Shavlik Protect

Archived

The Shavlik Protect application normalizes Shavlik Protect events and enables you to analyze Shavlik Protect data. You can further customize the searches to perform in-depth analysis.

Release Details

Version: 5.0.0

Release date: 2020-05-14

Supported On: LogPoint v6.0.0 and later

SHA 256: ce543b16de9251899867d29c36e98bed96cf58211b37f60843709959362b6bad

Download

Package Details

Normalization Package
- LP_Shavlik Protect v_9_2

Enhancement

A minor update has been done in the application’s normalizer for better signature handling.

Installation

Follow these steps to install the Shavlik Protect v5.0.0 plugin:

Download the Shavlik Protect package from the Download section above.
Add the required Shavlik Protect as a device in LogPoint.
Create a collection policy with the Syslog collector and appropriate processing policy.
Assign the policy to the device.

Log Format

Expected Log Format

Shavlik Protect log format

Log Samples

QAI1212|AI15-003|NULL|Apple xxxxxx 12 x64|Gold|Installed|2015-09-02 09:48:48.320|PSWKAK01|PROxxxx|Abc|1.1.1.1|2015-09-02 10:00:18.790|2015-04-29 12:36:19.000 QNumber, Bulletin, ReleasedOn, ProductName, ServicePackName, InstallState, StartedOn, MachineName, Domain, LocaleName, LastKnownIP, LastPatchAssessedOn, InstalledOn

To export data to LogPoint use Syslog collector on port 514 on the LogPoint server.

Support

If you have any questions or require assistance, create a support ticket.