Endpoint Protection

Team,

In one log I found “Worst Detection: (Severity 4) Other” . Could anybody explain what is this?

Thanks,

Sushanta

Can you provide a screenshot?

You can check this as a starting point:

Threat Severity Assessment

https://www.symantec.com/security_response/severityassessment.jsp

HI,

Can you explain more ..

also Share Logs screen shot ?

Hello Sushanta,

You have provided limited information.

Could please let us know, what log was it?

Could you provide us a screenshot or probably the logs you see this in?

Secondly, I would suggest you to check these Articles:

Interpreting the log files for Symantec AntiVirus Corporate Edition and Symantec Endpoint Protection http://www.symantec.com/docs/TECH100099

What Does "Risk was partially removed" Mean? http://www.symantec.com/docs/TECH94475

Best Practices for responding to "Left Alone" in the virus or threat history log

http://www.symantec.com/docs/TECH101661

Explanation of Action field values in Symantec Endpoint Protection 11 and Symantec AntiVirus 10.1 http://www.symantec.com/docs/TECH102052

There is a Worst Detection column in the client status log (Monitor > Logs > Computer Status, detailed view or exported csv file). My guess is that's just "historical" stuff. It's not indicating a virus outbreak. In this case, there should be a red rhombus in the corresponding client status log line.

Possibly it's conforming to the WORSTINFECTION_IDX column in the SEM_AGENT table. See the SEP schema reference guide, page 162:

http://www.symantec.com/docs/DOC4324

Hi,

here are the logs ...which i got ...hope it helps!

what to know about the coloum in bold letters...WORST DETECTION!

HI,

WORST DETECTION! Coloum not available.

Hi..

please find the attached logs

Attachment(s)

logs_0.xlsx   10 KB 1 version

Hello,

This is a Host intergrity OR Enforcer Log.

Here Host Intirity is passed.

Host Integrity check passed   Requirement: "SEP AV Check (No remediation)" passed   Requirement: "rasauto32 Check" passed   Requirement: "Nwsapagent32 Check" passed 

and

Worst Detection - (Severity 4) Other

It indicates that since the Host integrity is passed, its severity is lowest.

Enforcer Activity Log

Available information includes items such as event time, event type, enforcer name, enforcer type, site, severity, and description.

Event type

1. All
2. Management events
3. Enforcer events
4. Enable events
5. Policy events

Reference: http://www.symantec.com/docs/TECH179005

First time i see this type of log here.... interesting

Has yet to appear in our SNAC log...

Irrespective of what Mithun says below, that column always seemed to report what is the 'worst infection' detected by SEP during the life time of the workstation.

The client might be clean now, but sometime before it did have an infection.