Some events from the Symantec Endpoint Protection Manager (SEPM) DB do not show in Endpoint Detection and Response (EDR).
SEDR with Endpoint Communication Channel (ECC) enabled and Group Inclusions configured
When group inclusions are enabled, SEDR only collects events from the SEPM DB for clients that belong to the groups in the inclusions list. This is expected behavior.
To collect SEPM DB events for additional clients either: