Quantcast
Channel: Symantec Connect - Products
Viewing all 20656 articles
Browse latest View live

SEPM database AGENT_BEHAVIOR_LOG_1 column DESCRIPTION

$
0
0

Today threats are downloaded by execution of powershell. Some of scripts create new object System.Net.WebClient and execute method DownloadFile.
I have created Application and Device Control polisy with rule to prevent runing powershell from cmd.exe.
In lab environment I have run a threat (xls file with macro). 

SEP did block the execution of powershell and logged the powershell command. 

In SEP -> View Logs -> Client Managment -> View Logs -> Control Log. Command/script have more than 500 characters. Example: setting value of variable with some parts of System.NetWebClient, and finally joining them with Invoke-Expression.

sep client control log

In SEPM console in Monitors -> Logs -> Application and Device Control Logs: Application Control in View Logs the Description has only 256 characters :(
The central information did not match with the same information in SEP. Command is truncated.

sepm monitors aadc log

Kliknij i przeciągnij, by przenieść.
I have checked the documentation about SEPM database schema and in table AGENT_BEHAVIOR_LOG_1 column DESCRIPTION type is nvarchar(256). Can this column keep more data (future release of SEPM)?

Regards,

Tomasz


Failed to execute schedule Symantec 12.1 RU6 Download due to insufficient free space for updates.

$
0
0
I need a solution

Can anyone help me to solve this problem ?

0

SONAR : Echec de définition

$
0
0
I need a solution

Bonjour,

Suite à la mise en place de notifications, nous avons repéré des postes non à jour au niveau des définitions  SONAR.

Le message est :

"Erreur de chargement de contenu du moteur SONAR

Description d’événement :    SONAR a généré une erreur : code 0, description : échec de définition

Source de l’événement :    Symantec Endpoint Protection

Gravité de l’événement :    Erreur"

Avez-vous une idée et quelle est la méthode pour y remedier ?

Merci

0

WildCard SSL Certificate

$
0
0
I do not need a solution (just sharing information)

Hi, we are running SEP14 MP2 with clients running from different locations.

I would like to find out if it is possible to use WildCard SSL certificate on SEP.

Thanks in advanced,

0

Not Installing on Mac 10.12

$
0
0
I need a solution

Apple Mac OS X 10.12.6

Trying to install Endpoint Protection Cloud

In the Enroll This Device web page, the Management Profile downloads but does not install automatically. I can install the profile it by double-clicking the downloaded file but the Enroll This Device page just downloads the file again and never progresses to the second stage: Install Security Client.

Can I use the downloaded Security Client installer from another Mac or is there another solution?

Thanks.

0

Emails

$
0
0
I need a solution

Hi,

I have a problem with our new email-servers and cluster*.eu.messagelabs.com as remote server.

Sending emails results in: 2017-07-29 15:40:54 H=cluster5a.eu.messagelabs.com [216.82.251.230] Operation timed out

Our Server are new and the IPs are not on an blacklists. Searching on google directed me to this forum. So please can you help me to whitelist or remove our servers from any blackllst.

These IPs are used by our servers:

- 138.201.149.13

- 138.201.149.19

- 138.201.59.104

- 138.201.59.105

We are not sending spam, but I have about 70 legal mails in queue with timeouts from the messagelab-servers.

If there is an other website for this request, please tell me the link to it.

Thank you very much.

Best regards

0

ECI Telecom Secures Microsoft Exchange Online

$
0
0
with Symantec Data Loss Prevention Cloud Service for Email
Background Image on Blogs "Quilted" Page: 
Publish to Facebook: 
No
Twitter Card Style: 
summary

ECI Telecom is a global provider of Elastic Network™ solutions to cloud service providers, utilities, strategic industries, and data center operators. Our solution portfolio includes carrier-class packet-optical transport systems, SDN/NFV applications, end-to-end network management, a comprehensive cyber security solution, and expert professional services.

In 2011, soon after the initial release of Microsoft® Office 365®, we at ECI Telecom began planning to eventually transition some of our core services to the cloud, including our Exchange® Online email system. Our reasons were twofold: As a developer of cloud-enabling technologies, we are committed to growing the cloud economy, and cloud offers simpler, more efficient service delivery for a globally distributed workforce like ours. I truly believe that the whole world will move to the cloud eventually; it's only a matter of time.

There was one major obstacle, though, in our transition. We weren't willing to give up the data visibility and security we had with our on-premises deployment of Symantec™ Data Loss Prevention. We've used this technology with every release of Exchange from 2010 to 2016. It has allowed us to see deeply into our traffic—to detect and remediate data policy issues in real time, before they could become data leaks.

But in 2011, there was no cloud-based alternative that offered as much visibility and security as Data Loss Prevention running onsite. When we tested Exchange in the cloud, there were gaps where we couldn't see the traffic, understand the movement, or protect the data.

That changed when Symantec began testing Data Loss Prevention Cloud Service for Email, with a new cloud-based detection service based on its industry-leading* on-premises software. The new service can catch sensitive data employees send in email from Exchange Online or Gmail with high-accuracy content-detection technology that minimizes false positives. It automatically alerts employees to security policy violations through email notifications and can help block noncompliant messages or redirect them to an encryption service for secure delivery.

Data Loss Prevention Cloud Service for Email integrates out of the box with Symantec Email Safeguard, an effective email security service that provides antimalware, antispam, data protection, and policy-based encryption capabilities with the convenience and simplicity of a fully hosted service. ECI became one of the first beta testers and the first full production customer.

As soon as we implemented this service, it was like having our eyes fully opened. We could understand what was happening from the inside to the outside, protect our data, and prevent leaks. It was also one of the simplest implementations I've ever performed. We only had to define one connector on the Symantec side and one on the Microsoft side, and we were able to reuse all our existing policies.

Today, we protect more than 2,000 Exchange Online users with Symantec Data Loss Prevention Cloud Service for Email. It gives us the visibility we need to understand our risks and manage them effectively. If you're considering a mail service in the cloud—and you should—you should also consider a data loss prevention service like this one.

Read more about ECI Telecom’s deployment of Symantec Advanced Threat Protection here.

 

*The Forrester Wave™: Data Loss Prevention Suites, Q4 2016, www.forrester.com/report/The+Forrester+Wave+Data+Loss+Prevention+Suites+....

Hauri or Virobot Uninstaller

$
0
0
I need a solution

Guys,

I know that unistaller for Hauri is not in the SEPM 3rd party uninstaller list.

Can anyone share expertise on how to remove using scripts to uninstall.

I have requested from hauri but no responce to date.

Can anyone help please.

Thank you

0

Action after get infected

$
0
0
I need a solution

Hi,

I have a list of risk which is getting from the Risk report. All the infected file or application currently stored in Quarantine. Some of the risk does not show any useful information in Symantec Security Response. May I know what is the required action when getting the risk?

Here is the list of risk: 

SAPE.Heur.1240
SAPE.Heur.2309
SAPE.Heur.247c
SAPE.Heur.5e89
SAPE.Heur.B1A07
SAPE.Heur.BBEC7
SAPE.Heur.C532A
SAPE.Heur.D5519
SAPE.InstallRex.15f
SAPE.InstallRex.26e
SAPE.InstallRex.af
SAPE.InstallRex.d1
WS.Reputation.1 - run full system scan and submit the suspicious file
WS.SecurityRisk.1 - run full system scan and submit the suspicious file
0

W32.Ramnit Attack 4: Web attack

$
0
0
I do not need a solution (just sharing information)

Basic 

A Web based attack relating to W32.Ramnit has been blocked. Opening infected page may result in compromise of the host machine. No further action is required, but you may wish to update your virus definitions and run a full system scan as a precautionary measure.

Severity: High

Affected :- Windows Systems

Solution :-  

Run Norton Power Eraser.

Run Symantec Power Eraser.

0

Fake Flash Update Download 2: Web Attack

$
0
0
I do not need a solution (just sharing information)

Information 

This signature detects attempts to download Fake Browser extensions on the user's machine. Rogue browser extensions can pose like legitimate extensions but when installed can steal sensitive information from the infected machine.

Affected 

--> Various Browsers

--> Various Windows Platforms

Severity: High

Solutions

Run Symantec Endpoint Protection. 

0

Auto Upgrade 12.1.6 RU6 MP6 to 14 MP2 - Known Issue?

$
0
0
I need a solution

Hi,

one of our customers had a problem with the Auto Upgrade feature. At first everything worked fine, but all of a sudden it didn't work anymore, even tho the clients said that they accepted the upgrade package.

The customer was able to "solve" this issue by unchecking the "“Include virus definitions in the client installation package” option.

Is this a known issue when upgrading from 12.1.6 RU6 MP6 to 14 MP2? If so, does anyone know if this issue will be solved in 14 RU1?

Thanks in advance!

0

Exclude application activity from DLP monitoring

$
0
0
I need a solution

Hi all,

I would like to know which is the most efficient way to completly exclude an application running on Windows OS from the DLP monitoring. 

Our customers run some applications designed by them and they want all activity generated by these programs not to be inspected by the DLP agents, in order not to affect at all the performance of the application processes.

I know that you can configure new applications from "Application Monitoring", but I'm not sure that adding the application and unmarking all the monitoring channels will avoid the processing of the activity (not only from generating new incidents).

Thanl you very much in advance!

0

SEPM cant get updates from Internal Liveupdate

$
0
0
I need a solution

Dears,

I have installed LUA then downloaded and distirbuted defs also I configured site properties -> liveupdate and added the source to be my LUA but when I run liveupdate manually from the SEPM it says liveupdate failed, any advices? (if you need any logs or nothing to help me solve this I will provide it)

Thanks in Advance.

0

Can I add newer client packages to older SEPM version.

$
0
0
I need a solution

Hi, At the moment I am static on version 12.1.6 (12.1 RU6 MP5) build 7004 (12.1.7004.6500) and we will not be updating it any more as far as i am aware. We are moving to SEP14 in the next 3 to 4 months. But in the mean time I have some Wintel engineers that are using/testing Server 2016. The current client install malfuctions on these servers. Therefore can I add 12.1.6 MP8 clients to my current SEPM and still create packages with them and not break my SEPM?

Thanks

PaulC

0

Exception by Machine Name

$
0
0
I need a solution

How do I create an Exception to match on a endpoint machine name?

0

New CloudSOC course coming

$
0
0
I do not need a solution (just sharing information)

Hi,

The new CloudSOC course will be available by the end of September 2017. We will be offering this course via instructor-led training, and also online.

If you have an questions please let me know.

0

--- Article Removed ---

$
0
0
***
***
*** RSSing Note: Article removed by member request. ***
***

Announcing New Impersonation Controls and Advanced Email Security Analytics!

$
0
0
I do not need a solution (just sharing information)

We’re excited to announce New Impersonation Controls and Advanced Email Security Analytics that now include insights into both clean and malicious emails in Symantec Cloud Email Security (the Symantec solution that includes Email Security.cloud and ATP:Email). These new capabilities provide the strongest protection against Business Email Compromise and the deepest visibility into targeted email attacks. The New Impersonation Controls are available today in Email Security.cloud and the Advanced Email Security Analytics will be available in ATP:Email later this quarter. For more information on these new capabilities:

Nirav Shah
Manager, Product & GTM Strategy, Symantec

0

Unable to upgrade to Windows 10 (1703) SEE 11.1.3

$
0
0
I need a solution

As we are getting ready to start rolling out Windows 10 to our enterprise we are exploring different options. Wipe and reload, in place upgrades. Attempting to do a in place upgrade fails if the drive is encrypted (SEE 11.1.3). I followed http://www.symantec.com/docs/HOWTO125875 and used the script as instructed.

The VM I'm testing on upgrades without issues when not encrypted, so it is not software that is in our base image for Windows 7. Reviewing the logs it appears to fail at the end of the first phase trying to apply the WinRE right before the reboot and moving to phase 2. The upgrade process runs as local Admin so I wouldn't think it's a rights issue. If anybody has any suggestions where to check next before opening a ticket that would be appreciated.

0
Viewing all 20656 articles
Browse latest View live


<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>