Symantec Endpoint Protection Connector

Complete the following prerequisite steps before configuring the connector in Qualys ETM. You will need access to your Symantec Endpoint Security console with permissions to create client applications.

1. Ensure you have access to your Symantec Endpoint Security console with permissions to create client applications.
2. Create a client application in the Symantec console and generate an Auth token using the OAuth credentials (see the steps below).
3. Confirm network connectivity: Qualys cloud must be able to reach your Symantec Endpoint Security API endpoint over HTTPS (port 443).

Creating a Client Application and Generating the Auth Token

Follow these steps to create a client application in Symantec Endpoint Security and obtain the Auth token required by the connector.

1. Log in to your Symantec Endpoint Security console.
2. In the left navigation menu, navigate to Integration > Client Application.
3. Click Add to create a new client application and provide a name for the application.
4. Configure the application privileges to include the following, then click Save:
   1. For Group Management, select View, Create, and Edit.
   2. For Remotely Run Commands, select Run Commands.
5. In the Client Application list, locate your application. Click the kebab icon (three-dot menu) next to your application and select Client Secret.
6. Copy the OAuth credentials value displayed on the screen.

   Important: This value is shown only once. Copy and store it securely before leaving this screen.

7. Use the OAuth credentials to generate an Auth token by executing a POST request to the Symantec token endpoint. The request should include the credentials in the Authorization header:

   curl -X POST https://api.sep.eu.securitycloud.symantec.com/v1/oauth2/tokens -H "accept: application/json" -H "authorization: {{OAuth Credentials value}}" -H "content-type: application/x-www-form-urlencoded"

8. Copy the Auth token value from the response. You will enter this token in the connector configuration in Qualys ETM.

Permissions Required

The client application created in the Symantec console must have the following privileges enabled. These permissions allow the connector to query the devices endpoint and retrieve asset data.

• Group Management – View, Create, Edit
• Remotely Run Commands – Run Commands

Scope and Data Access

The connector queries the Symantec devices endpoint (/v1/devices) to retrieve endpoint inventory. The API has a rate limit of 5,000 requests per hour with a default batch size of 1,000 records per request. Custom filtering and filter queries are not supported for this connector. Import of installed software and source tags is not supported.

Key Rotation

When the Auth token expires or needs to be rotated, generate a new token using the OAuth credentials from your Symantec client application and update the token value in the connector configuration in Qualys ETM. Refer to Troubleshooting if connector runs fail after token expiry.

In this step you provide the connector name, description, and the authentication token used to connect to the Symantec Endpoint Security API.

Connector Details

Authentication Details

After entering credentials, click Test Connection to verify connectivity. The following checks are performed:

• Network Reachability
• TLS Handshake
• Authentication Credential Check
• Authorization Scope Check
• Data Fetch

All five checks must pass before you can proceed to the next step. If any check fails, refer to Troubleshooting.

Configure which data the connector synchronizes and how frequently it runs.

The connector imports Host Assets (Compute) from the Symantec devices endpoint. Because the Broadcom API does not support incremental retrieval, the connector performs a full data pull on every run.

In the Schedule section, configure when the connector runs:

• Single Occurrence – specify an exact date and time for a one-time run.
• Recurring – specify start date/time, end date/time, and recurrence interval for ongoing synchronization.