Symantec Endpoint Protection V2

Details

ID	`Symantec Endpoint Protection V2`
Provider	Broadcom
Category	Endpoint
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Query the Symantec Endpoint Protection Manager using the official REST API.

Use Cases

Scan/Quarantine/content-update an endpoint.
Assign policy to an endpoint.
Move client to different group.

Unsupported use cases in the API:

Get scan results
Get reports/logs
Receive system alerts

Required Permissions

The following role is required to use the Symantec Endpoint Protection API:

sysadmin
Note: An Administrator role does not have enough permissions for this integration. A System Administrator (sysadmin) role is required.

Configure Symantec Endpoint Protection V2 in Cortex

Parameter	Required
Server (e.g., https://1.2.3.4:8446)	True
Authentication	True
Password	True
SEPM domain for the user	False
Trust any certificate (not secure)	False
Use system proxy settings	False
Local time zone (e.g., +02:30,-06:00)	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

sep-endpoints-info

Returns information about endpoints.

Base Command

sep-endpoints-info

Input

Argument Name	Description	Required
columns	A CSV list of the displayed columns.	Optional
computerName	Filters by the host name of the computer. A wild card search can be done using ‘*’ at the end of the query.	Optional
lastUpdate	Indicates when a computer’s status was last updated. The default is “0”, which returns all results. Default is 0.	Optional
os	The operating system by which to filter. Possible values are: CentOs, Debian, Fedora, MacOSX, Oracle, OSX, RedHat, SUSE, Ubuntu, Win10, Win2K, Win7, Win8, WinEmb7, WinEmb8, WinEmb81, WinFundamental, WinNT, Win2K3, Win2K8, Win2K8R2, WinVista, WinXP, WinXPEmb, WinXPProf64.	Optional
pageSize	The number of results to include on each page. The default is 20.	Optional
groupName	The name of the group to which the endpoint belongs. A wild card search can be done using ‘*’ at the end of the query.	Optional

Context Output

Path	Type	Description
SEPM.Endpoint.Hostname	String	The hostname of the endpoint.
SEPM.Endpoint.Domain	String	The domain of the endpoint.
SEPM.Endpoint.IPAddresses	String	The IP addresses of the endpoint.
SEPM.Endpoint.OS	String	The OS information of the endpoint.
SEPM.Endpoint.Description	String	The description of the endpoint.
SEPM.Endpoint.MACAddresses	String	The MAC address of the endpoint.
SEPM.Endpoint.BIOSVersion	String	The BIOS version of the endpoint.
SEPM.Endpoint.DHCPServer	String	The DHCP server address of the endpoint.
SEPM.Endpoint.HardwareKey	String	The hardware key of the client to be moved.
SEPM.Endpoint.LastScanTime	String	The last scan time of the endpoint.
SEPM.Endpoint.RunningVersion	String	The running version of the endpoint.
SEPM.Endpoint.TargetVersion	String	The target version of the endpoint.
IP.Address	String	The IP address of the endpoint.
IP.Host	String	The IP host of the endpoint.
Endpoint.Hostname	Unknown	The hostname of the endpoint.
Endpoint.MACAddress	Unknown	The MAC address of the endpoint.
Endpoint.Domain	Unknown	The domain of the endpoint.
Endpoint.IPAddress	Unknown	The IP address of the endpoint.
Endpoint.DHCPServer	Unknown	The DHCP server of the endpoint.
Endpoint.OS	String	The OS of the endpoint.
Endpoint.OSVersion	String	The OS version of the endpoint.
Endpoint.BIOSVersion	String	The BIOS version of the endpoint.
Endpoint.Memory	String	The memory of the endpoint.
Endpoint.Processors	String	The processors that the endpoint uses.
IP.Hostname	String	The hostname that is mapped to this IP address.
SEPM.Endpoint.Group	String	The group of the endpoint.
SEPM.Endpoint.PatternIdx	String	The PatternIdx of the endpoint.
SEPM.Endpoint.OnlineStatus	String	The online status of the endpoint.
SEPM.Endpoint.UpdateTime	String	The update time of the endpoint.

Command Example

!sep-endpoints-info

Human Readable Output

Human_Readable_Output_1

sep-groups-info

Returns information about groups.

Base Command

sep-groups-info

Input

Argument Name	Description	Required
columns	The column by which the results are sorted.	Optional

Context Output

Path	Type	Description
SEPM.Groups	Unknown	The list of groups.
SEPM.Groups.created	number	The time of creation time (in Epoch).
SEPM.Groups.fullPathName	string	The name of the group.
SEPM.Groups.id	string	The ID of the group.
SEPM.Groups.numberOfPhysicalComputers	number	The number of physical computers in the group.
SEPM.Groups.numberOfRegisteredUsers	number	The number of registered users in the group.
SEPM.Groups.policyDate	number	The date of the policy (in Epoch).
SEPM.Groups.policySerialNumber	number	The serial number of the policy.

Command Example

!sep-groups-info

Human Readable Output

Human_Readable_Output_2

sep-system-info

Returns information about the system, such as version or AV definition.

Base Command

sep-system-info

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
SEPM.ServerAVDefVersion	string	The version of the AV definition.

Command Example

!sep-system-info

Human Readable Output

Human_Readable_Output_3

sep-command-status

Retrieves the status of a command.

Base Command

sep-command-status

Input

Argument Name	Description	Required
commandId	The ID of the command.	Required

Context Output

Path	Type	Description
SEPM.LastCommand.CommandDetails	string	The details of the command.
SEPM.LastCommand.CommandId	string	The ID of the command.

Command Example

!sep-command-status commandId=04A68CA5952B4726AAFEB421E0EB436C

Human Readable Output

Human_Readable_Output_4

sep-client-content

Retrieves the content of the client.

Base Command

sep-client-content

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
SEPM.ClientContentVersions	string	Displays the versions for each client.
SEPM.LastUpdated	string	The last update of a date.

Command Example

!sep-client-content

Human Readable Output

Human_Readable_Output_5

sep-list-policies

Retrieves a list of existing policies.

Base Command

sep-list-policies

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
SEPM.PoliciesList.PolicyName	string	The name of the policy.
SEPM.PoliciesList.Type	string	The type of the policy.
SEPM.PoliciesList.ID	string	The ID of the policy.
SEPM.PoliciesList.Description	string	The description of the policy.
SEPM.PoliciesList.Enabled	boolean	Whether the list of polices is enabled. Enabled if “True”.
SEPM.PoliciesList.AssignedLocations.GroupID	string	The ID of the group of the locations assigned to this policy.
SEPM.PoliciesList.AssignedLocations.Locations	string	The list of location IDs assigned to this policy.
SEPM.PoliciesList.AssignedCloudGroups.GroupID	string	The ID of the cloud group of the locations assigned to this policy.
SEPM.PoliciesList.AssignedCloudGroups.Locations	string	The list of location IDs belonging to a cloud group assigned to this policy.

Command Example

!sep-list-policies

Human Readable Output

Human_Readable_Output_6

sep-assign-policy

Assigns an existing policy to a specified location.

Base Command

sep-assign-policy

Input

Argument Name	Description	Required
groupID	The ID of the group to which the endpoint belongs.	Required
locationID	The ID of the location of the endpoint.	Required
policyType	The type of policy to be assigned.	Required
policyID	The ID of the policy to be assigned.	Required

Context Output

There is no context output for this command.

Command Example

!sep-assign-policy groupID=44BE96AFC0A8010B0CFACB30929326C2 locationID=50FEEA3FC0A8010B739E49CB0C321A7E policyID=A00ADE188AA148D7AD319CBCA1FA2F23 policyType=hi

Human Readable Output

Human_Readable_Output_7

sep-list-locations

Retrieves a list of location IDs for a specified group.

Base Command

sep-list-locations

Input

Argument Name	Description	Required
groupID	The group ID for which to list locations.	Required

Context Output

Path	Type	Description
SEPM.Locations.ID	Unknown	The ID of the location.

Command Example

!sep-list-locations groupID=44BE96AFC0A8010B0CFACB30929326C2

Human Readable Output

Human_Readable_Output_8

sep-endpoint-quarantine

Quarantines an endpoint according to its policy.

Base Command

sep-endpoint-quarantine

Input

Argument Name	Description	Required
endpoint	The IP or hostname of the endpoint.	Required
actionType	Adds or removes an endpoint from quarantine. Possible values are: Add, Remove.	Required

Context Output

Path	Type	Description
SEPM.Quarantine.CommandID	string	The ID of the command that was run.
SEPM.Quarantine.Action	string	The type of the action type. Can be “Add” or “Remove”.
SEPM.Quarantine.Endpoint	string	The IP or hostname of the identifier of the endpoint.

Command Example

!sep-endpoint-quarantine actionType=add endpoint=demisto-PC

Human Readable Output

Human_Readable_Output_9

sep-scan-endpoint

Scans an endpoint.

Base Command

sep-scan-endpoint

Input

Argument Name	Description	Required
endpoint	The IP address or hostname of the endpoint.	Required
scanType	The scan type of the endpoint. Can be “ScanNow_Quick”, “ScanNow_Full”, or “ScanNow_Custom”. Possible values are: ScanNow_Quick, ScanNow_Full, ScanNow_Custom.	Required

Context Output

Path	Type	Description
SEPM.Scan.CommandID	string	The ID of the command that was run.
SEPM.Scan.Type	string	The type of the scan. Can be “ScanNow_Quick”, “ScanNow_Full”, or “ScanNow_Custom”.
SEPM.Scan.Endpoint	Unknown	The IP or hostname of the identifier of the endpoint.

Command Example

!sep-scan-endpoint endpoint=demisto-PC scanType=ScanNow_Quick

Human Readable Output

Human_Readable_Output_10

sep-update-endpoint-content

Updates the content of a specified client.

Base Command

sep-update-endpoint-content

Input

Argument Name	Description	Required
endpoint	The IP address or hostname of the endpoint.	Required

Context Output

Path	Type	Description
SEPM.Update.Endpoint	String	The endpoint that is being updated.
SEPM.Update.CommandID	String	The ID of the command for which to check the status.

Command Example

!sep-update-endpoint-content endpoint=demisto-PC

Human Readable Output

Human_Readable_Output_11

sep-move-client-to-group

Moves a client to a group.

Base Command

sep-move-client-to-group

Input

Argument Name	Description	Required
groupID	The ID of the group to which to move the client.	Required
hardwareKey	The hardware key of the client to be moved.	Required

Context Output

There is no context output for this command.

Command Example

!sep-move-client-to-group groupID=AA51516BC0A8010B3BFBBE37F7B71214 hardwareKey=269CE816FDB1BA25A2505D0A5A59294C

Human Readable Output

Human_Readable_Output_12

sep-identify-old-clients

Get endpoints for a running version that is different than the target version or the desired version (if specified).

Base Command

sep-identify-old-clients

Input

Argument Name	Description	Required
columns	Sets which columns will be displayed.	Optional
computerName	Filters by the host name of the computer. A wild card search can be done using ‘*’ at the end of the query.	Optional
lastUpdate	Indicates when a computer’s status was last updated. The default is “0”, which returns all results.	Optional
os	The operating system by which to filter.	Optional
pageSize	The number of results to include on each page. The default is 20.	Optional
groupName	The name of the group to which the endpoint belongs. A wild card search can be done using ‘*‘at the end of the query.	Optional
desiredVersion	desiredVersion.	Optional

Context Output

There is no context output for this command.

Command Example

!sep-identify-old-clients desiredVersion=10

Human Readable Output

Human_Readable_Output_13

Known Limitations

SEPM REST- API currently exposes statistics, but does not expose extended information about Risks, Application and Device control, and Network logs.
SEPM REST- API currently does not support an operation to get Host Names or IP addresses of clients who don’t have an update content version.
SEPM REST- API currently does not support an operation to create or download reports.

Configuration parameters

server — Server (e.g., https://1.2.3.4:8446) (required)
authentication — Authentication (required)
domain — SEPM domain for the user
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
timeZone — Local time zone (e.g., +02:30,-06:00)

Commands (13)

sep-assign-policy
Assigns an existing policy to a specified location.
sep-client-content
Retrieves the content of the client.
sep-command-status
Retrieves the status of a command.
sep-endpoint-quarantine
Quarantines an endpoint according to its policy.
sep-endpoints-info
Returns information about endpoints.
sep-groups-info
Returns information about groups.
sep-identify-old-clients
Get endpoints for a running version that is different than the target version or the desired version (if specified).
sep-list-locations
Retrieves a list of location IDs for a specified group.
sep-list-policies
Retrieves a list of existing policies.
sep-move-client-to-group
Moves a client to a group.
sep-scan-endpoint
Scans an endpoint.
sep-system-info
Returns information about the system, such as version or AV definition.
sep-update-endpoint-content
Updates the content of a specified client.

Source

SymantecEndpointProtection_V2.py SymantecEndpointProtection_V2_test.py SymantecEndpointProtection_V2.yml SymantecEndpointProtection_V2_description.md

Download History Raw

category: Endpoint
provider: Broadcom
commonfields:
  id: Symantec Endpoint Protection V2
  version: -1
configuration:
- display: Server (e.g., https://1.2.3.4:8446)
  name: server
  required: true
  type: 0
- display: Authentication
  name: authentication
  required: true
  type: 9
- display: SEPM domain for the user
  name: domain
  type: 0
  required: false
- defaultvalue: 'false'
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- defaultvalue: 'false'
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Local time zone (e.g., +02:30,-06:00)
  name: timeZone
  type: 0
  required: false
description: Query the Symantec Endpoint Protection Manager using the official REST API.
display: Symantec Endpoint Protection v2
name: Symantec Endpoint Protection V2
script:
  commands:
  - arguments:
    - description: A CSV list of the displayed columns.
      name: columns
    - description: Filters by the host name of the computer. A wild card search can be done using '*' at the end of the query.
      name: computerName
    - defaultValue: '0'
      description: Indicates when a computer's status was last updated. The default is "0", which returns all results.
      name: lastUpdate
    - auto: PREDEFINED
      description: The operating system by which to filter.
      name: os
      predefined:
      - CentOs
      - Debian
      - Fedora
      - MacOSX
      - Oracle
      - OSX
      - RedHat
      - SUSE
      - Ubuntu
      - Win10
      - Win2K
      - Win7
      - Win8
      - WinEmb7
      - WinEmb8
      - WinEmb81
      - WinFundamental
      - WinNT
      - Win2K3
      - Win2K8
      - Win2K8R2
      - WinVista
      - WinXP
      - WinXPEmb
      - WinXPProf64
    - description: The number of results to include on each page. The default is 20.
      name: pageSize
    - description: The name of the group to which the endpoint belongs. A wild card search can be done using '*' at the end of the query.
      name: groupName
    description: Returns information about endpoints.
    name: sep-endpoints-info
    outputs:
    - contextPath: SEPM.Endpoint.Hostname
      description: The hostname of the endpoint.
      type: String
    - contextPath: SEPM.Endpoint.Domain
      description: The domain of the endpoint.
      type: String
    - contextPath: SEPM.Endpoint.IPAddresses
      description: The IP addresses of the endpoint.
      type: String
    - contextPath: SEPM.Endpoint.OS
      description: The OS information of the endpoint.
      type: String
    - contextPath: SEPM.Endpoint.Description
      description: The description of the endpoint.
      type: String
    - contextPath: SEPM.Endpoint.MACAddresses
      description: The MAC address of the endpoint.
      type: String
    - contextPath: SEPM.Endpoint.BIOSVersion
      description: The BIOS version of the endpoint.
      type: String
    - contextPath: SEPM.Endpoint.DHCPServer
      description: The DHCP server address of the endpoint.
      type: String
    - contextPath: SEPM.Endpoint.HardwareKey
      description: The hardware key of the client to be moved.
      type: String
    - contextPath: SEPM.Endpoint.LastScanTime
      description: The last scan time of the endpoint.
      type: String
    - contextPath: SEPM.Endpoint.RunningVersion
      description: The running version of the endpoint.
      type: String
    - contextPath: SEPM.Endpoint.TargetVersion
      description: The target version of the endpoint.
      type: String
    - contextPath: IP.Address
      description: The IP address of the endpoint.
      type: String
    - contextPath: IP.Host
      description: The IP host of the endpoint.
      type: String
    - contextPath: Endpoint.Hostname
      description: The hostname of the endpoint.
      type: Unknown
    - contextPath: Endpoint.MACAddress
      description: The MAC address of the endpoint.
      type: Unknown
    - contextPath: Endpoint.Domain
      description: The domain of the endpoint.
      type: Unknown
    - contextPath: Endpoint.IPAddress
      description: The IP address of the endpoint.
      type: Unknown
    - contextPath: Endpoint.DHCPServer
      description: The DHCP server of the endpoint.
      type: Unknown
    - contextPath: Endpoint.OS
      description: The OS of the endpoint.
      type: String
    - contextPath: Endpoint.OSVersion
      description: The OS version of the endpoint.
      type: String
    - contextPath: Endpoint.BIOSVersion
      description: The BIOS version of the endpoint.
      type: String
    - contextPath: Endpoint.Memory
      description: The memory of the endpoint.
      type: String
    - contextPath: Endpoint.Processors
      description: The processors that the endpoint uses.
      type: String
    - contextPath: IP.Hostname
      description: The hostname that is mapped to this IP address.
      type: String
    - contextPath: SEPM.Endpoint.Group
      description: The group of the endpoint.
      type: String
    - contextPath: SEPM.Endpoint.PatternIdx
      description: The PatternIdx of the endpoint.
      type: String
    - contextPath: SEPM.Endpoint.OnlineStatus
      description: The online status of the endpoint.
      type: String
    - contextPath: SEPM.Endpoint.UpdateTime
      description: The update time of the endpoint.
      type: String
  - arguments:
    - description: The column by which the results are sorted.
      name: columns
    description: Returns information about groups.
    name: sep-groups-info
    outputs:
    - contextPath: SEPM.Groups
      description: The list of groups.
      type: Unknown
    - contextPath: SEPM.Groups.created
      description: The time of creation time (in Epoch).
      type: number
    - contextPath: SEPM.Groups.fullPathName
      description: The name of the group.
      type: string
    - contextPath: SEPM.Groups.id
      description: The ID of the group.
      type: string
    - contextPath: SEPM.Groups.numberOfPhysicalComputers
      description: The number of physical computers in the group.
      type: number
    - contextPath: SEPM.Groups.numberOfRegisteredUsers
      description: The number of registered users in the group.
      type: number
    - contextPath: SEPM.Groups.policyDate
      description: The date of the policy (in Epoch).
      type: number
    - contextPath: SEPM.Groups.policySerialNumber
      description: The serial number of the policy.
      type: number
  - description: Returns information about the system, such as version or AV definition.
    name: sep-system-info
    outputs:
    - contextPath: SEPM.ServerAVDefVersion
      description: The version of the AV definition.
      type: string
  - arguments:
    - description: The ID of the command.
      name: commandId
      required: true
    description: Retrieves the status of a command.
    name: sep-command-status
    outputs:
    - contextPath: SEPM.LastCommand.CommandDetails
      description: The details of the command.
      type: string
    - contextPath: SEPM.LastCommand.CommandId
      description: The ID of the command.
      type: string
  - description: Retrieves the content of the client.
    name: sep-client-content
    outputs:
    - contextPath: SEPM.ClientContentVersions
      description: Displays the versions for each client.
      type: string
    - contextPath: SEPM.LastUpdated
      description: The last update of a date.
      type: string
  - description: Retrieves a list of existing policies.
    name: sep-list-policies
    outputs:
    - contextPath: SEPM.PoliciesList.PolicyName
      description: The name of the policy.
      type: string
    - contextPath: SEPM.PoliciesList.Type
      description: The type of the policy.
      type: string
    - contextPath: SEPM.PoliciesList.ID
      description: The ID of the policy.
      type: string
    - contextPath: SEPM.PoliciesList.Description
      description: The description of the policy.
      type: string
    - contextPath: SEPM.PoliciesList.Enabled
      description: Whether the list of polices is enabled. Enabled if "True".
      type: boolean
    - contextPath: SEPM.PoliciesList.AssignedLocations.GroupID
      description: The ID of the group of the locations assigned to this policy.
      type: string
    - contextPath: SEPM.PoliciesList.AssignedLocations.Locations
      description: The list of location IDs assigned to this policy.
      type: string
    - contextPath: SEPM.PoliciesList.AssignedCloudGroups.GroupID
      description: The ID of the cloud group of the locations assigned to this policy.
      type: string
    - contextPath: SEPM.PoliciesList.AssignedCloudGroups.Locations
      description: The list of location IDs belonging to a cloud group assigned to this policy.
      type: string
  - arguments:
    - description: The ID of the group to which the endpoint belongs.
      name: groupID
      required: true
    - description: The ID of the location of the endpoint.
      name: locationID
      required: true
    - description: The type of policy to be assigned.
      name: policyType
      required: true
    - description: The ID of the policy to be assigned.
      name: policyID
      required: true
    description: Assigns an existing policy to a specified location.
    name: sep-assign-policy
  - arguments:
    - description: The group ID for which to list locations.
      name: groupID
      required: true
    description: Retrieves a list of location IDs for a specified group.
    name: sep-list-locations
    outputs:
    - contextPath: SEPM.Locations.ID
      description: The ID of the location.
      type: Unknown
  - arguments:
    - description: The IP or hostname of the endpoint.
      name: endpoint
      required: true
    - auto: PREDEFINED
      description: Adds or removes an endpoint from quarantine.
      name: actionType
      predefined:
      - Add
      - Remove
      required: true
    description: Quarantines an endpoint according to its policy.
    name: sep-endpoint-quarantine
    outputs:
    - contextPath: SEPM.Quarantine.CommandID
      description: The ID of the command that was run.
      type: string
    - contextPath: SEPM.Quarantine.Action
      description: The type of the action type. Can be "Add" or "Remove".
      type: string
    - contextPath: SEPM.Quarantine.Endpoint
      description: The IP or hostname of the identifier of the endpoint.
      type: string
  - arguments:
    - description: The IP address or hostname of the endpoint.
      name: endpoint
      required: true
    - auto: PREDEFINED
      description: The scan type of the endpoint. Can be "ScanNow_Quick", "ScanNow_Full", or "ScanNow_Custom".
      name: scanType
      predefined:
      - ScanNow_Quick
      - ScanNow_Full
      - ScanNow_Custom
      required: true
    description: Scans an endpoint.
    name: sep-scan-endpoint
    outputs:
    - contextPath: SEPM.Scan.CommandID
      description: The ID of the command that was run.
      type: string
    - contextPath: SEPM.Scan.Type
      description: The type of the scan. Can be "ScanNow_Quick", "ScanNow_Full", or "ScanNow_Custom".
      type: string
    - contextPath: SEPM.Scan.Endpoint
      description: The IP or hostname of the identifier of the endpoint.
      type: Unknown
  - arguments:
    - description: The IP address or hostname of the endpoint.
      name: endpoint
      required: true
    description: Updates the content of a specified client.
    name: sep-update-endpoint-content
    outputs:
    - contextPath: SEPM.Update.Endpoint
      description: The endpoint that is being updated.
      type: String
    - contextPath: SEPM.Update.CommandID
      description: The ID of the command for which to check the status.
      type: String
  - arguments:
    - description: The ID of the group to which to move the client.
      name: groupID
      required: true
    - description: The hardware key of the client to be moved.
      name: hardwareKey
      required: true
    description: Moves a client to a group.
    name: sep-move-client-to-group
  - arguments:
    - description: Sets which columns will be displayed.
      name: columns
    - description: Filters by the host name of the computer. A wild card search can be done using '*' at the end of the query.
      name: computerName
    - description: Indicates when a computer's status was last updated. The default is "0", which returns all results.
      name: lastUpdate
    - description: The operating system by which to filter.
      name: os
    - description: The number of results to include on each page. The default is 20.
      name: pageSize
    - description: The name of the group to which the endpoint belongs. A wild card search can be done using '*'at the end of the query.
      name: groupName
    - description: desiredVersion.
      name: desiredVersion
    description: Get endpoints for a running version that is different than the target version or the desired version (if specified).
    name: sep-identify-old-clients
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
tests:
- SymantecEndpointProtection_Test
fromversion: 5.0.0