Endpoint Protection

Which kind of notification do I use to send email when an ADC App/Device Control event has been logged?? -- in the 'Add Notification' section??

Thank you, Tom

Check this

http://service1.symantec.com/SUPPORT/ent-security.nsf/ppfdocs/2008032010523548?Open&dtype=corp&src=&seg=&om=1&om_out=prod

You can notify the user by checking the Notify User check box.

If you check the Send Email Alert box, it should do it automatically, no further setup needed.

We don't want to notify the users, we want to notify the SEP administrators.

The add notification choices are in Table 13-5 pp. 285-286 of the Administrator Guide.

They are also in the 'Notification Conditions' but it is not clear which Notification Condition to use for the ADC log entries...

I will try trial/error to see if 'Client security alert' will work...

Thank you, Tom

Oh sorry, yes it Client security alert

Check Device control events and Application control events

I create the notification condition for client security alert, fill it out, it will NOT save, why???

I click OK and nothing happens.

Mail server and email address have been tested and validated. Server group was chosen from dropdown list.

Any suggestions?? Nothing on google so far.

Thank you, Tom

I just created one, filled it out, and clicked OK. The window goes away and it shows under the notification conditions as expected.

Not sure as I've not seen this before, try logging out and back in and re-create

I could not get the notification to set via Firefox, but I did get it working by RDP'ing to the SEP server and running its management console. Weird, since within FF I created a different one to test the mail server...

Thank you, Tom

Maybe it's a quirk/bug within the web console. I always use the remote java console instead of the web console so I'm not sure.

Itz probably a nasty BUG waiting to BITE me someday...!!!

I'm glad I got it solved, thank you for helping me think of an alternate way to go about it...

Thank you, Tom

RDP may be the culprit.try to access SEPM as per this KB and try

Installing, Managing, Replicating SEP or SEPM in an RDP or Dameware session is expected to fail.