As we continue to improve the Sync API service that our WSS customers use to obtain logs, we are modifying the behavior of the API to better handle situations where a start date for log retrieval is not specified or extended periods of log data are requested. Both situations are not common as the API is used primarily for near real-time log download. The API modifications will help ensure that a timely response is provided to all customers who utilize the API.Customer Impact
If you are currently downloading WSS logs via the Sync API, please be aware of the following API changes that are schedule to deploy August 5, 2020: If we receive a request without a start date or token (startDate=0 and token=none) the API will only return the last 7 days of data
If we receive a valid start date and no end date or an end date that is greater than 30 days, the API will return a maximum of 30 days data from the start date
Both of the situations described above are not common use cases for the Sync API as its primary function is to provide near real-time log download. Please review your scripts or SIEM plug-ins that utilize the Sync API to ensure the change will not impact your log retrieval.
Note: If you are using the Broadcom provided WSS Splunk plug-in, it will not be impacted by the changes. If you have the need to download logs covering extended periods of time, we do offer a Log Download feature via the WSS portal.
For Sync API details please refer to the Web Security Service Near Real-Time Log Sync Solution Brief.
If you experience issues following this update, contact Technical Support. Support information is located at https://support.broadcom.com/security or on the main Web Security Service Portal page at https://portal.threatpulse.com/
Please visit Symantec Status for periodic updates and to view the status of the service.