Improve Sysmantec Endpoint Protection (SEP) rules and decoders

[Lopuiz]

Hi team,

Exists some rules and decoders for Symantec products. They can be found in 0120-sysmantec-av_rules.xml, 0125-sysmantec-ws_rules.xml and 0330-sysmantec_decoders.xml files.

These rules have not been modified for three years and now have some flaws. For example:

1. Rule 7320 is not correct.

Event number 13 fire Symantec AntiVirus Shutdown.

And following rule says event 13 occurs when the scan is started or stopped.

https://github.com/wazuh/wazuh-ruleset/blob/725a0155cfde0a849729d9d174f03e1453e31242/rules/0120-symantec-av_rules.xml#L29-L34

2. The symantec-av decoder also doesn't seem match SEP logs:

https://github.com/wazuh/wazuh-ruleset/blob/725a0155cfde0a849729d9d174f03e1453e31242/decoders/0330-symantec_decoders.xml#L17-L22

3. Only exist rules for Eventlog logs format and not for Eventchannel logs format.

We could improve rules and decoders using the following information: Symantec Endpoint Protection 12.1.x event log entries

Best regards, Eva