It uses both the Host name & the IP address.

SEPM uses both IP and  host name to report data from the database where the inforamtion is stored once the client is installed and registered. It does not uses aby cookies

It uses some thing called unmanged detector to find unmanged client .

Unmanaged Detector listens for gratuitous ARP traffic and collects Internet Protocol (IP) and Machine Address (MAC) data from traffic passing it on the local network. This data is then forwarded to the Unmanaged Detector’s SEPM which compares the IP address and MAC address of detected systems against its known list of managed endpoint clients and reports on the unmanaged endpoint clients.

An unmanaged detector is configured by right-clicking a managed SEP client in the Clients page of the SEPM console, and selecting "Make unmanaged detector".
 

http://service1.symantec.com/SUPPORT/ent-security....

Hello,

When the PC registrars to the SEPM, the SEPM creates a "unique ID" based on IP addnress, NIC, and  maybe hostname to generate this identifier.

This is he "key" to this host in the database, not the IP name or hostname....though those fields are indexed and searchable.

You can see the identifier if you right click on the client in the SEPM, and choose Edit Properties.   Unique ID is listed 3rd from the bottom on the first tab.  

Doug