Endpoint Protection Manager incorrectly shows all IPS signatures as Block/Log
Article ID: 186062
When trying to create an IPS exclusion in the Symantec Endpoint Protection Manager (SEPM) it shows all signatures as being set to Block/Log. Clients, however, act differently for some detections, such as those of the Audit type.
The SEPM does not correctly display the default actions for the IPS signatures and instead shows all of them as Block/Log
This issue affects SEPM builds version 14.2 MP1 - 14.3 MP1.
This issue is resolved in Symantec Endpoint Protection 14.3 RU1. Upgrade your Symantec Endpoint Protection Manager to this version or higher to resolve this issue.