Endpoint Protection

Hi all!

Can someone tell me what "Audit" refers to in SEP attack signatures? Specifically i am looking at ICMP redirect attacks and i see that there is a signature for this (see link), however its labelled as Audit.

http://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=20017

Does this mean that it is logged only and not blocked? or that its blocked under a heading of Audit?

Symantec updated their categories for attack sig's (see link) but it doesn't seem that Audit is covered.

http://www.symantec.com/business/support/index?page=content&id=TECH152794

any help much appreciated.

i believe this will help,

These signatures are responsible for detecting such traffic as peer-to-peer file sharing, instant messaging, and voice over IP (VOIP).

check this link

http://www.symantec.com/business/support/index?page=content&id=TECH161411

Thanks Pete, but does traffic detected as Audit get blocked?

by default is is "Allow" but you put under exception and set action as Block.

I have taken a look in the IPS excusions and cannot see it listed. Is this signature a feature of SEP 11?

I have scanned down the list of Audit signatures and can't see it listed in SEP 11. I guess its a v12 feature.

Thanks.

I can see it in SEP 12.1 RU 1.