The Symantec Endpoint Protection (SEP) client Client Intrusion Detection System (CIDS) detects outbound network traffic from a computer in the Excluded Hosts list in the Intrusion Prevention System (IPS) policy. The IPS logs show that the direction of the event as Outgoing, the Local Host is the local computer, and Remote Host is another computer in the network.
The CIDS engine evaluates network traffic against known security threats and blocks traffic that matches those threats. Excluded Hosts allow administrators to define hosts whose traffic should not trigger detections. This is useful for preventing detections from traffic which may appear malicious but is necessary to normal business operations. For example, you can exclude traffic generated from a network vulnerability scanner to prevent simulated attacks from being blocked by the SEP client.
Excluded hosts exceptions apply to the remote host IP address on any inbound or outbound traffic to the computer. IPS will not detect outbound traffic to destination computers in the Excluded Hosts list. IPS will not detect inbound traffic from source computers in the excluded hosts list.
Ensure both computers have an IPS policy with the remote computer's IP address in the Excluded Hosts list. For example: