Symantec
™
Endpoint Detection and Response 4.5 Installation Guide for the S550
appliance
Table 7: Symantec EDR web and IP addresses
Web addresses/IP Address Protocol Port Description
•
remotetunnel1.edrc.symantec.com
•
remotetunnel2.edrc.symantec.com
•
remotetunnel3.edrc.symantec.com
•
remotetunnel4.edrc.symantec.com
•
remotetunnel5.edrc.symantec.com
HTTPS 443 Permits Symantec Support remote access to
the Symantec EDR appliance.
https://api-gateway.symantec.com TCP 443 Accesses Symantec's Targeted Attack
Analytics service.
licensing.dmas.symantec.com TCP 443 Used to get the Cynic license.
api.us.dmas.symantec.com
api.eu.dmas.symantec.com
TCP 443 Used to perform queries to the Cynic US and
UK servers (required).
liveupdate.symantec.com TCP 80 Used to check for and download definitions for
Symantec's detection technologies.
ratings-wrs.symantec.com TCP 443 Used to query Norton Safe Web server to
identify malicious websites.
stnd-avpg.crsi.symantec.com
stnd-ipsg.crsi.symantec.com
TCP 443 Used to send detection telemetry to Symantec.
register.brightmail.com TCP 443 Used to register the appliance.
swupdate.brightmail.com TCP 443 Used to check for and download new releases
of Symantec EDR.
shasta-rrs.symantec.com
shasta-mrs.symantec.com
TCP 443 Used to perform reputation lookups for
Windows executable and APK installable files.
datafeedapi.symanteccloud.com TCP 443 Used to download Email Security.cloud and
EDR: Roaming events.
stats.norton.com TCP 443 When telemetry is configured, used to send
statistics telemetry to Symantec.
telemetry.symantec.com TCP 443 When telemetry is configured, used to send file
telemetry and to upload diagnostic packages
to Symantec.
EDR appliance console TCP 443 (inbound) or in
the range of 1024 to
9997
Access to Symantec EDR public API.
https://sso1.edrc.symantec.com TCP 443 Used for SSO.
Symantec EDR ports and settings describes the ports that Symantec EDR uses for communications, content updates, and
interactions with Symantec.cloud detection services.
20
To Next Page
Loading...