## About Symantec Endpoint Protection

This topic is intended for developers of remote monitoring and management solutions who are not familiar with Symantec Endpoint Protection. It provides a very basic summary of the following aspects of the product:

- Client functionality

- Client-server communication

- Server functionality

The Symantec Endpoint Protection client provides the following protection technologies. For more detailed information, see the Symantec Endpoint Protection documentation.

We recommend that you monitor other aspects of client behavior in addition to these technologies. You can monitor whether the Symantec Endpoint Protection client is installed, whether the client is checking in with the management server, or whether the client is managed by the management server.

Only Symantec Endpoint Protection version 12.1.5 or later (client and management server) supports all the monitoring features described in this documentation.

See Monitoring client state and activity.

Table: Client protection technologies

Type of protection | Protection component and how it works | How component is managed | How to monitor
--- | --- | --- | ---
Virus and Spyware Protection Protects against viruses, malware, and spyware | Scheduled and on-demand scans These scans run on all system files unless otherwise specified. Auto-Protect These scans provide real-time scanning of files, folders, and resources as they are accessed on the client computer. Download Insight Blocks suspicious downloads from the Internet Virus and Spyware components all rely on lists of known threats. | At least one default scheduled scan always runs, and cannot be disabled. Additional scheduled scans can be added by the administrator or by the client user if the administrator allows it. Auto-Protect can be disabled by the administrator or by the client user if the administrator allows it. If Auto-Protect is disabled, Download Insight is also disabled. Download Insight can be disabled separately from Auto-Protect. You can run commands on the client to enable or disable some protection technologies, or to remediate infected or at risk states. See Running commands on clients. | You can monitor the Infected OpState registry key for infection state. You can monitor the AVRunningStatus OpState registry key for whether these technologies are enabled. If Download Insight is disabled but Auto-Protect is enabled, the registry key value does not change. For detailed information about threats that these technologies detect, you can also review the event log for eventID 51. This event also logs threats that are detected by SONAR. See Client events.
Proactive Threat Protection Provides zero-day protection against unknown threats | SONAR SONAR relies on heuristic analysis of running processes on the client. It provides behavioral analysis to predict risks, unlike the virus protection technologies that catch known threats. | SONAR can be disabled by the administrator or by the client user if the administrator allows it. | You can review the event log for eventIDs 34053 (SONAR disabled) and 34054 (SONAR enabled). Because SONAR is predictive, however, monitoring these events may not be as useful as monitoring Virus and Spyware Protection.
Network Threat Protection Protects against Web and network threats | Firewall Network Intrusion Prevention Browser Intrusion Prevention | All of these components can be disabled separately by the administrator or by the client user if the administrator allows it. Only the firewall writes to the registry, however. See Running commands on clients. | You can monitor the FWRunningStatus OpState registry key for whether these technologies are enabled. Typically if an administrator or a client user disables this type of protection, they disable all of Network Threat Protection, not just a single component (Firewall or Intrusion Prevention). Monitoring only the FWRunningStatus registry key is therefore sufficient.
Network Access Control Monitors and enforces compliance with security settings | N/A |  | You can monitor only the Symantec Network Access Control service on the client and the state of Symantec Network Access Control licenses on the management server.
LiveUpdate Provides regular updates to the product software and to content - definitions, signatures, lists, reputation data, and more. | LiveUpdate
Note: | LiveUpdate can be configured to provide updates from a number of different sources. See Content revision state events on the management server.
|  | You can calculate a threshold date for out of date content and compare this date to the date in the LatestVirusDefsDate registry key. You can monitor Content events on the client and the server.

Client-server communication is established by means of a sylink.xml file on the client. This file includes the IP address of the management server that the client reports to, and the domain name if applicable. It also includes the certificates that the client needs for secure communication with the server.

The Symantec Endpoint Protection management server provides a full range of reporting, policy management, client management, and network management functions. Most of these functions offer a level of detail that is best monitored directly in the Symantec Endpoint Protection management console. Some basic functionality can be monitored remotely, however.

See Monitoring the management server.

See Managing Symantec Endpoint Protection Manager with web services.