About The Files And Applications That Sonar Detects; Managing Sonar - Symantec 20032623 - Endpoint Protection Small Business Edition Implementation Manual

196

Managing SONAR

About the files and applications that SONAR detects

About the files and applications that SONAR detects
Managing SONAR
See About the files and applications that SONAR detects"
SONAR uses a heuristics system that leverages Symantec's online intelligence
network with proactive local monitoring on your client computers to detect
emerging threats. SONAR also detects changes or behavior on your client
computers that you should monitor.
SONAR does not make detections on application type, but on how a process
behaves. SONAR acts on an application only if that application behaves maliciously,
regardless of its type. For example, if a Trojan horse or keylogger does not act
maliciously, SONAR does not detect it.
SONAR detects the following items:
Heuristic threats
System changes
Trusted applications that exhibit bad
behavior
If you disable Auto-Protect, you limit SONAR's ability to make detections of high
and low risk files. If you disable Insight lookups (reputation queries), you also
limit the SONAR's detection capability.
See Managing SONAR"
SONAR is part of Proactive Threat Protection on your client computers. You
manage SONAR settings as part of a Virus and Spyware Protection policy.
You configure SONAR settings for the clients that run Symantec Endpoint
Protection Small Business Edition version 12.1. SONAR settings also include
SONAR uses heuristics to determine if an
unknown file behaves suspiciously and might be
a high risk or low risk. It also uses reputation data
to determine whether the threat is a high risk or
low risk.
SONAR detects applications or the files that try
to modify DNS settings or a host file on a client
computer.
Some good trusted files might be associated with
suspicious behavior. SONAR detects these files
as suspicious behavior events. For example, a
well-known document sharing application might
create executable files.
on page 196.
on page 196.