Health Status in the Endpoint detection and response (EDR) User Interface (UI) shows a Red Critical.
Message appears as "Device failed to connect to Symantec for content updates"
LiveUpdate was not able to retrieve virus definitions or other content.
Check to confirm that the Device where this message appears can reach the LiveUpdate servers.
If symptoms persist, open a case with Symantec Technical Support.
There was a known issue of content failure in older build wherein Proxy server is configured to connect to the Internet and Symantec Liveupdate server was accessible. A workaround was as follows:
Other option is to configure EDR appliance to connect directly to the internet