MARS and Symantec Endpoint Protection (SAV 11.x)

[milee1420]

MARS uses AMS to retrieve/parse messages from older versions of Symantec Antivirus. AMS doesn't exist in the newest version (aka Symantec Endpoint Protection). Is there a way to integrate SEP messages into MARS? If not, does anyone know if Cisco has any plans to support SEP with MARS?

[pcomeaux]

Hi -

Supporting Symantec Endpoint Protection is under consideration for a future release.

Have you written a custom parser for this in the meantime?

thxs

peter

[milee1420]

No, we have not. That would've been outside the scope/budget. After discussing with a few Cisco TACs, we determined that it would be more cost effective to wait for the new release.