Endpoint Protection Manager Client -Server Activity logs show event type "Client has Downloaded ATP info file", however, there is not corresponding entry in external / syslog output.
Endpoint Protection Manager with external logging enabled integrated with EDR/ATP
Symantec is aware and investigating this issue