The SEDR appliance removes groups from the Group Inclusion list if the SEPM API call gets paginated

Products

• Endpoint Detection and Response

Issue/Introduction

The Symantec Endpoint Detection and Response appliance will make periodic API calls to the configured SEPMs to stay updated on which clients are in which groups. If a group name is not returned or a client changes groups, the software unenrolls the clients from ECC 2.0.

Cause

In SEPM versions prior to 14.2 RU 1, there was an issue with the Stored Procedure on the SEPM DB which could cause a pagination issue, causing groups to not get listed on the second API call.

Resolution

The Symantec Endpoint Detection and Response software will remove clients or groups from ECC 2.0 enrollment if this occurs. This will be addressed in a future software release.