Advanced Threat Protection

 View Only

  • 1.  How Symantec ATP scans for threats

    Posted Mar 14, 2016 08:24 PM

    Hi,

     

    Is there anyone here how Symantec ATP scan for threats in Endpoints and in Network?

     

    Thank you.

     

    Regards,

    JM



  • 2.  RE: How Symantec ATP scans for threats

    Posted Jun 14, 2016 07:14 AM

    please share if you find how to scan with Symantec ATP



  • 3.  RE: How Symantec ATP scans for threats
    Best Answer

    Posted Aug 10, 2016 04:25 PM

    The ATP platform uses mutliple control points:

    • network - processes traffic through various filters and detection engines to detect malicious activity
    • endpoint - leverages SEP/SEPM
    • email - leverages Symantec Email Security.cloud to uncover attacks
    • Vantage - signature-based detection that finds threats in the network stream
    • Insight - Reputation database
    • Mobile Insight - Used for Android applications as well as detects privacy and performance issues in mobile apps
    • Antivirus - signature-based
    • Cynic - virtual sandbox
    • Blacklists/whitelists - pulled down from Symantec. Updated regularly. Can also create custom ones
    • Synapse - Correlates ATP network, email, and endpoint data
    • SONAR - Used for process behavior