> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Symantec Endpoint Protection Manager

> Connect ThreatAware to Symantec Endpoint Protection Manager (SEPM) for on-premises endpoint protection monitoring

## Overview

The Symantec Endpoint Protection Manager (SEPM) integration enables ThreatAware to access your on-premises SEPM deployment, providing visibility into endpoint protection status, threat detection, and security posture across your organisation.

<Info>
  **Connection Method**: API (On-Premises)
  **Setup Time**: 30 minutes
  **Access Required**: SEPM Administrator account
  **Network**: Requires firewall configuration for AWS-to-SEPM communication
</Info>

## Data collected

The SEPM integration provides:

* Endpoint protection status
* Threat detection events
* Security policy compliance
* Device security posture

## Use cases

<CardGroup cols={2}>
  <Card title="Endpoint Protection Monitoring" icon="shield-check">
    Monitor endpoint protection status across your organisation
  </Card>

  <Card title="Threat Detection" icon="exclamation-triangle">
    Track detected threats and malware on protected endpoints
  </Card>

  <Card title="Policy Compliance" icon="clipboard-check">
    Verify Symantec security policies are correctly applied
  </Card>

  <Card title="Security Incidents" icon="fire">
    Investigate and respond to endpoint security incidents
  </Card>
</CardGroup>

## Setup overview

SEPM integration requires configuration in three areas:

1. Creating a dedicated SEPM administrator account for ThreatAware
2. Configuring firewall rules to allow AWS infrastructure to communicate with SEPM
3. Providing connection details to ThreatAware

## Prerequisites

* SEPM deployed on-premises and accessible from the internet (or via VPN/proxy)
* SEPM Administrator account with permissions to add new administrators
* External IPv4 address and port for SEPM web services
* Firewall access to configure inbound rules

## Network configuration

### Firewall requirements

To enable ThreatAware (hosted in AWS) to communicate with your on-premises SEPM, configure firewall rules:

**Inbound Rules** - Allow traffic from ThreatAware's current allowlist IPs, available in-product under **Settings → Integrations → AWS Account / IP Whitelist Info**.

**External Port Mapping**:

* Map an **external port** (any available port) to SEPM's internal web services port
* SEPM default internal port: `8446`
* Example: External port `8446` → Internal IP `192.168.1.50:8446`

**IP Mapping Configuration**:

* External IPv4 address → SEPM internal IPv4 address
* Document both the external address and port for ThreatAware configuration

## Setup instructions

<Steps>
  <Step title="Create SEPM Administrator Account">
    * Log into SEPM using an existing Administrator account
    * Navigate to **Admin** in the SEPM console
    * Click "Add an Administrator"
  </Step>

  <Step title="Configure Administrator Details">
    In the **General Tab**:

    * **Username**: Create a unique username (e.g., `threataware-admin`)
    * **Full Name**: Enter a descriptive name (e.g., "ThreatAware Integration")
    * **Email Address**: Enter an administrative contact email
    * **Password**: Create a strong password and store securely
  </Step>

  <Step title="Set Administrator Permissions">
    Under the **Access Rights** section:

    * Select **Limited Administrator** (not Full Administrator)
    * Configure specific permissions required for ThreatAware:
      * Typically includes:
        * View reports and events
        * Access to threat information
        * Device inventory access
      * Avoid granting unnecessary permissions (follow least privilege principle)
    * Save the administrator account
  </Step>

  <Step title="Configure Firewall Rules">
    On your network firewall:

    * Create an **inbound rule** allowing traffic from ThreatAware's current allowlist IPs (see **Settings → Integrations → AWS Account / IP Whitelist Info**)
    * Configure port mapping:
      * External port → SEPM internal port `8446`
    * Document the external IPv4 address and port for ThreatAware
    * Test connectivity from an external location to verify access
  </Step>

  <Step title="Test SEPM Access">
    * Verify SEPM is accessible via the external IPv4 address and port
    * Test the URL: `https://{external-ip}:{external-port}`
    * Confirm the SEPM login page appears
    * Note any SSL certificate warnings (may be expected for on-premises systems)
  </Step>

  <Step title="Configure in ThreatAware">
    Log into ThreatAware and navigate to **Settings → Integrations**:

    * Search for and select **Symantec Endpoint Protection Manager**
    * Enter the following credentials:
      * **Username**: The SEPM administrator username created in Step 1
      * **Password**: The password for the SEPM administrator account
      * **External IPv4 Address**: The external IP address of SEPM
      * **External Port**: The external port mapped to SEPM (typically `8446`)
    * Click **Connect** or **Authorize** to establish the integration
  </Step>

  <Step title="Verify Connection">
    * Check the integration status displays as **Active**
    * Data collection will begin within 1 hour
    * Verify SEPM endpoint data appears in ThreatAware
  </Step>
</Steps>

## Required credentials

<AccordionGroup>
  <Accordion title="Username" icon="user">
    **Field Name**: SEPM Administrator Username
    **Type**: String
    **Description**: The username of the SEPM administrator account created for ThreatAware

    Example: `threataware-admin` or `svc_threataware`
  </Accordion>

  <Accordion title="Password" icon="lock">
    **Field Name**: SEPM Administrator Password
    **Type**: Password (encrypted)
    **Description**: The password for the SEPM administrator account

    <Tip>
      Store this credential securely in your organisation's password manager. Use a strong, unique password.
    </Tip>
  </Accordion>

  <Accordion title="External IPv4 Address" icon="server">
    **Field Name**: SEPM External IPv4 Address
    **Type**: String
    **Description**: The external IPv4 address used to access SEPM from the internet

    **Format**: Dotted IPv4 notation (e.g., `203.0.113.42`)
    **Note**: This should be the publicly routable address configured on your firewall
  </Accordion>

  <Accordion title="External Port" icon="plug">
    **Field Name**: SEPM External Port
    **Type**: Number
    **Description**: The external port mapped to SEPM's internal web services port

    **Default**: `8446` (mapped to internal SEPM port 8446)
    **Example**: Enter `8446` or your custom external port
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings → Integrations** in ThreatAware
   * Confirm SEPM shows **Active** status
   * Check the last sync timestamp

2. **Verify Endpoint Data**
   * Wait 60 minutes for the initial data poll
   * Search for a known protected endpoint in ThreatAware
   * Verify SEPM protection status appears in device details

3. **Test Security Data**
   * Create a test query to filter endpoints by protection status
   * Verify threat detection data if available
   * Confirm data matches SEPM Console

## Troubleshooting

<AccordionGroup>
  <Accordion title="Invalid Credentials Error" icon="triangle-exclamation">
    **Symptoms**: Integration status shows authentication failure

    **Solutions**:

    * Verify the **Username** and **Password** are correct
    * Ensure the SEPM administrator account is active and not locked
    * Confirm the account has not been disabled
    * Test logging into SEPM directly with these credentials
    * Verify the password was entered without extra spaces
  </Accordion>

  <Accordion title="Connection Timeout" icon="clock">
    **Symptoms**: Integration fails to connect or times out

    **Solutions**:

    * Verify the **External IPv4 Address** and **External Port** are correct
    * Test connectivity: Open `https://{external-ip}:{external-port}` in a browser
    * Confirm firewall rules allow traffic from ThreatAware AWS IPs to your SEPM
    * Check inbound rules for the four AWS IP addresses
    * Verify the port mapping is correctly configured on your firewall
    * Test from a different network to rule out local firewall issues
  </Accordion>

  <Accordion title="Firewall Configuration Issues" icon="ban">
    **Symptoms**: Integration connects intermittently or data collection fails

    **Solutions**:

    * Verify ThreatAware's current allowlist IPs are in the inbound firewall rule (see **Settings → Integrations → AWS Account / IP Whitelist Info**)
    * Confirm the external port is correctly mapped to SEPM port `8446`
    * Check for any IP filtering or blocking policies
    * Verify the firewall rule is enabled and has no time-based restrictions
    * Review firewall logs for any blocked connections
  </Accordion>

  <Accordion title="Permission Errors" icon="ban">
    **Symptoms**: Integration connects but cannot access endpoint data

    **Solutions**:

    * Verify the SEPM administrator account has "Limited Administrator" role
    * Ensure permissions include:
      * View reports and events
      * Device inventory access
      * Threat information access
    * Check that the account has not been restricted or suspended
    * Verify permissions have not been reduced since account creation
    * Update permissions if needed and retry the connection
  </Accordion>

  <Accordion title="SSL Certificate Issues" icon="lock">
    **Symptoms**: Connection fails with SSL/certificate warning

    **Solutions**:

    * On-premises SEPM typically uses self-signed certificates
    * This is expected and should not prevent integration
    * Verify the certificate error is from SEPM, not a network issue
    * If using a valid certificate, ensure it has not expired
    * Confirm the external IPv4 address matches the certificate CN/SAN
    * Contact your SEPM administrator if certificate issues persist
  </Accordion>

  <Accordion title="No Data After 1 Hour" icon="database">
    **Symptoms**: Integration shows active but no endpoint data appears

    **Solutions**:

    * Verify SEPM has protected endpoints with data to collect
    * Check that the administrator account can access endpoint data in SEPM
    * Confirm permissions have not been restricted or changed
    * Wait additional time - first sync may take longer than 1 hour
    * Review ThreatAware integration logs for error messages
    * Contact ThreatAware support if data collection continues to fail
  </Accordion>
</AccordionGroup>

## Security best practices

<Warning>
  **Firewall Security**

  * Only allow traffic from the specified ThreatAware AWS IP addresses
  * Do not open SEPM ports to the entire internet
  * Regularly audit and update firewall rules
  * Monitor firewall logs for suspicious connection attempts
</Warning>

<Tip>
  **Administrator Account Security**

  * Create a dedicated administrator account specifically for ThreatAware
  * Use a strong, unique password
  * Enable MFA if SEPM supports it
  * Store credentials securely in your password manager
  * Audit SEPM administrator accounts regularly
  * Review access logs for the ThreatAware account
</Tip>

<Tip>
  **Principle of Least Privilege**

  * Grant only necessary permissions to the ThreatAware administrator account
  * Use "Limited Administrator" role, not full administrator privileges
  * Restrict access to only the data ThreatAware needs
  * Review and update permissions periodically
  * Disable or delete the account if the integration is no longer needed
</Tip>

## Additional resources

<CardGroup cols={2}>
  <Card title="Symantec SEPM Documentation" icon="book" href="https://www.symantec.com/">
    Official Symantec SEPM documentation for API and administrator setup
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact ThreatAware support for integration assistance
  </Card>
</CardGroup>

## Important notes

<Info>
  **On-Premises Deployment**

  * SEPM integration requires network connectivity from ThreatAware infrastructure to your on-premises SEPM
  * Firewall configuration is essential for successful integration
  * External IPv4 address and port must be stable and consistently accessible
  * Test connectivity before finalizing ThreatAware configuration
</Info>

<Tip>
  **Maintenance and Monitoring**

  * Monitor the integration status regularly for connection stability
  * Verify firewall rules remain in place and unchanged
  * Test connectivity periodically to catch issues early
  * Keep SEPM and ThreatAware updated with latest versions
  * Review integration logs for any warnings or errors
</Tip>