--- title: Symantec EDR  description: "Symantec EDR uses machine learning and behavioral analytics to detect and expose suspicious network activities\n\nSymantec EDR and SIRP together provide users with a single platform to perform automated operations, such as retrieving events, blacklisting and whitelisting artifacts, incidents, and files from the Symantec EDR server and isolating or rejoining an endpoint," --- [Skip to content](https://content.sirp.io/knowledge-base/symantec-edr-help-center-sirp#main-content) English Show submenu for translations [Customer portal](https://content.sirp.io/customer-portal?hsLang=en) [![SIRP-Logo-4c-KO](https://content.sirp.io/hs-fs/hubfs/SIRP-Logo-4c-KO.png?width=200&height=90&name=SIRP-Logo-4c-KO.png)](https://sirp.io/) Open main navigation Close main navigation - English Show submenu for translations - [Customer portal](https://content.sirp.io/customer-portal) - [Contact us](https://content.sirp.io/customer-portal/new) [Contact us](https://content.sirp.io/customer-portal/new?hsLang=en) What would you like to automate today? - There are no suggestions because the search field is empty. 1. [SIRP Help Center](https://content.sirp.io/knowledge-base?hsLang=en) 2. [Integration Guide](https://content.sirp.io/knowledge-base/integration-guide?hsLang=en) # Symantec EDR ### **Symantec EDR Integration** Symantec EDR uses machine learning and behavioral analytics to detect and expose suspicious network activities Symantec EDR and SIRP together provide users with a single platform to perform automated operations, such as retrieving events, blacklisting and whitelisting artifacts, incidents, and files from the Symantec EDR server and isolating or rejoining an endpoint, Supported Actions SIRP’s Symantec EDR integration app allows you to execute the following actions: | **S.no** | **Action** | **Description** | | --- | --- | --- | | 1 | Get Incidents | Retrieves information about all incidents from the Symantec EDR. | | 2 | Mark Incident As Closed | Closes incident on the Symantec EDR. | | 3 | Update Incident Resolution | Update resolution on an incident on the Symantec EDR. | | 4 | Add IP To Allowlist | Push IP to Allowlist in Symantec EDR | | 5 | Add Domain to Allowlist | Push Domain to Allowlist in Symantec EDR | | 6 | Add URL to Allowlist | Push URL to Allowlist in Symantec EDR | | 7 | Add Hash to Allowlist | Push SHA256 to Allowlist in Symantec EDR | | 8 | Add IP To Blacklist | Push IP to Blacklist Symantec EDR | | 9 | Add Domain to Blacklist | Push Domain to Blacklist in Symantec EDR | | 10 | Add URL to Blacklist | Push URL to Blacklist in Symantec EDR | | 11 | Add Hash to Blacklist | Push MD5, SHA256 to Blacklist in Symantec EDR | | 12 | Add IP To Denylist | Push IP to Denylist in Symantec EDR | | 13 | Add Domain to Denylist | Push Domain to Denylist in Symantec EDR | | 14 | Add URL to Denylist | Push URL to Denylist in Symantec EDR | | 15 | Add Hash to Denylist | Push MD5, SHA256 to Denylist in Symantec EDR | | 16 | Remove IP from Blacklist. | Push out IP from Blacklist in Symantec EDR | | 17 | Remove Domain from Blacklist | Push out Domain from Blacklist in Symantec EDR | | 18 | Remove URL from Blacklist | Push out URL from Blacklist in Symantec EDR | | 19 | Remove Hash from Blacklist | Push out MD5, SHA256 from Blacklist in Symantec EDR | | 20 | Remove IP To Denylist | Push out IP from Denylist in Symantec EDR | | 21 | Remove Domain from Denylist | Push out Domain from Denylist in Symantec EDR | | 22 | Remove URL from Denylist | Push out URL from Denylist in Symantec EDR | | 23 | Remove Hash from Denylist | Push out MD5, SHA256 from Denylist in Symantec EDR | ### **Enable and Configure Symantec EDR** ### **Create a new user on the Symantec Instance** 1. Open your Symantec XDR instance. 2. In the **Settings** on the left, go to **Data Sharing.** 3. Under **OAuth Clients**, click **Add Application.** [![](https://downloads.intercomcdn.com/i/o/566854529/7a2d97163c132101b8fa8412/WhatsApp+Image+2022-08-22+at+1.27.04+PM.jpeg?expires=1752237000&signature=b0d4b4a81a0db1bbcfdf30b39f102fbc725022fcf8849dfefa817805d9779c7f&req=cSYhHsx6mINWFb4f3HP0gNzR47x5ScuqOD%2B2Hw3MnrrWTxPRukUvofpR0bgI%0AUck%3D%0A)](https://downloads.intercomcdn.com/i/o/566854529/7a2d97163c132101b8fa8412/WhatsApp+Image+2022-08-22+at+1.27.04+PM.jpeg?expires=1752237000&signature=b0d4b4a81a0db1bbcfdf30b39f102fbc725022fcf8849dfefa817805d9779c7f&req=cSYhHsx6mINWFb4f3HP0gNzR47x5ScuqOD%2B2Hw3MnrrWTxPRukUvofpR0bgI%0AUck%3D%0A) 4. In **Add Application:** 1. Add **App Name.** 2. Set **Enable V2 APIs** 3. Set **Role** to **Admin** [![](https://downloads.intercomcdn.com/i/o/566857099/6826522c6a4fbefa5873eafd/WhatsApp+Image+2022-08-22+at+1.27.04+PM+%281%29.jpeg?expires=1752237000&signature=6e5dab44fc488ef99583f5894a87034cb72f17061e81e0667218a1d14a6a981d&req=cSYhHsx5nYhWFb4f3HP0gNdU7JpNOG6yOPnKa%2BqqIPXumf86CCUX6mr3%2BtlP%0ATqA%3D%0A)](https://downloads.intercomcdn.com/i/o/566857099/6826522c6a4fbefa5873eafd/WhatsApp+Image+2022-08-22+at+1.27.04+PM+%281%29.jpeg?expires=1752237000&signature=6e5dab44fc488ef99583f5894a87034cb72f17061e81e0667218a1d14a6a981d&req=cSYhHsx5nYhWFb4f3HP0gNdU7JpNOG6yOPnKa%2BqqIPXumf86CCUX6mr3%2BtlP%0ATqA%3D%0A) 5. Copy **Client ID** and **Client Secret** and click done. [![](https://downloads.intercomcdn.com/i/o/566858101/f9d7d4a457947e1cc216969f/WhatsApp+Image+2022-08-22+at+1.27.06+PM+%281%29.jpeg?expires=1752237000&signature=a06b5598be9b21869d9c1d0ee54d520bbdf3472e885565ab1fc3c31b9c0c389f&req=cSYhHsx2nIFeFb4f3HP0gPfDpP2RgYr5YKjXBxxJutntDr8UXyxX7djqfprC%0AydU%3D%0A)](https://downloads.intercomcdn.com/i/o/566858101/f9d7d4a457947e1cc216969f/WhatsApp+Image+2022-08-22+at+1.27.06+PM+%281%29.jpeg?expires=1752237000&signature=a06b5598be9b21869d9c1d0ee54d520bbdf3472e885565ab1fc3c31b9c0c389f&req=cSYhHsx2nIFeFb4f3HP0gPfDpP2RgYr5YKjXBxxJutntDr8UXyxX7djqfprC%0AydU%3D%0A) ### Enable the Symantec EDR in SIRP 1. First, log in to SIRP, then go to **Apps** from the left navigation bar. 2. Locate the app named **Symantec EDR.** 3. **Enable** the Symantec EDR by clicking on the toggle button under the Status Column. [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/image-Jul-11-2025-11-57-40-5071-AM.png)](https://downloads.intercomcdn.com/i/o/566858706/088679e29aabc019661fefab/image.png?expires=1752237000&signature=10c1e5729723933a90d17b1062a3e53e1e8f3645efcff737205172550e1f35d4&req=cSYhHsx2moFZFb4f3HP0gBlRO%2Fh6kBe4zf6ouZxJRAC86SYMWGZR1exjwLGL%0AYIW4nVYW37QW4qvQ1A%3D%3D%0A) Once you enable the App, click the **configure** option to integrate SIRP with Symantec 1. Add the following details and click **Save**: 1. **URL:** \ 2. **Client-ID:** \ 3. **Client-Secret:** \ 4. **Configuration Name:** \ [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/image-Jul-11-2025-11-57-42-5320-AM.png)](https://downloads.intercomcdn.com/i/o/566859725/ec223d7515b8c4b814804a5e/image.png?expires=1752237000&signature=2f5f12516612adf5d8aea678cd8ddd9cc7a4da5fab54600e79d00baff556c247&req=cSYhHsx3moNaFb4f3HP0gH7upQKL17GBvtvGdmepHbx%2B0wcWuBEhKuWlsvis%0AG%2BJDkaA%2FrP50Xo7F5g%3D%3D%0A)[![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/WhatsApp%2BImage%2B2022-08-22%2Bat%2B1.27.06%2BPM.jpg)](https://downloads.intercomcdn.com/i/o/566860989/cb36b92c5d1a7cfcf053b0d9/WhatsApp+Image+2022-08-22+at+1.27.06+PM.jpeg?expires=1752237000&signature=5e8625f96f66cdf4a5616dcfb813a8011648c9e5d86d5e83996e1f5918a44cf0&req=cSYhHs9%2BlIlWFb4f3HP0gCZGHza9RasprMvdNaxmWhtEwyr1C%2BPloa0h7oPJ%0AYc09Cr4J4qILzMt%2F3w%3D%3D%0A) - [SIRP Community](https://content.sirp.io/knowledge-base/sirp-community?hsLang=en) - [Playbook Guide](https://content.sirp.io/knowledge-base/playbook-guide?hsLang=en) - [User Guide](https://content.sirp.io/knowledge-base/user-guide?hsLang=en#main-content) - [IM Guide](https://content.sirp.io/knowledge-base/user-guide?hsLang=en#im-guide) - [Admin Guide](https://content.sirp.io/knowledge-base/admin-guide?hsLang=en) - [Integration Guide](https://content.sirp.io/knowledge-base/integration-guide?hsLang=en) - [Release Notes](https://content.sirp.io/knowledge-base/release-notes?hsLang=en) - [Add on Apps](https://content.sirp.io/knowledge-base/add-on-apps?hsLang=en) - [Architecture](https://content.sirp.io/knowledge-base/architecture?hsLang=en) - [Use Cases](https://content.sirp.io/knowledge-base/use-cases?hsLang=en) [![SIRP-Logo-4c-KO](https://content.sirp.io/hs-fs/hubfs/SIRP-Logo-4c-KO.png?width=200&height=90&name=SIRP-Logo-4c-KO.png "SIRP-Logo-4c-KO")](https://sirp.io) ### Global Headquarter ##### United States 7735 Old Georgetown Rd, Suite 510 Bethesda, MD 20814 [+1 888 701 9252](tel:+18887019252) [mailto:email@email.com](mailto:email@email.com) Copyright © 2025, SIRP Labs Inc