Using Custom Scan Notification Options

book

Article ID: 178004

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

How to use custom scan option variables from Symantec Endpoint Protection event notifications.

Resolution

Notifications can be configured using variables along with custom text in the notification fields for Auto-Protect, email protection and user-defined scans, either from the Symantec Endpoint Protection client UI or from the Symantec Endpoint Protection Manager. For centrally managed clients, the administrator may lock some of these settings from the Symantec Endpoint Protection Manager.




Notification and remediation options

Option
Description
Detection options
Display a notification message when a risk is detected

Enables or disables notifications on infected computers when Auto-Protect or a user-defined scan finds a virus or a security risk.

You can modify the type of information that you want to appear in the message. You can use the default text or you can delete text and type in your own text. If you right-click inside of the text box, you can insert variable fields into the notification text. In the message itself, the relevant text automatically replaces the variable fields.

Message variables displays the default message variables and the variables that you can add.

Remediation Options
The client might need to terminate a process or stop a service to remove or repair a risk.

The following options are available:

  • Terminate processes automatically

    If you enable this option, the client terminates processes automatically. If you disable this option, Symantec Endpoint Protection prompts you before it takes action on a process.

  • Stop services automatically

    If you enable this option, the client stops services automatically. If you disable this option, the client prompts you before it takes action on a service.




    Note: You are always notified when a restart is required. You can then save data and close open applications or opt out of the restart.



Note that message variables must be entered exactly as they appear in the table below and be contained within brackets.
For example with a notification by AutoProtect, the default alert notification variable "LoggedBy" would display Auto-Protect. The entry in the notification reads "Scan type: [LoggedBy] Scan" and will display "Scan type: Auto-Protect Scan" if a detection is made by AutoProtect, or if a threat is found during a scheduled scan it will show "Scan type: Scheduled Scan". The wording before an after the variable can be what ever the user/administrator chooses.


Message variables

Field
Description
LoggedBy The type of scan that detected the virus or security risk.
Event The type of event, such as "Risk Found."
SecurityRiskName The name of the virus or security risk that was found.
PathAndFilename The complete path and name of the file that the virus or the security risk has infected.
Location The drive on the computer on which the virus or security risk was located.
Computer The name of the computer on which the virus or security risk was found.
User The name of the user who was logged on when the virus or security risk occurred.
ActionTaken The action that was taken in response to detecting the virus or security risk. This action can be either the first action or second action that was configured.
DateFound The date on which the virus or security risk was found.
Status The state of the file: Infected, Not Infected, or Deleted.
Filename The name of the file that the virus or the security risk has infected.
StorageName The affected area of the application, such as File System Auto-Protect or Lotus Notes Auto-Protect.
ActionDescription A full description of the actions that were taken in response to detecting the virus or security risk.