Endpoint Protection

I am getting this email notification from my SEPM:

Failed to read C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\temp\threatcon.zip

I checked that folder and there is no "threatcon.zip" file in there.

I'm running 12.1 RU5 on Windows 2008 R2.

Various scheduled reports that run a dropped here. Is there anything in the folder?

Do you have any scheduled reports configured to run?

Whats the notification condition here?

I tried running all the various reports - system, enforcer, etc, but nothing shows. But I keep getting these in my email:

Server System Events

May want to engage support

1) The database used for SEPM is the default DB or MS SQL DB ? 

2) What is the schedule for DB backup on SEPM ?

3) Try to monitor if you are getting this notification when running the schedule db backup ? 

4) Could you please navigate to - 

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\logs\scm-server-0.log

In the above log file do you see any such error given below ?

2015-05-05 15:19:27.726 THREAD 29 SEVERE: Failed to read C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\temp\threatcon.zip in: com.sygate.scm.server.task.SecurityDataTask
com.sygate.scm.server.util.ServerException: Failed to read C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\temp\threatcon.zip
    at com.sygate.scm.server.task.SecurityDataTask.processThreatCon(SecurityDataTask.java:225)
    at com.sygate.scm.server.task.SecurityDataTask.execute(SecurityDataTask.java:79)

1) Do you have proxy settings configured on your SEPM Server ? 

2) Could you please check if you can download this file on your SEPM Server .
 

http://securityresponse.symantec.com/avcenter/sr2/threatcon.zip <http://securityresponse.symantec.com/avcenter/sr2/threatcon.zip> 

Once you download the file copy paste this threatcon.zip file at this location : -  C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\temp

3) access this url on your sepm server via any browser - 

http://localhost:9090/servlet/ConsoleServlet?ActionType=ConfigServer&action=StartTask&task=SecurityDataTask

For your information - 

There is a special task that runs once every 4 hours, retrieves the information from the Security Response website and updates the information in the SEPM's database. It retrieves the information from:

http://securityresponse.symantec.com/avcenter/threatcon.zip

Where do you see this threatcon on SEPM  ?