Endpoint Protection

 View Only

  • 1.  Symantec Quarantine Agent

    Posted Feb 18, 2014 09:10 PM

    Hi guys,

    I got a Symantec Quarantine, and I this got notification. What is this mean?

     
    		major
    10.1.**.**[***-see-***] NT-Services Robot: ***-see-*** Probe: ntservices
    Symant - Max restarts of service reached
    Time: 11/29/13 13:36:02, Arrival Time: 11/29/13 13:39:23, Assigned To: , Count: 22502

     



  • 2.  RE: Symantec Quarantine Agent

    Posted Feb 18, 2014 09:13 PM

    What version of SEP is this?

    Is that redacted? What was the OS this occurred on?



  • 3.  RE: Symantec Quarantine Agent

    Posted Feb 18, 2014 09:20 PM

    SEP version 11.0.6003

    I got an email alert with this notification almost everyday. 

    On Windows Server 2003 SE SP2

     

    Symantec Central Quarantine
     
    Symantec Corporation
     
    Version: 3.6.7180


  • 4.  RE: Symantec Quarantine Agent

    Posted Feb 18, 2014 09:23 PM

    Oh you're running the quarantine server?

    If you go to this client, what does it show in the security or risk log?



  • 5.  RE: Symantec Quarantine Agent

    Posted Feb 18, 2014 09:33 PM

    yeap

    meaning I check on the SEP agent on this quarantine server?



  • 6.  RE: Symantec Quarantine Agent

    Posted Feb 18, 2014 09:36 PM

    Is the alert coming from the SEP agent on the quarantine server itself or from another client in your network?

    I just want to see what the risk log shows in the client that had this quarantined.



  • 7.  RE: Symantec Quarantine Agent

    Posted Feb 18, 2014 10:10 PM

    what i know the alert is coming from that server. because the IP address in the alert is Symantec Quarantine server IP address.

    When i go to the SEP agent in the Quarantine server. i didnt see any log for Risk and Security. it all empty



  • 8.  RE: Symantec Quarantine Agent

    Posted Feb 19, 2014 09:07 AM

    Do you have any notifications setup?

    http://www.symantec.com/docs/TECH95663