## Calling the Evidence of Compromise command

Unlike the other commands of the CommandService API, the runClientCommandEvidenceOfCompromise web method does not have any equivalent in the Symantec Endpoint Protection Manager console. You can run this command only on Symantec Endpoint Protection client version 12.1.5 or later.

Also unlike most of the other commands of the CommandService API, the runClientCommandEvidenceOfCompromise web method takes as its argument an EvidenceOfCompromiseCommand object that specifies detailed parameters.

One required argument to EvidenceOfCompromiseCommand is InputEoCDataInXml. This argument must take the form of a byte array that specifies the contents of a valid XML file. The schema to validate against is provided with the samples in this SDK, in the following location:

`\SEPM_WebService_SDK\SampleCode\PowerShell\EoCFiles\eoc.xsd`

The EOC scan on the client can detect suspicious activity that you define in the XML file. The following items can be checked:

- Filenames and paths. Hashes are also checked.

- Registry keys

- Suspicious processes

Note the following constraints on the EOC XML:

- The file must be generated on a system that runs Windows XP or later.

- The OS language must be English. Tokenization support is provided so that runClientCommandEvidenceOfCompromise() can be run on non-English clients.

- Only standard Windows installation pathnames are supported.

- Only UTF-8 character encoding is supported.

See Client commands reference.