Endpoint Protection

I've enabled Intrusion Prevention policy however after several hours there is nothing in the logs; the Firewall policy is off. Is nothing logged on the clients unless there is an attack?

Thank you!

Thank you Brian81! I'll give this a try over the weekend

Title: 'Where are Intrusion Prevention events logged on the Symantec Endpoint Protection Client and Symantec Endpoint Protection Manager?'
Document ID: 2009081113563248
> Web URL: http://service1.symantec.com/support/ent-security.nsf/docid/2009081113563248?Open&seg=ent

Also, check this:

https://www-secure.symantec.com/connect/downloads/steps-create-custom-sep-ids-signatures

I could not cause an event using the Symantec instructions. How do I know this is working?

Try a ping of death from a machine with NTP installed

ping -l 65000 PC name or IP address

Hi Brian81, I should get back here more often. Thanks for the info! I tried ping and got an instant alert from SEP but nothing in the logs.

OK, ping-of-death worked and was stopped but nothing logged in NTP logs. Is this normal?