| Web Services for Remote Management 14.0 Reference documentation for web service interfaces to support remote management of Symantec Endpoint Protection

- Home
- Packages
- Classes

# Introduction

This release of Symantec Endpoint Protection includes support for remote management of basic functions on the client and on the management server. Remote management is provided by web services. All calls to Endpoint Protection web services are authenticated using OAuth and allow access only by authorized Endpoint Protection administrators.

Web services for Remote Management offer the following:

- Reporting of license status and content status on the management server by web service calls, in addition to existing license status reporting in the Windows Event Log.
- Issuing commands to the client. These commands include Update, Update and Scan, Restart, and more.
- Managing the policies that are delivered to the client. Policies can be imported from another management site, and they can be assigned to groups or locations at another management site.

For detailed information about the commands that you can send to the client, and about policies, groups, and locations, see the Integration Guide and the product documentation.

Issuing commands and managing policies let you remediate the conditions on the client that you can monitor by leveraging the Windows Event Log and the registry.

# What's new in this build

This build includes the following new API:

- assignQuarantinePolicy, which lets you assign quarantine policies such that you can use the Quarantine command. The Quarantine command places specified Endpoint Protection clients in the network Quarantine location that is controlled by the assigned Quarantine policies.

For details, see the PolicyService API, the CommandService API, the Integration Guide, and the product documentation.

# About this documentation

This documentation provides detailed reference information for all web services that support remote management.

For general information about how to use Endpoint Protection web services in your remote management application, see the Integration Guide that accompanies this Reference Guide.

High-level descriptions of each web service interface are provided in the Reference Guide at the package level.

# Requirements

## Installation

To work with Endpoint Protection web services, you must install the Endpoint Protection management server.

This installation installs the web services.

## Authentication

All web service calls must be authenticated using the OAuth 2.0 protocol. Every call must include an OAuth access token.

For more information about using OAuth with web services, see the Integration Guide.

## Web services protocol

Symantec Endpoint Protection web services require the SOAP protocol over HTTPS.

# Restrictions, limitations and constraints on the design

Web services for remote management are available only for the management server, which runs only on Windows. No support for any other platform is provided.

# Architecture

## The flow of Symantec Endpoint Protection remote management web service requests

The web service request is initiated by the remote management tool. The request is sent over secure HTTPS to a web services Tomcat application on the Endpoint Protection management server. This application leverages the Spring server framework to handle the web service request and send the response. The WSDL generated Java classes then marshal the HTTPS requests and responses to and from WSDL generated objects. These objects can be created on the client and on the server in whatever language the third-party tool requires.

# Dependencies

## Metro Web Service Engine

Symantec Endpoint Protection Remote Management web services leverage Metro for the web service engine. Metro and Axis2 are both SOAP based, and both were considered. Metro was chosen for performance and interoperability.

The Metro web services stack is based on the reference implementations of the JAXB 2.x data-binding and JAX-WS 2.x web services standards. Metro uses WSIT technology, which in turn uses XML and the Webservices Security project (XWSS) WS-Security implementation. This implementation makes the Metro stack faster than Axis2. For a case study, see: http://www.ibm.com/developerworks/java/library/j-jws11/.

Metro is jointly tested by Sun Microsystems and Microsoft to ensure that web service clients (consumers) and web services (producers) interoperate with Windows Communication Foundation (WCF) web services applications, and vice versa. WCF is part of the Windows .NET framework 3.x and later.

Metro is also leveraged by other enterprise products developed by Symantec. Using Metro across Symantec enterprise applications provides a single standard against which third parties can write remote management solutions.

## File Transfer

The PolicyService API uses Message Transmission Optimization Mechanism (MTOM) for fast efficient transfer of binary files. MTOM support is fully interoperable with .NET clients and servers. If you work with Metro, then your MTOM solution works out of the box as an endpoint or as a client.

If your client uses the JAX-WS Reference Implementation, see http://metro.java.net/2.1.1/guide/Binary_Attachments__MTOM_.html for more information.

# Security Vulnerability Assessment

Symantec Endpoint Protection Remote Management web services open an additional Tomcat port for the web application. The web services are installed and listening for network connections on the reserved port. This is detected by SVA tools that detect open ports.

The web services use HTTPS by default and use a self-signed certificate to negotiate the exchange of symmetric keys to encrypt the data. If you require stronger security, follow the instructions that are provided in the documentation and in the Symantec knowledge base for replacing the self-signed certificate with a properly signed certificate provided by the customer.

Symantec Endpoint Protection Manager does not expose a second HTTP web service port that is unencrypted.

The web services use OAuth 2.0 for authentication. This mechanism lets remote management tools authenticate with the management server, without the tool itself being involved in the authentication process. A remote management tool should therefore not be able to intercept the username and password, as it would if the credentials were entered or stored within the tool.

Copyright
  Copyright (C) 2016 Symantec Corporation. All Rights Reserved.