About the SONAR definitions release dated September 5, 2012, revision 11

Article:TECH196189  |  Created: 2012-09-05  |  Updated: 2012-09-12  |  Article URL http://www.symantec.com/docs/TECH196189
Article Type
Technical Solution


Issue



This document contains information regarding the throttled release of SONAR definitions dated September 5, 2012, revision 11.


Solution




What is happening

Symantec will release the SONAR definition engine dated 09/05/2012, r. 11 as a throttled update, beginning September 13, 2012 at 6:00 AM PDT and ending September 20, 2012. During the throttled update period, client computers that run LiveUpdate directly to the Symantec servers may receive content dated either 08/23/2012 r. 13 or 09/05/2012, r. 11. Symantec Endpoint Protection 12.1.2 Beta clients and managers will receive definitions dated 08/31/2012 r. 11, with the same content as the 09/05/2012 r. 11 definitions. On September 20, 2012, at 6:00 AM PDT, Symantec will release a revision with the same content but a newer date to all update methods, including LiveUpdate, LiveUpdate Administrator, and Endpoint Protection Managers, so that all clients and managers will have the same content.

Because this update will be received only by certain clients and not by managers, the following conditions will occur. These conditions do not indicate a problem, and will cease after the September 20 update:

  • Behavior-Based Protection definitions on Symantec Endpoint Protection Managers will have a date that is older than the date given at http://www.symantec.com/security_response/definitions.jsp.
  • Behavior-Based Protection definitions on Symantec Endpoint Protection Managers may have a date that is older than some clients, if the clients update from Symantec LiveUpdate servers.
  • Behavior-Based Protection definitions on some clients may have a date different from other clients, if the clients update from Symantec LiveUpdate servers.

 

How to control the version on your network

During the throttled update period, only clients that use LiveUpdate to update from symantec.symantecliveupdate.com can receive the engine dated 09/05/2012, r. 11. Clients that use any other method to update definitions will not receive this version.

To prevent managed or lightly managed clients from receiving this version, use a policy to restrict the SONAR definition version. There is not a way to prevent unmanaged clients that connect to Symantec servers with LiveUpdate from receiving the version.

There is not a way to force clients to receive the definitions dated 09/05/2012, r. 11 before September 20.

 

How to obtain test definitions

For testing purposes, you can download test definitions with the latest content from https://fileshare.symantec.com. The test definitions are dated 08/31/2012, r. 11. To obtain the test definitions, use the following credentials:

  • User name: TestDef
  • Password: Sym@nt3c

On the Shared Folders tab, the zip file is in the SONAR_defs folder. The password to the zip file is "sonar".




Article URL http://www.symantec.com/docs/TECH196189


Terms of use for this information are found in Legal Notices