It allows for Microsoft Incident Responders to assist in remediation

ATP can access the database using a log collector on the SEPM host

It allows for Symantec Incident Responders to assist in remediation

ATP can access the database without any special host system requirements

Incursion

Discovery

Capture

Exfiltration

The endpoint automatically switches to using a Compliance location, where a Compliance policy is applied to the computer.

The endpoint automatically switches to using a System Lockdown location, where a System Lockdown

policy is applied to the computer.

The endpoint automatically switches to using a Host Integrity location, where a Host Integrity policy is

applied to the computer.

The endpoint automatically switches to using a Quarantine location, where a Quarantine policy is applied to the computer.