Linux Agents do not send File or Network Activity events to EDR

Products

• Endpoint Protection
• Endpoint Detection and Response

Issue/Introduction

File and Network Activity events for Linux agents are not sent to the Symantec Endpoint Detection and Response (SEDR) appliance after upgrading the Linux agents to Symantec Endpoint Protection (SEP) version 14.3 RU8.

Environment

SEP for Linux 14.3 RU8

EDR version 4.x

 

Cause

Ongoing changes to operating systems and security technologies require ongoing tuning to how Broadcom handles incoming event volumes. As a result File and Network Activity events now remain in the local event store.

Resolution

The full dump command is now available to Linux clients running SEP 14.3 RU9 or newer when EDR 4.10 and newer is in use.