Does Symantec Endpoint Protection Have File Integrity Monitoring Verified Official

Once you have your list of "good" files, you must create a policy to enforce them.

No, not as a dedicated, native feature.

Symantec Endpoint Protection does offer File Integrity Monitoring capabilities, although it may not be enabled by default. The feature is part of the SEP's Advanced Threat Protection (ATP) module, which provides a range of advanced security features to detect and prevent sophisticated threats. Once you have your list of "good" files,

: Part of the broader Symantec Endpoint Security (SES) suite, this tool monitors endpoint events in real-time, including file executions and registry modifications, providing a trail for changes that occur. Comparison of Symantec Solutions for FIM Feature Symantec Endpoint Protection (SEP) Data Center Security (DCS/CSP) Primary Use General endpoint antivirus & firewall Server hardening & compliance Dedicated FIM No (uses Host Integrity checks) Yes (Real-time FIM module) Real-time Alerts For threats and policy violations For any unauthorized file modification Audit Reports General security events Detailed "Who, What, When" change logs For further technical details, you can visit the Broadcom TechDocs portal to see how SEP technologies protect against specific attacks. Are you looking to meet a specific

Is it enough for your organization?

While Host Integrity is the manual, policy-based FIM, SEP has two other features that provide automated integrity monitoring:

| Pros | Cons | | :--- | :--- | | No need to install a separate agent (Tripwire, OSSEC) if you already have SEP. | Latency: Not strictly real-time. Alerts are delayed until the next scheduled scan. | | Compliance: Meets basic PCI-DSS requirements for FIM. | Management Overhead: Creating and maintaining Fingerprint Lists manually is time-consuming. | | Enforcement: Can automatically block network access for non-compliant machines. | Performance: Hashing thousands of files during a check can spike CPU usage on older servers. | | Low Cost: Included in the license (no extra fee). | Granularity: Lacks advanced features like file permission monitoring (e.g., alerting if "Everyone" gets Write access to a folder). | The feature is part of the SEP's Advanced

When a change is detected, SEP can trigger various actions, such as: