Symantec Data Loss Prevention (DLP)

Update Symantec DLP

To update Symantec DLP

1. Note what version of Symantec DLP you have.

   • If your version is older than 15.7, see steps 4 and 5 below to gather required Report IDs.

   • If your version is newer than 15.7, identify the time zone used for your Symantec DLP server.

2. Verify that there is a role with adequate permissions for the API user to inherit.

   1. In Incidents section, select View and then Perform Attribute Lookup.
   2. In Incidents section, go to the Incident Reporting and Update API section, and select Incident Reporting and then Incident Update.

3. Create a user for the integration. Setup should include the following:

   1. Select password access.
   2. Under Report Preferences, select Include Incident Violations in XML Export and Include Incident History in XML Export.

   3. Assign the role from Step 1 to this user and make it the default role.

      This user can only be assigned one role.

      
      

      If you're using Active Directory to authenticate your API user, the username must be specified in a non-standard manner:
      • <Username>:<Active_Directory_Domain_In_Upper_Case>
        or
        <Role>\<Username>:<Active_Directory_Domain_In_Upper_Case>
      • Examples: svc-verodin:ACME.COM OR api-user\svc-verodin:ACME.COM
      • Reference: https://www.symantec.com/connect/forums/ad-user-authentication-dlp-reporting-and-updating-api#comment-8394101
4. (Optional) Log into the newly-created user account, and create a new Network Incident Report with the following settings:
   1. Set the Filter Status to Equals and New.
   2. Set the Filter Date to Today.
   3. Click Advanced Filter & Summarization.
   4. Add a Source IP filter.
   5. Add a Is Any Of condition.
   6. Add a comma-delimited list of Actor IP addresses.
   7. Save and name the report.

5. (Optional) Obtain the saved report ID number .

   1. In the left column of the DLP web UI, click the name of the newly created report

   2. In the browser's location bar, find the report number located in the URL as ?reportID=<NUMBER>.

      

      Finding the Report Number

API Calls

The following API call is used by the Validation Platform.

Update the Validation Platform

Prerequisites

Information to gather before you start:

1. IP address or hostname used to access Symantec DLP.
2. Port for Symantec DLP communications (typically 443).
3. Identify the Symantec DLP user credentials.
4. Identify the timezone used for the Symantec DLP server.
5. Capture the list of Saved Report IDs.

Configuration

To add the Symantec DLP integration

1. Go to Settings > Integrations.

2. Click Add Integration > Symantec DLP.

3. Enter information for the Host, Port, Username, and Password.

4. Select the API used in your version of Symantec DLP.
   1. If you selected soap, enter the Saved Report IDs identified in the steps above.
   2. If you selected rest, enter the time zone of the Symantec DLP server.

Symantec DLP Integration

5. Expand Advanced options and update the information if necessary.

6. Click Submit.

Verify connectivity

To verify connectivity to Symantec DLP

Click Test to verify that:

• The Director can communicate with Symantec DLP using the port specified.
• User credentials are working.