Symantec Endpoint Protection Manager (SEPM) and Symantec Endpoint Protection (SEP) is deployed in closed network where no internet connection exist. All SEP client is dark network client.
Virus definition for dark network client in SEPM is updated by LiveUpdate administrator (LUA) or Intelligent Update (IU) but notification is not triggered even when condition is match.
SEP 14.x
SEPM uses the revision of virus definition for the standard client and SEPM does not meet the notification condition because the virus definition file for the standard client does not exist in SEPM or it is older than the definition for the dark network client than client.
Install the latest virus definition for standard client by LUA or IU.