:** `sepm/api/v1/policy-objects/fingerprints/{{id}}`
- **Method:** `POST`

### Input

| **Argument Name**    | **Type** | **Required** | **Description**                            |
| -------------------- | -------- | ------------ | ------------------------------------------ |
| `path_parameters.id` | string   | Required     | Parameters for the Update Blacklist action |
| `name`               | string   | Optional     | Name of the resource                       |
| `domainId`           | string   | Optional     | Unique identifier                          |
| `description`        | string   | Optional     | Parameter for Update Blacklist             |
| `hashType`           | string   | Optional     | Type of the resource                       |
| `data`               | array    | Optional     | Response data                              |

### Input Example

`{"json_body":{"name":"test","domainId":"E1B640690A2000C02F0213A4FD07BC8A","description":"a description","hashType":"MD5","data":["ac20a4ed0c586b32e80f2156188cd1a2"]},"path_parameters":{"id":"E5B43B239C334AB289CD842B09B97241"}}`

### Output

| **Parameter**   | **Type** | **Description**                  |
| --------------- | -------- | -------------------------------- |
| `status_code`   | number   | HTTP status code of the response |
| `reason`        | string   | Response reason phrase           |
| `response_text` | string   | Output field: response\_text     |

### Output Example

`{"status_code":200,"response_headers":{"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'self' https://win-qdbt6mvuilc:8443","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff, nosniff","Referrer-Policy":"strict-origin-when-cross-origin","Feature-Policy":"microphone 'none'; geolocation 'none'; usb 'none'; autoplay 'none' ","Pragma":"no-cache","Expires":"Thu, 01 Jan 1970 00:00:00 GMT","Cache-Control":"no-cache, no-store","X-Rate-Limit-Limit":"50","X-Rate-Limit...`

## Update Content Command

Initiates a content update on specified Symantec Endpoint Protection endpoints using group or computer IDs. System administrator account required.

### Endpoint

- **URL:** `sepm/api/v1/command-queue/updatecontent`
- **Method:** `POST`

### Input

| **Argument Name**         | **Type** | **Required** | **Description**                                  |
| ------------------------- | -------- | ------------ | ------------------------------------------------ |
| `parameters.group_ids`    | array    | Required     | Parameters for the Update Content Command action |
| `parameters.computer_ids` | array    | Required     | Parameters for the Update Content Command action |

### Input Example

`{"parameters":{"group_ids":["09AF1BF50A2000C06EF0620A092A5A17"],"computer_ids":["09AF1BF50A2000C06EF0620A092A5A17"]}}`

### Output

| **Parameter**  | **Type** | **Description**                  |
| -------------- | -------- | -------------------------------- |
| `status_code`  | number   | HTTP status code of the response |
| `reason`       | string   | Response reason phrase           |
| `errorCode`    | string   | Error message if any             |
| `appErrorCode` | string   | Error message if any             |
| `errorMessage` | string   | Response message                 |

### Output Example

`{"status_code":400,"response_headers":{"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'self' https://win-qdbt6mvuilc:8443","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff, nosniff","Referrer-Policy":"strict-origin-when-cross-origin","Feature-Policy":"microphone 'none'; geolocation 'none'; usb 'none'; autoplay 'none' ","Pragma":"no-cache","Expires":"Thu, 01 Jan 1970 00:00:00 GMT","Cache-Control":"no-cache, no-store","X-Rate-Limit-Limit":"50","X-Rate-Limit...`

# Response Headers

| **Header**                | **Description**                                            | **Example**                                                                         |
| ------------------------- | ---------------------------------------------------------- | ----------------------------------------------------------------------------------- |
| Cache-Control             | Directives for caching mechanisms                          | no-cache, no-store                                                                  |
| Connection                | HTTP response header: Connection                           | close                                                                               |
| Content-Length            | The length of the response body in bytes                   | 0                                                                                   |
| Content-Security-Policy   | HTTP response header: Content-Security-Policy              | frame-ancestors 'self' [https://win-qdbt6mvuilc:8443](https://win-qdbt6mvuilc:8443) |
| Content-Type              | The media type of the resource                             | application/json;charset=UTF-8                                                      |
| Date                      | The date and time at which the message was originated      | Thu, 01 Dec 2022 15:58:49 GMT                                                       |
| Expires                   | The date/time after which the response is considered stale | Thu, 01 Jan 1970 00:00:00 GMT                                                       |
| Feature-Policy            | HTTP response header: Feature-Policy                       | microphone 'none'; geolocation 'none'; usb 'none'; autoplay 'none'                  |
| Keep-Alive                | HTTP response header: Keep-Alive                           | timeout=60                                                                          |
| Pragma                    | HTTP response header: Pragma                               | no-cache                                                                            |
| Referrer-Policy           | HTTP response header: Referrer-Policy                      | strict-origin-when-cross-origin                                                     |
| Server                    | Information about the software used by the origin server   | SEPM                                                                                |
| Strict-Transport-Security | HTTP response header: Strict-Transport-Security            | max-age=31536000 ; includeSubDomains                                                |
| Transfer-Encoding         | HTTP response header: Transfer-Encoding                    | chunked                                                                             |
| X-Content-Type-Options    | HTTP response header: X-Content-Type-Options               | nosniff, nosniff                                                                    |
| X-Frame-Options           | HTTP response header: X-Frame-Options                      | DENY                                                                                |
| X-Rate-Limit-Limit        | HTTP response header: X-Rate-Limit-Limit                   | 50                                                                                  |
| X-Rate-Limit-Remaining    | HTTP response header: X-Rate-Limit-Remaining               | 49                                                                                  |
| X-Rate-Limit-Reset        | HTTP response header: X-Rate-Limit-Reset                   | 21388                                                                               |
| X-XSS-Protection          | HTTP response header: X-XSS-Protection                     | 1; mode=block                                                                       |