Endpoint Protection

Does anyone know how to view what IPS signatures are being tripped from the SEPM client?
Right now it looks like the only way to see what IPS events that are occuring from and endpoint is from the SEPM console / Log

 Change the Clients to Server Control to Client Control Mode.
But in that way you might loose the firewall policies. So you can do that for a troubleshooting purpose.

In SEPM - Clients - highlight group- Policies-Location Specific Settings - Client User Interface Control settings.

Are you referring to the Intrusion Prevention Policy setting in the Mixed Control Setting?

Right now all options are set to server.

 Yes that correct.If you change it to client side it will show the logs on the client.

Actually I just found it. The tripped IPS events are reported under the Client Management Logs - Security Log
You would think Symantec would report Firewall and IPS event in the same log file under Network Threat Protection

Thanks...