I need a solution
Is there anyway to force the IPS to ignore the 10.200.x.x range? I would have thought that the allow access rule would have stopped this type of blocking
0
↧
IPS Still blocking IPs even with Allow All rule
↧
Additinoal Site installation
I need a solution
HI,
When i am installing additional management site im getting this error.
Please assist.
0
↧
↧
Details of Active Scan location
I need a solution
From https://support.symantec.com/en_US/article.TECH122485.html , I get a general idea that the scan location depends on definition file provided by SEP.
How can I find the exact location which Active Scan will take place?
0
↧
moving sepm to new sepm
I need a solution
Hi Team,
Please suggest best way to move sepm to new sepm.
details -4 sepm load balanced with sql and need to setup same policy configuration to new sepm with new sql.
0
↧
Hash value
I need a solution
Does someone knows the site to check hash value coverage in bulk.
using virustotal.com only one ny one can be checked, i need for bulk.
0
↧
↧
File Integrity Monitoring
I need a solution
Hello, we are using SEPM 14 Mp2. Is the Host based integrity monitoring feature same as File Integrity monitoring (FIM) ? Can we leverage it to track and prevent unauthorized changes to system files, folders , registry etc?
0
↧
Allowing/disabling exceptions
I need a solution
Currently we allow all users to add exceptions to Symantec. If we were to disable all client restrictions for creating exceptions, would this affect all currently created exceptions or only new ones after this point.
Is there a way for all clients to report back to the SEPM with that exceptions are configured?
We would like to manage all exceptions through SEPM and not invididually on each system.
0
↧
How to upgrade MAC clients from SEPM
I need a solution
How to upgrade SEP MAC Clients to latest version from SEP Manager ?
0
↧
Having to turn SEP off to run windows updates on Server 2012 R2
I need a solution
I currently have 14.0 MP1 on my servers.
Windows update fails unless I disable SEP.
Is this corrected in 14.0.1 RU1?
0
↧
↧
Reporting incorrect
I need a solution
Hi all, Just joined a new company and have been tasked with getting things running a bit smoother.
I have noticed that there are a few servers that are not reporting correctly to the Endpoint Protection Manager correctly.
I am getting daily emails advising the virus definitions are older than 7 days however when i log onto the machines the endpoint is showing as up to date. I have noticed in the reporting logs they seem to be having an issue getting the definitions downloaded.
Can anyone point me in the right direction to get these up to date and reporting correctly?
0
↧
Exception while warming up client agent for applicaton sepm (Exception java.lang.NullPointerException)
I need a solution
Hi everyone,
I've observed a strange phenomenon; the manifestation of which has been discussed here but the symptom is different. I'm running SEPM on Window 2016 server and I'm starting to suspect that it's the OS which somehow wasn't tested on 12.x since even at this forum the OS drop down list does not include 2016 as an option; latest one listed is 2012.
A second very wierd thing is this: look at the actual text which is a copy/paste from the log file - the word "applicaton"? Is this just progremmers error when Symantec was compiling the product or is it significant in some other way?
Yes I do get the internal error screen when attempting to login to the SEP GUI but my log errors are different from what has been published under TECH248133
I get the following error in ajaxswing.log (location on Windows server for this log file is C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\logs):
2017/12/21 06:57:07:755 : Thread-3 : [com.creamtec.ajaxswing.core.ClientAgentFactory$1] Exception while warming up client agent for applicaton sepm (Exception java.lang.NullPointerException)
java.lang.NullPointerException
What makes this issue interesting is that if I reboot the SEPM then GUI works fine for a day or two and then its back to the java.lang.NullPointerException. I also don't see any of the accompanying errors in catalina.err described under TECH248133.
Does anyone have suggestions on where to go? My problem is that the symptom has been published with solutions and none work for me.
Thanks
0
↧
Symantec Endpoint Protection is not installing , Erro ; 2381 Directory does not exist : C:\Windows\system32\Drivers\SEP
I need a solution
Can't install client, Need a solution ASAP please...
0
↧
Attempting to enroll a 14 RU1 Symantec Endpoint Protection Manager after December 17th, 2017
I do not need a solution (just sharing information)
Please be advised: https://support.symantec.com/en_US/article.TECH248484.html
We are investigating alternative ways to resolve this issue for SEP 14 RU1.
SEP 14 RU1 MP1 should be available in the next week or two.
Thanks!
0
↧
↧
Unable to get virus definitions to install
I need a solution
I have SEP 14 installed on Windows 2012. This is a computer that does not connect to the internet. I downloaded the latest definitions file (I've tried both 32-bit and 64-bit just in case), but the updater fails every time. I've checked the boards and my dlls are set correctly. How do I solve this? The application is there but has no definitions at this point. Thank you.
Wed Dec 20 22:20:23 2017 : ******************************************************************
Wed Dec 20 22:20:23 2017 : Starting Intelligent Updater - Version 5.1.7.21
Wed Dec 20 22:20:23 2017 : ******************************************************************
Wed Dec 20 22:20:23 2017 : AUTH SYMSIGNED BEGIN: Started.
Wed Dec 20 22:20:23 2017 : AUTH SYMSIGNED CLASS3 BEGIN: Entering CriticalSection Initialization .
Wed Dec 20 22:20:23 2017 : AUTH SYMSIGNED CLASS3: Finding code signing : TRUE.
Wed Dec 20 22:20:23 2017 : AUTH SYMSIGNED END: Finished processing. Returns TRUE
Wed Dec 20 22:20:23 2017 : IU RES SYMSIGNED SUCCESS: Successfully verified Symantec Signature for the iuResource DLL
Wed Dec 20 22:20:23 2017 : IU RES LOAD: Successfully loaded the resource file..
Wed Dec 20 22:20:23 2017 : CONFIG LOAD SUCCESS: Successfully loaded the configuration file: iuConfig.xml.
Wed Dec 20 22:20:23 2017 : IU INFO: File-name : 20171220-008-Core16v5i32.EXE
Wed Dec 20 22:20:23 2017 : IU INFO: Creation-date : 20171220
Wed Dec 20 22:20:23 2017 : AUTH DLL LOCATION: IU will read the DLL SAVIUAuth location from registry.
Wed Dec 20 22:20:24 2017 : REG FAILURE: Failed while opening the key from registry. Return code: 2
Wed Dec 20 22:20:24 2017 : REG SUCCESS: Success while opening key
Wed Dec 20 22:20:24 2017 : REG SUCCESS: Succeeded while fetching the path from registry.
Wed Dec 20 22:20:24 2017 : AUTH DLL: DLL found for Entry number 0.
Wed Dec 20 22:20:24 2017 : Identified as 32-bit product installation. Continuing...
Wed Dec 20 22:20:24 2017 : IU MODE: IU is running is FULL mode.
Wed Dec 20 22:20:26 2017 : CONFIG LOAD SUCCESS: Successfully loaded the configuration file: iuConfig.xml.
Wed Dec 20 22:20:26 2017 : IU INFO: File-name : 20171220-008-Core16v5i32.EXE
Wed Dec 20 22:20:26 2017 : IU INFO: Creation-date : 20171220
Wed Dec 20 22:20:26 2017 : PROCESSING ENTRY: VIRSCAN.zip - Virus Definitions
Wed Dec 20 22:20:26 2017 : Entry details:
Wed Dec 20 22:20:26 2017 : Update-File: VIRSCAN.zip
Wed Dec 20 22:20:26 2017 : Update-Desc: Virus Definitions
Wed Dec 20 22:20:26 2017 : Auth DLL Name: SAVIUAuth
Wed Dec 20 22:20:26 2017 : Auth DLL Location: local
Wed Dec 20 22:20:26 2017 : Auth Content-Type: virus definitions x32
Wed Dec 20 22:20:26 2017 : Deploy Content-Type: virus definitions x32
Wed Dec 20 22:20:26 2017 : Deploy DLL Name: SAVIUDeploy
Wed Dec 20 22:20:26 2017 : Deploy DLL Location: local
Wed Dec 20 22:20:26 2017 : AUTH DLL LOCATION: IU will read the DLL location from registry - SAVIUAuth
Wed Dec 20 22:20:26 2017 : REG SUCCESS: Success while opening key
Wed Dec 20 22:20:26 2017 : REG SUCCESS: Succeeded while fetching the path from registry.
Wed Dec 20 22:20:26 2017 : DEPLOY DLL LOCATION: IU will read the DLL location from registry - SAVIUDeploy
Wed Dec 20 22:20:26 2017 : REG SUCCESS: Success while opening key
Wed Dec 20 22:20:26 2017 : REG SUCCESS: Succeeded while fetching the path from registry.
Wed Dec 20 22:20:26 2017 : AUTH SYMSIGNED BEGIN: Started.
Wed Dec 20 22:20:26 2017 : AUTH SYMSIGNED CLASS3 BEGIN: Entering CriticalSection Initialization .
Wed Dec 20 22:20:26 2017 : AUTH SYMSIGNED CLASS3: Finding code signing : TRUE.
Wed Dec 20 22:20:26 2017 : AUTH SYMSIGNED END: Finished processing. Returns TRUE
Wed Dec 20 22:20:26 2017 : AUTH SYMSIGNED SUCCESS: Successfully verified Symantec Signature for the authorization dll C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\14.0.3752.1000.105\Bin\LuAuth.dll
Wed Dec 20 22:20:26 2017 : AUTH LOAD SUCCESS: Successfully loaded the authorization dll - C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\14.0.3752.1000.105\Bin\LuAuth.dll
Wed Dec 20 22:20:26 2017 : AUTH SYMSIGNED BEGIN: Started.
Wed Dec 20 22:20:26 2017 : AUTH SYMSIGNED CLASS3 BEGIN: Entering CriticalSection Initialization .
Wed Dec 20 22:20:26 2017 : AUTH SYMSIGNED CLASS3: Finding code signing : TRUE.
Wed Dec 20 22:20:26 2017 : AUTH SYMSIGNED END: Finished processing. Returns TRUE
Wed Dec 20 22:20:26 2017 : DEPLOY SYMSIGNED SUCCESS: Successfully verified Symantec Signature for the deployment dll C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\14.0.3752.1000.105\Bin\DuLuCbk.dll
Wed Dec 20 22:20:26 2017 : DEPLOY LOAD SUCCESS: Successfully loaded the deployment dll - C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\14.0.3752.1000.105\Bin\DuLuCbk.dll
Wed Dec 20 22:20:26 2017 : AUTHORIZATION FAILED: VIRSCAN.zip is not authorized for deployment. Error code : 104
Wed Dec 20 22:20:26 2017 : IGNORE ENTRY: Ignoring entry for VIRSCAN.zip because it is not authorized for deployment
Wed Dec 20 22:20:26 2017 : PROCESSING ENTRY: VIRSCAN.zip - Virus Definitions
Wed Dec 20 22:20:26 2017 : Entry details:
Wed Dec 20 22:20:26 2017 : Update-File: VIRSCAN.zip
Wed Dec 20 22:20:26 2017 : Update-Desc: Virus Definitions
Wed Dec 20 22:20:26 2017 : Auth DLL Name: ISAuthDLL
Wed Dec 20 22:20:26 2017 : Auth DLL Location: local
Wed Dec 20 22:20:26 2017 : Auth Content-Type: virus definitions x32
Wed Dec 20 22:20:26 2017 : Deploy Content-Type: virus definitions x32
Wed Dec 20 22:20:26 2017 : Deploy DLL Name: ISDeployDLL
Wed Dec 20 22:20:26 2017 : Deploy DLL Location: local
Wed Dec 20 22:20:26 2017 : AUTH DLL LOCATION: IU will read the DLL location from registry - ISAuthDLL
Wed Dec 20 22:20:26 2017 : REG SUCCESS: Success while opening key
Wed Dec 20 22:20:26 2017 : REG FAILURE: Failed while fetching the path from registry.
Wed Dec 20 22:20:26 2017 : DEPLOY DLL LOCATION: IU will read the DLL location from registry - ISDeployDLL
Wed Dec 20 22:20:26 2017 : REG SUCCESS: Success while opening key
Wed Dec 20 22:20:26 2017 : REG FAILURE: Failed while fetching the path from registry.
Wed Dec 20 22:20:26 2017 : IGNORE ENTRY: Ignoring entry for VIRSCAN.zip because of registry read failure. Error occurred while reading the path for the Authorization DLL from the registry.
Wed Dec 20 22:20:26 2017 : The product corresponding to this entry in iuconfig.xml is not installed on the system.
Wed Dec 20 22:20:26 2017 : PROCESSING ENTRY: VIRSCAN.zip - Virus Definitions
Wed Dec 20 22:20:26 2017 : Entry details:
Wed Dec 20 22:20:26 2017 : Update-File: VIRSCAN.zip
Wed Dec 20 22:20:26 2017 : Update-Desc: Virus Definitions
Wed Dec 20 22:20:26 2017 : Auth DLL Name: Norton X32 AuthDLL
Wed Dec 20 22:20:26 2017 : Auth DLL Location: local
Wed Dec 20 22:20:26 2017 : Auth Content-Type: VirusDefs
Wed Dec 20 22:20:26 2017 : Deploy Content-Type: VirusDefs
Wed Dec 20 22:20:26 2017 : Deploy DLL Name: Norton X32 DeployDLL
Wed Dec 20 22:20:26 2017 : Deploy DLL Location: local
Wed Dec 20 22:20:26 2017 : AUTH DLL LOCATION: IU will read the DLL location from registry - Norton X32 AuthDLL
Wed Dec 20 22:20:26 2017 : REG SUCCESS: Success while opening key
Wed Dec 20 22:20:26 2017 : REG FAILURE: Failed while fetching the path from registry.
Wed Dec 20 22:20:26 2017 : DEPLOY DLL LOCATION: IU will read the DLL location from registry - Norton X32 DeployDLL
Wed Dec 20 22:20:26 2017 : REG SUCCESS: Success while opening key
Wed Dec 20 22:20:26 2017 : REG FAILURE: Failed while fetching the path from registry.
Wed Dec 20 22:20:26 2017 : IGNORE ENTRY: Ignoring entry for VIRSCAN.zip because of registry read failure. Error occurred while reading the path for the Authorization DLL from the registry.
Wed Dec 20 22:20:26 2017 : The product corresponding to this entry in iuconfig.xml is not installed on the system.
Wed Dec 20 22:20:26 2017 : PROCESSING ENTRY: VIRSCAN.zip - Virus Definitions
Wed Dec 20 22:20:26 2017 : Entry details:
Wed Dec 20 22:20:26 2017 : Update-File: VIRSCAN.zip
Wed Dec 20 22:20:26 2017 : Update-Desc: Virus Definitions
Wed Dec 20 22:20:26 2017 : Auth DLL Name: SSEIUAuth
Wed Dec 20 22:20:26 2017 : Auth DLL Location: local
Wed Dec 20 22:20:26 2017 : Auth Content-Type: virus definitions x32
Wed Dec 20 22:20:26 2017 : Deploy Content-Type: virus definitions x32
Wed Dec 20 22:20:26 2017 : Deploy DLL Name: SSEIUDeploy
Wed Dec 20 22:20:26 2017 : Deploy DLL Location: local
Wed Dec 20 22:20:26 2017 : AUTH DLL LOCATION: IU will read the DLL location from registry - SSEIUAuth
Wed Dec 20 22:20:26 2017 : REG SUCCESS: Success while opening key
Wed Dec 20 22:20:26 2017 : REG FAILURE: Failed while fetching the path from registry.
Wed Dec 20 22:20:26 2017 : DEPLOY DLL LOCATION: IU will read the DLL location from registry - SSEIUDeploy
Wed Dec 20 22:20:26 2017 : REG SUCCESS: Success while opening key
Wed Dec 20 22:20:26 2017 : REG FAILURE: Failed while fetching the path from registry.
Wed Dec 20 22:20:26 2017 : IGNORE ENTRY: Ignoring entry for VIRSCAN.zip because of registry read failure. Error occurred while reading the path for the Authorization DLL from the registry.
Wed Dec 20 22:20:26 2017 : The product corresponding to this entry in iuconfig.xml is not installed on the system.
Wed Dec 20 22:20:26 2017 : PROCESSING ENTRY: VIRSCAN.zip - Virus Definitions
Wed Dec 20 22:20:26 2017 : Entry details:
Wed Dec 20 22:20:26 2017 : Update-File: VIRSCAN.zip
Wed Dec 20 22:20:26 2017 : Update-Desc: Virus Definitions
Wed Dec 20 22:20:26 2017 : Auth DLL Name: SSEIUAuth
Wed Dec 20 22:20:26 2017 : Auth DLL Location: local
Wed Dec 20 22:20:26 2017 : Auth Content-Type: csapi_defs
Wed Dec 20 22:20:26 2017 : Deploy Content-Type: csapi_defs
Wed Dec 20 22:20:26 2017 : Deploy DLL Name: SSEIUDeploy
Wed Dec 20 22:20:26 2017 : Deploy DLL Location: local
Wed Dec 20 22:20:26 2017 : AUTH DLL LOCATION: IU will read the DLL location from registry - SSEIUAuth
Wed Dec 20 22:20:26 2017 : REG SUCCESS: Success while opening key
Wed Dec 20 22:20:26 2017 : REG FAILURE: Failed while fetching the path from registry.
Wed Dec 20 22:20:26 2017 : DEPLOY DLL LOCATION: IU will read the DLL location from registry - SSEIUDeploy
Wed Dec 20 22:20:26 2017 : REG SUCCESS: Success while opening key
Wed Dec 20 22:20:26 2017 : REG FAILURE: Failed while fetching the path from registry.
Wed Dec 20 22:20:26 2017 : IGNORE ENTRY: Ignoring entry for VIRSCAN.zip because of registry read failure. Error occurred while reading the path for the Authorization DLL from the registry.
Wed Dec 20 22:20:26 2017 : The product corresponding to this entry in iuconfig.xml is not installed on the system.
Wed Dec 20 22:20:26 2017 : PROCESSING ENTRY: VIRSCAN.zip - Virus Definitions
Wed Dec 20 22:20:26 2017 : Entry details:
Wed Dec 20 22:20:26 2017 : Update-File: VIRSCAN.zip
Wed Dec 20 22:20:26 2017 : Update-Desc: Virus Definitions
Wed Dec 20 22:20:26 2017 : Auth DLL Name: SMSDOMIUAuth
Wed Dec 20 22:20:26 2017 : Auth DLL Location: local
Wed Dec 20 22:20:26 2017 : Auth Content-Type: virus definitions x32
Wed Dec 20 22:20:26 2017 : Deploy Content-Type: virus definitions x32
Wed Dec 20 22:20:26 2017 : Deploy DLL Name: SMSDOMIUDeploy
Wed Dec 20 22:20:26 2017 : Deploy DLL Location: local
Wed Dec 20 22:20:26 2017 : AUTH DLL LOCATION: IU will read the DLL location from registry - SMSDOMIUAuth
Wed Dec 20 22:20:26 2017 : REG SUCCESS: Success while opening key
Wed Dec 20 22:20:26 2017 : REG FAILURE: Failed while fetching the path from registry.
Wed Dec 20 22:20:26 2017 : DEPLOY DLL LOCATION: IU will read the DLL location from registry - SMSDOMIUDeploy
Wed Dec 20 22:20:26 2017 : REG SUCCESS: Success while opening key
Wed Dec 20 22:20:26 2017 : REG FAILURE: Failed while fetching the path from registry.
Wed Dec 20 22:20:26 2017 : IGNORE ENTRY: Ignoring entry for VIRSCAN.zip because of registry read failure. Error occurred while reading the path for the Authorization DLL from the registry.
Wed Dec 20 22:20:26 2017 : The product corresponding to this entry in iuconfig.xml is not installed on the system.
Wed Dec 20 22:20:26 2017 : PROCESSING ENTRY: VIRSCAN.zip - Virus Definitions
Wed Dec 20 22:20:26 2017 : Entry details:
Wed Dec 20 22:20:26 2017 : Update-File: VIRSCAN.zip
Wed Dec 20 22:20:26 2017 : Update-Desc: Virus Definitions
Wed Dec 20 22:20:26 2017 : Auth DLL Name: SMSMSEIUAuth
Wed Dec 20 22:20:26 2017 : Auth DLL Location: local
Wed Dec 20 22:20:26 2017 : Auth Content-Type: virus definitions x32
Wed Dec 20 22:20:26 2017 : Deploy Content-Type: virus definitions x32
Wed Dec 20 22:20:26 2017 : Deploy DLL Name: SMSMSEIUDeploy
Wed Dec 20 22:20:26 2017 : Deploy DLL Location: local
Wed Dec 20 22:20:26 2017 : AUTH DLL LOCATION: IU will read the DLL location from registry - SMSMSEIUAuth
Wed Dec 20 22:20:26 2017 : REG SUCCESS: Success while opening key
Wed Dec 20 22:20:26 2017 : REG FAILURE: Failed while fetching the path from registry.
Wed Dec 20 22:20:26 2017 : DEPLOY DLL LOCATION: IU will read the DLL location from registry - SMSMSEIUDeploy
Wed Dec 20 22:20:26 2017 : REG SUCCESS: Success while opening key
Wed Dec 20 22:20:26 2017 : REG FAILURE: Failed while fetching the path from registry.
Wed Dec 20 22:20:26 2017 : IGNORE ENTRY: Ignoring entry for VIRSCAN.zip because of registry read failure. Error occurred while reading the path for the Authorization DLL from the registry.
Wed Dec 20 22:20:26 2017 : The product corresponding to this entry in iuconfig.xml is not installed on the system.
0
↧
Upgrade SEP 12 to SEP 14 and use new Sylink.xml
I need a solution
Hi,
We are upgrading the SEP 12 client on 7,000 Windows 7 desktops to SEP 14. We have SEPM 12 servers and new SEPM 14 servers. The SEP 12 clients are currently being managed by the SEPM 12 servers they have to be switched to the SEPM 14 servers when upgraded.
The SEP 14 client install has the SEPM 14 SyLink.xml, but it seems to be ignored when updating the client as once the update is complete the client is still communicating with the "old" SEPM 12 servers.
I tried using KeepPreviousSetting=0 in SetAid.ini, but that results in the upgraded client being self-managed.
Is there a way to tell the SEP 14 client upgrade to use the new SyLink.xml when upgrading without having to manually run something like SylinkDrop before launching the upgrade ?
Thanks
0
↧
SEPFL: How do I make sure many clients don't render network drives unusable?
I need a solution
We are running SEPFL on CentOS, and we're concerned that a large number of managed clients running their scheduled scans at the same time will basically DDoS the file server. Users' home directories are stored on a networked drive. If every single client runs its scheduled scan at 00:30, we're worried that people using applications that require data on the network will be unable to get their work done.
The first question is simply: Is this something that we need to be worried about? or is SEP really smart about these things so that it doesn't create issues with this?
The second question is, supposing that this is a very real issue: How do I make sure SEP doesn't render the network drives unusable during scheduled scans? One possible, though potentially messy to maintain solution I've come up with is setting individual clients to stagger their scans. As I understand it, this would be done with the sav scheduledscan command; however, I would need to delete the default scheduled scan. The command to delete the scan requires the scan ID. I do not know how to get it. I run the list command, but it apparently doesn't give the scan ID. It has a column called S.No which says the default scan is number 1, but when I run the info command for scan ID 1, it says "Scan not found".
Any help is appreciated.
0
↧
Endpoint Detection and Response Status "no status reported"
I need a solution
Hi- I am running SEP on both Mac and Windows, versions 12 and 14 on both OSs. When I run the scheduled report Client Status\Client Inventory Details, I have all of the clients show the Endpoint Detection and Response Status field as either "no status reported" or "disabled".
I discovered that "disabled" indicates that one or more components on the client have been diabled. What does "no status reported" mean?
This is on both OSs, both versions of SEP. Virus definitions and IPS signatures are updating as expected. SEP Manager is version 14.0.2349.0100 running on Winodws Server 2008 R2
Thanx
OregonSteve
"Never, never doubt what nobody is sure about." -Willy Wonka
0
↧
↧
Linux Machines (RedHat, Ubuntu, etc) are not directly taking updates from the SEPM
I need a solution
I have linux machines with different Linux OS RedHat, Ubuntu, etc..
issue is all Linux Machines are not directly taking updates from the SEPM
currently i am updating all linux machines with Intelligent Updater (IU) definitions. is it possible that all machine take definitions from SEPM?
0
↧
SEP IPS log has incorrect Begin Time
I need a solution
Hello,
Can everybody give an explaination of Time Stamp, Event Type, Begin Time, End Time in SEP Attack log?
I have the issue on client side when IPS log has different timing on some SEP agents running 12.1RU6MP8. The Begin Time does not comply to Event Time in View Logs -> Security Log (NTP Attack logs).
For example, I filtered Begin Time by October then see Time Stamp or Event Time have timings from December. With my ongoing test the timing are different on some SEP agents.
That means SEPM notifies me with alert that was happend 2 months ago even the host was always online with healthy SEP agent.
| Time Stamp | Event Type | Event Time | Begin Time | End Time |
| 01.12.2017 6:27 | Intrusion Prevention | 01.12.2017 6:26 | 12.10.2017 13:21 | 12.10.2017 13:21 |
| 01.12.2017 16:40 | Intrusion Prevention | 01.12.2017 16:39 | 12.10.2017 23:34 | 12.10.2017 23:34 |
| 02.12.2017 17:46 | Intrusion Prevention | 02.12.2017 17:45 | 14.10.2017 0:40 | 14.10.2017 0:40 |
| 02.12.2017 17:46 | Intrusion Prevention | 02.12.2017 17:45 | 14.10.2017 0:40 | 14.10.2017 0:40 |
| 03.12.2017 1:12 | Intrusion Prevention | 03.12.2017 1:11 | 14.10.2017 8:06 | 14.10.2017 8:06 |
| 03.12.2017 8:01 | Intrusion Prevention | 03.12.2017 8:00 | 14.10.2017 14:55 | 14.10.2017 14:55 |
| 03.12.2017 8:01 | Intrusion Prevention | 03.12.2017 8:01 | 14.10.2017 14:56 | 14.10.2017 14:56 |
| 04.12.2017 3:46 | Intrusion Prevention | 04.12.2017 3:45 | 15.10.2017 10:40 | 15.10.2017 10:40 |
| 04.12.2017 15:08 | Intrusion Prevention | 04.12.2017 15:07 | 15.10.2017 22:02 | 15.10.2017 22:02 |
| 04.12.2017 19:58 | Intrusion Prevention | 04.12.2017 19:57 | 16.10.2017 2:52 | 16.10.2017 2:52 |
| 05.12.2017 19:27 | Intrusion Prevention | 05.12.2017 18:43 | 17.10.2017 1:38 | 17.10.2017 1:38 |
| 05.12.2017 19:27 | Intrusion Prevention | 05.12.2017 18:43 | 17.10.2017 1:38 | 17.10.2017 1:38 |
| 06.12.2017 5:19 | Intrusion Prevention | 06.12.2017 5:18 | 17.10.2017 12:13 | 17.10.2017 12:13 |
| 06.12.2017 12:18 | Intrusion Prevention | 06.12.2017 12:17 | 17.10.2017 19:12 | 17.10.2017 19:12 |
| 06.12.2017 12:18 | Intrusion Prevention | 06.12.2017 12:17 | 17.10.2017 19:12 | 17.10.2017 19:12 |
| 07.12.2017 7:18 | Intrusion Prevention | 07.12.2017 7:17 | 18.10.2017 14:12 | 18.10.2017 14:12 |
| 07.12.2017 10:44 | Intrusion Prevention | 07.12.2017 10:44 | 18.10.2017 17:38 | 18.10.2017 17:38 |
| 07.12.2017 10:44 | Intrusion Prevention | 07.12.2017 10:44 | 18.10.2017 17:38 | 18.10.2017 17:38 |
| 08.12.2017 8:47 | Intrusion Prevention | 08.12.2017 8:46 | 19.10.2017 15:41 | 19.10.2017 15:41 |
| 08.12.2017 8:47 | Intrusion Prevention | 08.12.2017 8:46 | 19.10.2017 15:41 | 19.10.2017 15:41 |
| 10.12.2017 5:09 | Intrusion Prevention | 10.12.2017 5:08 | 21.10.2017 12:03 | 21.10.2017 12:03 |
| 10.12.2017 8:02 | Intrusion Prevention | 10.12.2017 8:01 | 21.10.2017 14:55 | 21.10.2017 14:55 |
| 10.12.2017 8:02 | Intrusion Prevention | 10.12.2017 8:01 | 21.10.2017 14:56 | 21.10.2017 14:56 |
| 11.12.2017 7:46 | Intrusion Prevention | 11.12.2017 7:45 | 22.10.2017 14:39 | 22.10.2017 14:39 |
| 11.12.2017 7:46 | Intrusion Prevention | 11.12.2017 7:45 | 22.10.2017 14:40 | 22.10.2017 14:40 |
| 12.12.2017 21:20 | Intrusion Prevention | 12.12.2017 21:19 | 24.10.2017 4:13 | 24.10.2017 4:13 |
| 13.12.2017 18:10 | Intrusion Prevention | 13.12.2017 18:09 | 25.10.2017 1:04 | 25.10.2017 1:04 |
| 14.12.2017 6:13 | Intrusion Prevention | 14.12.2017 6:12 | 25.10.2017 13:06 | 25.10.2017 13:06 |
| 15.12.2017 6:52 | Intrusion Prevention | 15.12.2017 6:51 | 26.10.2017 13:45 | 26.10.2017 13:45 |
| 17.12.2017 8:01 | Intrusion Prevention | 17.12.2017 8:00 | 28.10.2017 14:55 | 28.10.2017 14:55 |
| 17.12.2017 8:02 | Intrusion Prevention | 17.12.2017 8:01 | 28.10.2017 14:55 | 28.10.2017 14:55 |
| 18.12.2017 7:49 | Intrusion Prevention | 18.12.2017 7:48 | 29.10.2017 14:43 | 29.10.2017 14:43 |
| 18.12.2017 10:47 | Intrusion Prevention | 18.12.2017 10:46 | 29.10.2017 17:40 | 29.10.2017 17:40 |
| 18.12.2017 10:47 | Intrusion Prevention | 18.12.2017 10:46 | 29.10.2017 17:40 | 29.10.2017 17:40 |
| 18.12.2017 17:29 | Intrusion Prevention | 18.12.2017 17:28 | 30.10.2017 0:22 | 30.10.2017 0:22 |
| 19.12.2017 0:34 | Intrusion Prevention | 19.12.2017 0:33 | 30.10.2017 7:28 | 30.10.2017 7:28 |
| 19.12.2017 9:20 | Intrusion Prevention | 19.12.2017 9:18 | 30.10.2017 16:13 | 30.10.2017 16:13 |
| 19.12.2017 13:35 | Intrusion Prevention | 19.12.2017 13:34 | 30.10.2017 20:28 | 30.10.2017 20:28 |
| 19.12.2017 23:11 | Intrusion Prevention | 19.12.2017 23:11 | 31.10.2017 6:05 | 31.10.2017 6:05 |
| 20.12.2017 10:48 | Intrusion Prevention | 20.12.2017 10:47 | 31.10.2017 17:41 | 31.10.2017 17:41 |
| 20.12.2017 13:07 | Intrusion Prevention | 20.12.2017 13:06 | 31.10.2017 20:00 | 31.10.2017 20:00 |
| 20.12.2017 15:23 | Intrusion Prevention | 20.12.2017 15:22 | 31.10.2017 22:16 | 31.10.2017 22:16 |
0
↧
14.0.1 MP1 available in file connect
I do not need a solution (just sharing information)
Release notes: https://support.symantec.com/en_US/article.DOC10734.html
Anyone have installation feedback?
0
↧