How to set up notifications in the Symantec Endpoint Protection Manager.
Notifications are messages about security events that have taken place in an Endpoint Protection environment.
Notifications can be configured to alert both clients and network administrators using the following methods:
See “Setting up administrator notifications” in the Administration_Guide.PDF
Viewing and filtering administrator notification information
You can view the information from the notifications log in the same way that you view the
information that is contained in other logs. You can filter the notifications log to view
information about a single type of notification event at a time. You can filter your view
of notifications and save the filters for future use.
Using notifications
You can filter notifications in the log based on the following criteria:
To view all notifications
To filter your view of notifications
A list of the type of notifications that you selected appears. Some notification types
contain default values when you configure them.
Threshold guidelines for administrator notifications
NOTE: These guidelines provide reasonable starting points depending on the size of your
environment, but they may need to be adjusted. Trial and error may be required to find
the right balance between too many and too few notifications for your environment. Set the
threshold to an initial limit, then wait for a few days. See if you receive notifications too
infrequently or if notifications inundate you or your network.
For virus, security risk, and firewall event detection, suppose that you have fewer than 100 computers
in a network. A reasonable starting point in this network is to configure a notification when two risk events
are detected within one minute. If you have 100 to 1000 computers, detecting five risk events within one
minute may be a more useful starting point.
Creating administrator notifications
You can create and configure notifications to be triggered when certain security-related
events occur.You can configure the software to take the following notification actions:
The default damper period for notifications is Auto (automatic). If a notification is triggered
and the trigger condition continues to exist, the notification action that you configured is not
performed again for 60 minutes. For example, suppose you set a notification so that you are
emailed when a virus infects five computers within one hour. If a virus continues to infect your
computers at or above this rate, Symantec Endpoint Protection emails you every hour. The
emails continue until the rate slows to fewer than five computers per hour.
You can configure the software to notify you when a number of different types of
events occur.
Using the Notification Conditions settings, you can configure a client security alert by
occurrences on any computer, a single computer, or on distinct computers. You can also
configure these options for a risk outbreak.
To create an administrative notification:
Sending mail as a result of a notification.
If you select Send email to as the action to take, the email notification depends on the mail
server's user name option. The user name that is configured for the mail server from the Server
Properties dialog must be a fully qualified domain name (FQDN) in the form user@domain.
If this field is left blank, the notifications are sent from SYSTEM@computername. If the
reporting server has a name that uses Double Byte Character Set (DBCS) characters, you
must specify the user name field with an email account name of the form user@domain.
To check this setting, follow the instructions Below.
NOTE: The Symantec Endpoint Protection Manager cannot send email notifications to a SMTP
server configured to require Secure Password Authentication. You will need to configure SEPM
to use another mail server that does not require SPA or disable the requirement of SPA from
your current email server.
To test whether the server requires Secure Password Authentication:
Configure another email client program, such as Outlook or Outlook Express to send POP3/SMTP
Email using the same SMTP Server. If you are only able to send Email through that SMTP Server
when the option "Log on using Secure Password Authentication" (or similar) is checked this indicates
that SPA is required.
Running a batch or executable file as the result of a notification.
If you select Run the batch or executable file as the action to take, type in
the name of the file. Path names are not allowed. The batch file or executable
file to run must be located in the following directory:
drive:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin
For this process to function properly, it is required to allow the
"Symantec Endpoint Protection Manager" (SEPM) service to interact with desktop.
To allow the SEPM service to interact with the desktop:
Note: For SEPM 12.1 RU5 or later, you have to enable "Allow service to interact with desktop" for the "Symantec Endpoint Protection Launcher" service instead of the "Symantec Endpoint Protection Manager" service.
Network Threat Protection Email Notifications
You may want to create a Network Threat Protection notification that is triggered when a traffic
event matches the criteria that are set for a firewall rule.
To create this type of notification, you must perform the following tasks:
Note: To send notifications by email, you must also configure a mail server. To configure a mail
server, click the Admin > Servers page, select a server, click Edit Server Properties, and then
click the Mail Server tab.
See “Configuring notifications for Network Threat Protection” below, or on page 483 of the
Administration_Guide.PDF
For a description of each configurable option, you can click Tell me more on the
Symantec Endpoint Protection Manager Console.Tell me more displays context-sensitive Help .
Note: You can filter your view of the Notification Conditions you have created by using the Show
notification types list box. To be sure that the new notifications that you create are displayed, make
sure that All is selected in this list box.
To Create a Network Threat Protection administrative notification:
The Send Email Alert option in the Logging column of the Firewall Policy Rules list is now operational.
When this notification is triggered, email is sent.
See “Configuring email messages for traffic events” on page 485 of the Administration_Guide.PDF.
For a description of each configurable option, you can click Tell me more on the
Symantec Endpoint Protection Manager Console. Tell me more displays the context-sensitive Help.
Note: You can filter your view of the Notification Conditions you have created by using the
Show notification types list box. To be sure that the new notifications that you create are
displayed, make sure that All is selected in this list box.
Network Threat Protection notifications:
By default, notifications appear on client computers when the client detects various Network
Threat Protection events. You can configure some of these notifications. Enabled notifications
display a standard message to which you can add customized text.
To configure firewall notifications:
To configure intrusion prevention notifications:
Configuring email messages for traffic events:
You can configure the Symantec Endpoint Protection Manager to send an email message to
you each time the firewall detects a rule violation, attack, or event. For example, you may want
to know when a client blocks the traffic that comes from a particular IP address.To configure
email messages for traffic events.
To configure a security alert. See “Creating administrator notifications” in the Administration_Guide.PDF on page 211.
To configure a mail server. See “Establishing communication between Symantec Endpoint Protection Manager and email servers” in the Administration_Guide.PDF on page 259.
About editing existing notifications
If you edit the settings of an existing notification, the previous entries that it generated
display messages in the notifications log based on your new settings. If you want to
retain your past notification messages in the notifications log view, do not edit the
settings of an existing notification. Instead, create a new notification with a new name.
Then, disable the existing notification by unchecking the actions that were configured
under What should happen when this notification is triggered.
References
See “Managing notifications” in the Administration_Guide.PDF p.647-650
Symantec™ Endpoint Protection 14.3 RU9 Installation and Administration Guide