Endpoint File Detection Events from Linux client is not received on syslog server

Products

• Endpoint Detection and Response

Issue/Introduction

Symantec Endpoint Detection and Response (SEDR) fails to forward Linux EICAR detection events (4123/8027) to Syslog server, other events like 8001 are sent.
There is no issue with Windows-based events.

Following error is seen in atp-microservices.log:

2026-05-22 07:19:35,229 ERROR pool-11-thread-1 (SedrIcdTransformer.java:translateLcpEvents:1082) Unable to translate LCP event
2026-05-22 07:19:35,229 ERROR pool-11-thread-1 (SedrIcdTransformer.java:translateSecurityEvent:1035) Failed to transform LCP event to ICD schema
2026-05-22 07:19:35,229 ERROR pool-11-thread-1 (LcpEventTransformer.java:transform:215) Exception occurred while transforming LCP event to ICD schema
java.lang.IllegalArgumentException: Illegal disposition value found. Disposition should be one of good or bad

Cause

Known issue

The Symantec Endpoint Protection (SEP) Linux agent does not include reputation data (specifically the 'disposition' value) in the detection event (DMAL) for EICAR strings. The EDR Microservice's event transformer expects a valid reputation score/disposition ('good' or 'bad'). When it receives a value of `127` (indicating no reputation data available), the transformer throws an exception, causing the event transformation to fail and preventing it from being sent to the Syslog forwarder.

Resolution

Broadcom is aware of the issue and a hotfix is work in progress to fix it on EDR 4.12.
This article will be updated as soon as it is published.