Endpoint Protection

Hey,

We are looking to protect our network against possible APT threats and one of the best solutions we could find is RBS/Insight. In order to acheive maximum effectivness, we would prefer that the product will alert the end-user in our organization when a suspicious file is detected on his PC, based on file reputation.

We would like to know if Insight already includes this feature (Reputation based alerts). If not, how long before it becomes available for users?

Thanks

Check this Artical may be help...........

http://www.symantec.com/theme.jsp?themeid=star

This document covers important considerations and best-practices for deploying Symantec's Insight technology.

Hello,

Symantec Insight is a reputation-based security technology that leverages the anonymous software adoption patterns of Symantec’s hundreds of millions of users to automatically discover and classify every single software file, good or bad, on the Internet. Based on advanced data mining techniques, Insight seeks out mutating code separating out risky, low-reputation files from those that are safe.

To know more check this Whitepaper on Symantec Insight on 

https://www-secure.symantec.com/connect/downloads/insight-deployment-best-practices-whitepaper

Incase, you want to check the Symantec Download Insight, check this Video:

https://www-secure.symantec.com/connect/videos/symantec-download-insight-symantec-endpoint-protection-121

You might want to customize Download Insight settings for the following reasons:

• Increase or decrease the number of Download Insight detections.

  You can adjust the malicious file sensitivity slider to increase or decrease the number of detections. At lower sensitivity levels, Download Insight detects fewer files as malicious and more files as unproven. Fewer detections are false positive detections.

  At higher sensitivity levels, Download Insight detects more files as malicious and fewer files as unproven. More detections are false positive detections.

• Change the action for malicious or unproven file detections.

  You can change how Download Insight handles malicious or unproven files. The specified action affects not only the detection but whether or not users can interact with the detection.

  For example, you might change the action for unproven files to Ignore. Then Download Insight always allows unproven files and does not alert the user.

• Alert users about Download Insight detections.

  When notifications are enabled, the malicious file sensitivity setting affects the number of notifications that users receive. If you increase the sensitivity, you increase the number of user notifications because the total number of detections increases.

  You can turn off notifications so that users do not have a choice when Download Insight makes a detection. If you keep notifications enabled, you can set the action for unproven files to Ignore so that these detections are always allowed and users are not notified.

  Regardless of whether notifications are enabled, when Download Insight detects an unproven file and the action is Prompt, the user can allow or block the file. If the user allows the file, the file runs automatically.

  When notifications are enabled and Download Insight quarantines a file, the user can undo the quarantine action and allow the file.

Note: If users allow a quarantined file, the file does not automatically run. The user can run the file from the temporary Internet folder. Typically the folder location is drive:\\Documents and Settings\username\Local Settings\Temporary Internet Files.

Also See: Customizing Download Insight settings.

Managing Download Insight detections

Hope that helps!!

is this same to SONAR component in the new SEP client v 12.1 ?

Hello,

SONAR is part of Proactive Threat Protection on your client computers. SONAR is the abbreviation for Symantec Online Network for Advanced Response. Unlike virus signatures, SONAR examines the behavior of applications to decide whether they are malicious. 

Check this Article: http://www.symantec.com/docs/HOWTO55268

Hope that helps!!