Endpoint Protection

Hi,

I am trying to figure out the meaning of "Action Type: 55" in the following log. Is there an action types table somewhere?

2016-03-28T09:15:35-07:00 ABC-001 SymantecServer: ABC09,Blocked,'C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.6318.6100.105\Bin\ccSvcHst.exe',,Begin: 2016-03-28 08:59:26,End: 2016-03-28 08:59:26,Rule: ,1888,C:\PROGRAM FILES (X86)\KINGSOFT\KSDEF\KSDEFSERVER.EXE,0,,C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.6318.6100.105\Bin\ccSvcHst.exe,User: SYSTEM,Domain: ,Action Type: 55,File size (bytes): ,Device ID: 

Thanks,

There is. It should be in the schema:

Symantec Endpoint Protection 12.1.6 database schema

Is this a tamper protection alert?

Brian,

Thank you for the referrence and the quick reply. 

I have seen similar documents but cannot find a table that lists the action types. Specifically, I cannot find the meaning of action type 55. For example, this is what I find in the resource you referenced:

ACTION_TYPE

smallint

2

√

null

Violation type that triggered the SymProtect event. Valid values are 0 to 58 inclusive.

As for you question, I am not sure of the exact model that generated this alert. We got it from a customer with very limited information.

It's a tamper protection alert, which was blocked.

I guess what do you need to know about the type 55? There are only a few options with TP

Along with "Action Type: 55", I often see action types 3, 5, 14, 45, 46, 56, 60. And I'm sure there are other action types than the ones I mentioned. It would be really helpful if there a listof all possible action types and what each type means.

Thanks.