Symantec endpoint protection 14 documentation

#SYMANTEC ENDPOINT PROTECTION 14 DOCUMENTATION FULL#

Sometime, when a hacker launches a mass attack, it may be reduced to one event by the log system, depending on the damper period. Localized strings for Unknown/ Inbound / Outbound. Localized string for Others/ TCP/ UDP/ ICMP. It is only valid on TSE_TRAFFIC_TCP and TSE_TRAFFIC_UDP. The TCP/UDP port of the remote computer (host byte-order). The host name of the remote client computer. The TCP/UDP port of the local computer (host byte order). Potentially Unwanted Software, Social Networking etc. N/A, very safe, safe, Possibly malicious etc. Host Integrity failed, Browser Protection event etc. The location used when the event occurred. For example, the ping of death DoS attack does not have an application name because it attacks the OS itself. This field may be empty if an unknown application is involved, or no application is involved.

#SYMANTEC ENDPOINT PROTECTION 14 DOCUMENTATION FULL#

The full path of the application involved. Sometimes, when a hacker launches a mass attack, it may be reduced to one event by the log system, depending on the damper period. If the end time is not detected, it is set to equal the start time. This field is an optional field because the exact end time of traffic may not be detected for example, as with UDP traffic. If Event ID = 210, Host Integrity passed (TSLOG_SEC_AV), additional information

If Event ID = 206, Intrusion Prevention System( Intrusion Detected, TSLOG_SEC_INTRUSION_DETECTED), the intrusion ID If Event ID = 209, Host Integrity failed (TSLOG_SEC_NO_AV), the reason for the failure. If appropriate Event ID is not found then Hack Type is blank. Hack Type information is dependent on Event ID. The IP address of the remote computer (IPv4). This field may be empty if the name resolution failed. The IP address of the local computer (IPv4). Usually, the first line of the description is treated as the summary. Time of event occurrence, if 'Export logs to a dump file' is enabled.Дescription of the event. 'Connected to Symantec Endpoint Protection Manager' Agent System logs contain information about agent activities. NETPORT, NATSRV, Network Intrusion Protection System, LiveUpdate Manager etc.Дescription of the event. Severity description, if 'Export logs to a dump file' is enabled. blocking the computer from opening certain application or website. Enforcer Activity logs contain information about compliance activity, i.e. 'The client has downloaded the policy successfully'Дescription of the event. 'The client has downloaded the auto-upgrade configuration file successfully'

'The management server received the client log successfully' Agent Activity Logs contain information about client-server communication activities.

5 = Add a shared policy upon domain creation.Дescription of the event.

4 = Add a shared policy upon a system upgrade.

3 = Added a shared policy upon system installation.

The Administrative logs event contain information about admin activiity such as login, logout, group creation, updating site property etc. Log severity, if 'Export logs to a dump file' is enabled.Дescription of the event. 'Database maintenance finished successfully' The system logs contain information about events such as when services start and stop. Log severity: All, Information, Warning or Error.Дescription of the event. Time stamp of the record, if 'Export logs to a dump file' is enabled. Note: Some fields may not be present in earlier versions of Symantec Endpoint Protection (SEP). ** indicates items that only appear if the property is set to ON * indicates items that were added as of 14.0.1 Fields are in the order of their appearance. The following section gives details of the CONTENT for each log type. There are total 16 different log types (including both server and client logs).

Symantec endpoint protection 14 documentation