In dark network environment, definitions of Symantec Endpoint Protection Manager (SEPM) 14.3 RU2 is updated by Intelligent Updater (IU), i.e. JDB file.
In this situation, Symantec Endpoint Protection (SEP) 14.3 RU1 MP1 and below managed clients do not update SONAR definitions from SEPM.
SEPM 14.3.4615.2000 (14.3 RU2)
SEP client 14.3.3589.1100 (14.3 RU1 MP1) and below
The JDB file is divided. On SEPM 14.3 RU2, you can import <Date>-<revision>-SONAR_IU_SEP_14_3_RU2.jdb for managed 14.3 RU2 client and <Date>-<revision>-SONAR_IU_SEP.jdb for managed 14.3 RU1MP1 and below client.
ESCRT-7163