Endpoint Protection Manager incorrectly shows all IPS signatures as Block/Log
Article ID: 186062
When trying to create an IPS exclusion in the Symantec Endpoint Protection Manager (SEPM) it shows all signatures as being set to Block/Log. Clients, however, act differently for some detections, such as those of the Audit type.
This issue affects SEPM builds version 14.2 MP1 - 14.3 MP1.
The SEPM does not correctly display the default actions for the IPS signatures and instead shows all of them as Block/Log
This issue is resolved in Symantec Endpoint Protection 14.3 RU1. Upgrade your Symantec Endpoint Protection Manager to this version or higher to resolve this issue.