Advanced Threat Protection

Posting ITS Webinar recording for the Connect community.

https://vimeo.com/153096782

Hi John . It was very informative , really liked it. However I have one question in this regard. I believe ATP : Network is also supported now in inline mode as of the version 2.0 , Isn't it ?

Inline is not currently available in this release. Symantec roadmap shows that is will be available in the upcoming release in April 2016

Hi John , I would really appreciate if you can kindly answer my following query. I've been playing with isolating the client via the ATP manager but it is a misleading becuase you apply a HI policy via the SEPM and then also associate it with a Firewall Quarantine policy . And when the HI check fails it will apply the Firewall Quarantine policy from the SEPM. 

So the only difference you see when you click on isolate button from the ATP Manager itself for this particular endpoint on the agent UI will only see this message " The agent has been Quarantined by the Administrator " And when you rejoin this client from the ATP Manager this message will go away but client will still be placed in the Quarantined location ( and having a quaranted firewall policy applied to it ) 

Have you tested this feature yet or no ?

SymSpec,

We have tested this process and see below for our results.

When we click isolate a endpoint from the ATP console the endpoint see these results.

After rejoining the endpoint from the ATP console we get this:

As you can see HI changes the location when it places the endpoint into isolation (Default >Quarantine) and when we rejoin it HI changes the location back to (Default)

Please let me know if this answers your question.

Thanks for the reply John. I am getting the same result in my results as you showed in the screenshot , Just one last thing . Can you please also share the screenshot of HI policy that you have applied to this client on SEPM ?  That will surely remove my last remaining doubt. Many thanks

Quarantine Firewall Policy.

John thanks for the kind reply actually I was refering to the requirements section in the HI . Can you please share that ? I am sorry for the inconvenience .  Regards !