Splunk Add-on for Symantec Endpoint Protection

Release notes for the Splunk Add-on for Symantec Endpoint Protection

Version 3.0.1 of the Splunk Add-on for Symantec Endpoint Protection was released on March 10, 2020.

Compatibility

Version 3.0.1 of the Splunk Add-on for Symantec Endpoint Protection is compatible with the following software, CIM versions, and platforms.

Splunk platform versions	7.0 or later
CIM	4.15.0
Platforms	Windows for the data collection node
Vendor Products	Symantec Endpoint Protection versions 14.0 to 14.2RU2

New features

Version 3.0.1 of the Splunk Add-on for Symantec Endpoint Protection has the following new features:

• FIPs compatibility.
• Support for new Vendor Product version 14.2RU1 and 14.2RU2.

Fixed issues

Version 3.0.1 of the Splunk Add-on for Symantec Endpoint Protection fixes the following (if any) issues.

Date resolved	Issue number	Description
2020-02-05	ADDON-21970	SEP: Transforms no longer match after upgrade to SEP 14.2 RU1

Known issues

Version 3.0.1 of the Splunk Add-on for Symantec Endpoint Protection contains the following (if any) known issues.

Date filed	Issue number	Description
2020-03-02	ADDON-25447	The value of Event_Description field is trimmed after single quote for sourcetype symantec:ep:admin:file for 14.2RU2

Third-party software attributions

Version 3.0.1 of the Splunk Add-on for Symantec Endpoint Protection incorporates the following:

• Httplib2 Python library
• future
• Configparser