Endpoint Protection

hello guys,

i was faced the issue that is popup cames at right bottom of monitor and the notification message was "PORT SCAN ATTACK LOGED"

some time with some other machine poppup came with the message that is "PORT SCAN ATTACK BLOCKED AND PORTS ARE BLOCKED FOR 600 SECONDs".

I know this is bcoz network virus issue but if in my environment if on every machine there is SEP installed then why it not clean to the n/w virus that is pinging me every time from same ip.

What exact SEPM version are you using ?

see this thread

http://www.symantec.com/connect/forums/issues-portscan-detections

Port scans are only logged, no further action is taken. It is up to you to remove the machine from the network and troubleshoot further. This is simply to alert you to a possible issue.

i am using SEPM version is 12.1.4.

i will send you attachment please check it..

Actuly this is happend with my one of customer and he want to stop that notification popup ..

and also he said that if we installed sep on every machine then why it is not clean yet if it is n/w virus..

Because it doesn't necessarily mean there is an infection. It could be a user running some sort of scan for vulbnerabilities. Again, port scanning is only logged, no other action is taken. It's up to you to troubleshoot further. You can create a firewall rule to actually block

If you want to turn that notification off do the following:

1. Go to the Clients page
2. Select the group which the PCs are in for which you want to turn off the notification
3. Select the Policies tab at the top
4. Click the + sign for Location-specific settings
5. Click Tasks and Edit next to Client User Interface Settings
6. Click Customize
7. Uncheck "Display Intrusion Prevention notifications