Partner Management for SEP Cloud

December 14, 2017, 1:58 pm

≫ Next: Script to change Incident Action from New to Reviewed

≪ Previous: Scheduled report including IP, Host Name, and Definitions date

I need a solution

Hi Team,

We are partners with Symatec and we have access to https://manage.symanteccloud.com which allows us to manage customers endpoints from centralized console.

We are able to add or import new or existing customers.

Since Symantec moved to a new type of endpoint protection we are not able to add customers anymore. I see there are option on customer portal to share some information with partners but on our side I dont see any options to add them.

Shall we wait for symantec to release update for partner management portal or am I missing something ?

↧

Script to change Incident Action from New to Reviewed

December 14, 2017, 2:09 pm

≫ Next: ProxySG | Intercept Proxy Services not working

≪ Previous: Partner Management for SEP Cloud

I need a solution

I am working with DLP version 14.5.

A report has been created where I have essentially "white-listed" known FTP sender / recipient IP addresses. While I still want these incidents to be tracked for reporting purposes, I am trying to write a PS script that will use the report, select all the incidents, and set the status to "Reviewed - No Action Required"

Is this possible? If so how would I go about doing it?

Thanks,

London

↧

ProxySG | Intercept Proxy Services not working

December 14, 2017, 8:18 pm

≫ Next: http/2 support and TLS 1.3 support

≪ Previous: Script to change Incident Action from New to Reviewed

I need a solution

Dear All,

I have issues about Proxy Service not working on ProxySG S400-20.

My customer have changed configuration about Proxy service Explicit HTTP from Intercept to bypass for test something.

and after test completed they change config back to same before from bypass to Intercept.

after next day they found some client still cannot access to internet have error about proxy service please see picture as below.

I have seen this error before if client config Explicit HTTP and proxy service config to bypass will see error same above.

but my customer have config intercept explicit http port 80 and 8080 already please see picture as below.

some client still found error when access to internet but some client after refresh to recall website again can access.

but this issue we found many client in company.

i upload sysinfo of this appliance please see from attach file.

If have some information to recommend please help or have workaround please share.

Thank you for your help.

sysinfo_proxy2.txt

↧

http/2 support and TLS 1.3 support

December 15, 2017, 1:44 am

≫ Next: Remote site is not connecting to management server

≪ Previous: ProxySG | Intercept Proxy Services not working

I need a solution

Hi all,

when will SGOS support http/2 and TLS 1.3?

The latest information I have is that http/2 support will come in SGOS 6.7 "late CY2017". Well, 2017 is almost over and the next SGOS release 6.7.4 is scheduled for "early next year". But will it include http/2 support?

For TLS 1.3: In what version will SGOS implement the current draft?

(Yes, I know, TLS 1.3 is not yet finally released and current SGOS versions have TLS downgrade support).

Best regards, Matthias

↧

Remote site is not connecting to management server

December 15, 2017, 2:18 am

≫ Next: BCAAA and UA for Windows 10

≪ Previous: http/2 support and TLS 1.3 support

I need a solution

Hi,

I have recently installed one remote site(Coimbatore).When i am replicationg from remote site it is showing failed to connect.

Please assist..

Symantec.png

↧

BCAAA and UA for Windows 10

December 15, 2017, 5:21 am

≫ Next: Upate agent via commandline

≪ Previous: Remote site is not connecting to management server

I need a solution

Hi!

I woulld like to know, which would be the recommended versions of BCAAA and Unified Agent for W10 1709 (Fall Creators Update)? (ProxySG)

Thank you so much!

Best regards!

↧

Upate agent via commandline

December 15, 2017, 6:35 am

≫ Next: How to build pgp recovery disks fro windows 7

≪ Previous: BCAAA and UA for Windows 10

I need a solution

Hello everyone,

I'm trying to force udpates via commandline when the SEP Agent is not current. is there a command that I can run via terminal so I can script to do updates when the Agent is not current?

All the best

Ken

↧

How to build pgp recovery disks fro windows 7

December 15, 2017, 6:38 am

≫ Next: SEP API

≪ Previous: Upate agent via commandline

I need a solution

I need to decrypt (PGP 10.3.2) a windows 7 laptop. I have the PGP pass phrase but have not access to the windows 7 system (admin password lost). I therefore have to first decrypt the disk. I think i need to create a bootable recovery disk. Looking at https://support.symantec.com/en_US/article.TECH214... i see 14 differents .iso files (from Symantec Encryption Desktop for Windows 10.3.2 Recovery Image to Symantec Encryption Desktop for Windows 10.3.2 MP13 Recovery Image). WHich one do i need to burn on my cd ? All 14 files on 14 different cds ?

Thank you fro helping

↧

SEP API

December 15, 2017, 6:49 am

≫ Next: SEPM Web console Copy/Paste issue

≪ Previous: How to build pgp recovery disks fro windows 7

I need a solution

Hello,

Is it possible to use the API to download the newest client?

thanks in advance,

Ken

1513369983

↧

SEPM Web console Copy/Paste issue

December 15, 2017, 9:33 am

≫ Next: Error When accessing The ProxySG Management Console

≪ Previous: SEP API

I need a solution

I've been getting reports from users that use our SEPM web console stating that the have sparatic issues with fields being locked and not allowing them to copy the contents. Has anyone experienced this and can point me in the right direction to resolve this issue? I know the obvious work around would be to use the desktop client however I would like to see about an actual resolution for those users who prefer the web client. Any advice would be appreciated. Thanks.

↧

Error When accessing The ProxySG Management Console

December 15, 2017, 11:44 am

≫ Next: ProxySG | Please help to see access logging

≪ Previous: SEPM Web console Copy/Paste issue

I need a solution

Hi,

I Can't access the Management Console of ProxySG even whene recommanded parameters are configured,

I Had this Error whene I try access the Console : RuntimeException : java.lang.ExceptionInitializerError.

I get this error in IE and in Mozilla Firefox /

The error in the attachement,

Best regards,

Saad

Capture.PNG

↧

ProxySG | Please help to see access logging

December 16, 2017, 2:52 am

≫ Next: SMSMSE Admin Guide

≪ Previous: Error When accessing The ProxySG Management Console

I need a solution

Hi All,

Please help to see access logging why have authentication fail so much and have error http 407.

Client authentication via IWA Realm and computer is join domain.

but client normal access to internet but first time access website it so slowly. you can see from attach file.

in attach files have access logging and CPL.

↧

SMSMSE Admin Guide

December 16, 2017, 9:18 pm

≫ Next: files black list

≪ Previous: ProxySG | Please help to see access logging

I do not need a solution (just sharing information)

Hi ,

I am going to install SMSMSE first time in a 5 years :)

Cant find the latest version Admin guide

Is it possible for someone to give me a direct link?

and if there are some pre requirements that i should be aware of i will be happy to know about

Thanks :)

↧

files black list

December 16, 2017, 11:50 pm

≫ Next: SEP Agent Issue

≪ Previous: SMSMSE Admin Guide

I need a solution

i have MD5 hashes for 100 (hashes only) file and i need to blacklist them in SEP 14

please share how to acheive this

↧

SEP Agent Issue

December 17, 2017, 3:37 am

≫ Next: Left Alone risk

≪ Previous: files black list

I need a solution

Dear all, I am having the below issues on SEP agents. Your kind support is appreciated in resolving this. Please feel free to ask me any additional queries.

1) I have many servers that are running SEP agent version 12.1.2 and 12.1.5. They are appearing as out of date. When I view the details I see that mostly only the " Download Protection Content Update" is out of date. These Server machines does not have internet access and they download the definations only from the SEPM. SEPM is running 14 MP1.

These problematic Server OS machiens doesn't have Sonar and Firewall installed on it. Only the AV and IPS component is installed on these servers.

2) I have many servers 70+ which are appearing as disabled on the SEPM dashboard. When I checked the details I find out that the Temper Protection is malfunctioning. I went into the group settings where these servers reside and under the temper protection locked the paddle lock which was previously not locked. Doing this would resolve the component malfucioning issue? if yes then how much time does it take in the report to show that temper protection is no longer malfuctioning after doing the above change?

Your comments and feedback is appreciated. Thanks

↧

Left Alone risk

December 17, 2017, 6:03 am

≫ Next: Virus affected in workstation.

≪ Previous: SEP Agent Issue

I need a solution

Hi All,

I have received the single risk(Left alone) notification from a particular server. I have took the sample file and submitted to symantec to check the file legimacy and got the result that submitted was not malicious. Then I have submitted in false positive symantec portal.

Team have replied back to me saying that the detection(s) for the following file(s) will be removed from our products.

But still I am receiving the file as a single risk.

Kindly let me know how to troubleshoot further on this. I know clearly that the file was legitimate.

Regards,

S.R.V

↧

Virus affected in workstation.

December 17, 2017, 8:15 am

≫ Next: IPS Signatures not updating

≪ Previous: Left Alone risk

I need a solution

Hi All,

Recently one of the workstion is being affected by the virus. I am not sure how to investigate the rootcause of the virus.

I have took the sample of the file and put in a virus total and found that the reputation of that file is very bad.

Immediately I have informed the concern team to remove the affected machine from the network and ask them to reimage.

Since it was workstation I have done this part as a soluction.

But if it is server affected by the virus or worm. How to find the root cause and handle the situation.

Kindly suggest.

Regards,

SRV

↧

IPS Signatures not updating

December 17, 2017, 11:07 am

≫ Next: Device control, monitor not block

≪ Previous: Virus affected in workstation.

I need a solution

I have updated several of my desktop clients to 14 RU1 (Build 3752) as a pilot to make sure that there are no issues before rolling it out to the entire environment. I have noticed though that the IPS signatures on these clients don't seem to update though. Oddly the console took almost a month before it listed any of these clients as being out of date. I noticed that it is recommended to update the management server first. Is this an issue that would be resolved by updating the management server(It is still on build 1904) or am I just noticing a coincidence?

↧