Symantec 20032623 - Endpoint Protection Small Business Edition, Руководство по внедрению

Страница: 196 / 351

See “About the files and applications that SONAR detects” on page 196.
About the files and applications that SONAR detects
SONAR uses a heuristics system that leverages Symantec's online intelligence
network with proactive local monitoring on your client computers to detect
emerging threats. SONAR also detects changes or behavior on your client
computers that you should monitor.
SONAR does not make detections on application type, but on how a process
behaves. SONAR acts on an application only if that application behaves maliciously,
regardless of its type. For example, if a Trojan horse or keylogger does not act
maliciously, SONAR does not detect it.
SONAR detects the following items:
SONAR uses heuristics to determine if an
unknown file behaves suspiciously and might be
a high risk or low risk. It also uses reputation data
to determine whether the threat is a high risk or
low risk. Heuristic threats
SONAR detects applications or the files that try
to modify DNS settings or a host file on a client
computer. System changes
Some good trusted files might be associated with
suspicious behavior. SONAR detects these files
as suspicious behavior events. For example, a
well-known document sharing application might
create executable files. Trusted applications that exhibit bad
behavior
If you disable Auto-Protect, you limit SONAR's ability to make detections of high
and low risk files. If you disable Insight lookups (reputation queries), you also
limit the SONAR's detection capability.
See “Managing SONAR” on page 196.
Managing SONAR
SONAR is part of Proactive Threat Protection on your client computers. You
manage SONAR settings as part of a Virus and Spyware Protection policy.
You configure SONAR settings for the clients that run Symantec Endpoint
Protection Small Business Edition version 12.1. SONAR settings also include
Managing SONAR
About the files and applications that SONAR detects
196