Mac endpoints stop sending event to SEDR

Products

• Endpoint Detection and Response
• Endpoint Protection

Issue/Introduction

You have one or more Symantec Endpoint Protection (SEP) for Mac clients that stop sending events to the Symantec Endpoint Detection and Response (SEDR) appliance.

Environment

SEP for Mac 14.3RU5

SEDR 4.7.x

Resolution

One or more of the following workarounds can be applied:

• Reboot the Mac agent
• Remove and re-add the SEPM group from Group Inclusions on the SEDR for which that Mac agent belongs (this will attempt to re-enroll the agent)
• Remove/re-add the SEPM controller (if group inclusions is not being used)