Go to Settings >> Configuration >> Normalization Policies.
Click Add.
Enter a Policy Name.
Select Compiled Normalizers and Normalization Packages applicable for the Symantec Security application.
Click Submit.
Adding a Normalization Policy¶
Go to Settings >> Configuration >> Devices.
Click Add.
Create Device Panel¶
Enter a device Name.
Enter the IP address(es) of the Symantec Security server.
Select the Device Groups.
Select an appropriate Log Collection Policy for the logs.
Select a collector or a forwarder from the Distributed Collector drop-down menu.
Note
It is optional to select the Device Groups, the Log Collection Policy, and the Distributed Collector.
Select a Time Zone.
Note
The timezone of the device must be the same as that of its log source.
Configure the Risk Values for Confidentiality, Integrity, and Availability used to calculate the risk levels of the alerts generated from the device.
Click Submit.
Available Collectors Fetchers Panel¶
Click Syslog Collector on the Available Collectors Fetchers panel.
Syslog Collector Panel¶
Select the Syslog Parser.
Select the Processing Policy which contains the previously added normalization policy.
Select the Charset.
Select None as Proxy Server.
Click Submit.