If you're having trouble at any stage please contact us at support@skyformation.com. 

Preface

The goal of this guide is to add a new SkyFormation for Symantec Endpoint Protection Mobile connector to your SkyFormation Platform.

Prerequisites

To add the Symantec Endpoint Protection Mobile connector to your SkyFormation app, you will need to have the following Symantec Endpoint Protection Mobile account's information at hand:

1. Organization ID
2. API URL
3. API token

To get this information you need to request it from Symantec through your portal, see https://support.symantec.com/en_US/article.TECH251805.html

Steps to onboard the connector to SkyFormation app

1. Logon to your SkyFormation Platform:

2. Navigate via left navigation panel to "Settings" section

3. Navigate via New Settings left navigation panel to "Accounts" section

4. Click the "Add Account" bottom

5. At the "SELECT SERVICE TO ADD" choose "Symantec EP mobile". You will see the following screen:

6. Fill in the following information:

    - Account Name
        Give the Symantec SEP mobile connector a meaningful name for you. 
        This will become your cloud app connector name displayed in the application and the 
        events sent to external systems as SIEM/Log management. This is a mandatory field.

      e.g. "Corporate Symantec Mobile Endpoint Security"     

    - Description
      Add a text that describes the Symantec SEP mobile service account for you.

     This is an optional field.

   - Organization ID, API URL, API token are the information pieces that you received from Symantec.

Important note: Skyformation uses the "security alerts" API from Symantec to pull the events. This API is designed to be used only by 1 application. Please make sure that you are not using this API directly yourself outside the skyformation app. Other Symantec services are not using this API. 

At this point you can click on "TEST CONNECTION" to make sure the connection is set up successfully, or just click on "DONE".

Start the connector and make sure that the status becomes "OK" after a few seconds.

DONE!