Endpoint Protection

Quick question about how SEP for Linux works:

Say I have a Linux server, and a typical policy set without exceptions. I make a install package using the policy set.

Next, I add in an exceptions policy for a directory on said Linux server. Scans on that directory could really mess with my server.

Because the package was created before the exception policy was made, will SEP run scans right after install on the excluded directory? Or will it check in with the SEPM server first or Liveupdate before actually doing anything?

I hope this question is clear. And all of this obviously assumes internet access so the client can check in with the SEPM server.

Thanks!

The client will need to connect to SEPM to grab policy and download/install content before doing anything. This should all happen prior to scans running, which would take into account your exclusions.

Ideally, you want to create a package after your policy has been set so it is included in the install.

Thanks Brian! Exactly what I needed to know :)