SONAR is the abbreviation for Symantec Online Network for Advanced Response

TruScan Proactive Threat Protection has been replaced by SONAR in SEP 12.1

Symantec Endpoint Protection 12.1 SONAR - Proactive Threat Protection or Download Insight False Positive Corrections

Migration from Symantec Endpoint Protection (SEP) 11.x to SEP 12.x - TruScan and SONAR exceptions

Check this artical

https://www-secure.symantec.com/connect/articles/i...

It's symantecs new version of Proactive Threat Protection instead of downloading the defs to you machine to save space symantec now use a larger cloud based database with billions of definitions that it can refer to. Better protection for you machines.

Hi,

Hello,

SONAR is a real-time protection that detects potentially malicious applications when they run on your computers. SONAR provides "zero-day" protection because it detects threats before traditional virus and spyware detection definitions have been created to address the threats.

SONAR uses heuristics as well as reputation data to detect emerging and unknown threats. SONAR provides an additional level of protection on your client computers and complements your existing Virus and Spyware Protection, intrusion prevention, and firewall protection.

SONAR uses a heuristics system that leverages Symantec's online intelligence network with proactive local monitoring on your client computers to detect emerging threats. SONAR also detects changes or behavior on your client computers that you should monitor.

Reference: http://www.symantec.com/docs/HOWTO81392

Hope that helps!!

About SONAR

Managing SONAR

Handling and preventing SONAR false positive detections

Adjusting SONAR settings on your client computers

Monitoring SONAR detection results to check for false positives