Enable automatic updates to the Splunk Add-on for Symantec Endpoint Protection lookup files

Symantec maintains a list of the latest security threats on its website. The Splunk Add-on for Symantec Endpoint Protection can poll this site regularly to keep the malware categories updated with the latest list. To enable automatic updates to the malware categories lookup file symantec_ep_malware_categories.csv, install and configure the add-on by following these steps:

1. From the Splunk Web home screen on your search head, click the gear symbol next to Apps.
2. In the row for Splunk Add-on for Symantec Endpoint Protection, click Set up.
3. Click the check box next to "Enable Splunk Enterprise to automatically update the malware category lookup table with the latest list of threats and risks from Symantec."
4. Adjust the polling interval (measured in seconds), if needed.
5. If you are using a proxy, check Enable Proxy and complete the fields. The Splunk platform encrypts the proxy username and password when you save this page.
6. If you checked Enable Proxy, check the Use proxy to do DNS resolution box if you want to perform DNS resolution through your proxy.
7. If you checked Enable Proxy, select the type of proxy to use in the Proxy Type field.
8. Click Save to save your configurations.