SEP Mac devices don't always log Bluetooth block events

Products

• Endpoint Security
• Endpoint Security Complete
• Endpoint Protection

Issue/Introduction

Where Symantec Endpoint Security Device Control blocks a Mac RU9 Client, you may not always see a block event listed in the cloud console. 

Environment

• Symantec Endpoint Security
• Bluetooth Device Control
• Symantec Endpoint Protection RU9 for Mac Client

Cause

There are two causes:

• Events are limited to avoid log spam and minimized by the product intentionally.
• Apple has limitations on its own API that reports these events.

Resolution

Log minimizing is an intentional feature to improve the viewing of the volume of Device Control events on the Investigate page. Apple may change the API in later OS releases, this applies to all MacOS releases supported by SEP 14.3 RU9 and may vary in consistency as changes are made to avoid noisy Bluetooth devices.