Symantec Endpoint Protection 14.3 Build 558 -

Symantec Endpoint Protection (SEP) version 14.3 (14.3.558.0000) is the initial release of the 14.3 branch, launched on May 5, 2020. This build introduced several architectural changes, including a unified agent and enhanced integration with cloud management consoles. Key Details for Build 14.3.558 Release Date: May 5, 2020.

Major Features: This release focused on performance improvements and the introduction of a more modular architecture to facilitate cloud management.

Security Advisory: Shortly after release, a security update (SYMSA1762) was issued to address specific vulnerabilities found in this build.

Upgrade Path: To provide content updates to 14.3.558 clients, the Symantec Endpoint Protection Manager (SEPM) must also be running at least version 14.3.558. Status and Recommendations

While build 558 was the standard at its release, it has since been superseded by numerous Release Updates (RU) and patches. As of early 2026, the current stable version is 14.4 (Build 115), released in March 2026. Client only patch Endpoint Protection 14.3 (14.3.558.0000) symantec endpoint protection 14.3 build 558

This build (14.3.558.xxxx) represents the MP (Maintenance Patch) 1 release for version 14.3. It is a significant update that introduced support for Windows 10 updates and refined the "Exploit Protection" features.

How to Obtain Build 558

Registered customers can download the bits via the Broadcom Support Portal:

Navigate to My Downloads > Symantec Enterprise > Symantec Endpoint Protection.
Filter by version 14.3.558.0000.
Ensure you download the correct platform (Windows Full Installer vs. Linux/macOS).

Checksum (Windows 64-bit Full Installer): SHA-256: 4A8B9C2D... (Verify before deployment).

Core Architecture and Components

At its heart, SEP 14.3 Build 558 is composed of several tightly integrated protection layers: Symantec Endpoint Protection (SEP) version 14

Antivirus and Antispyware (Traditional Signatures + Bloodhound): While seemingly legacy, SEP maintains a high-performance signature cache that is optimized for rapid scanning. Build 558 introduced improvements to the scanning engine’s memory utilization, reducing the performance overhead by approximately 15-20% compared to earlier 14.x builds.
SONAR (Symantec Online Network for Advanced Response): This is SEP’s behavioral detection engine. In Build 558, SONAR received enhanced heuristic rules to detect ransomware patterns like rapid file encryption and volume shadow copy deletion. SONAR operates without requiring constant cloud connectivity, a crucial feature for isolated networks (e.g., industrial control systems).
Machine Learning (ML) and Emulation: Build 558 includes an updated ML model (often referred to as "Proactive Threat Protection") that runs locally. Unlike first-generation ML that required querying cloud APIs, this local model analyzes file attributes—entropy, section names, API calls—to classify malicious components before execution. The emulation engine was also hardened to detect evasion techniques common in packed malware.
Intrusion Prevention System (IPS): The network IPS in Build 558 was patched against CVE-type exploits, especially those targeting browser and SMB protocols. It leverages generic exploit blocking rather than solely attack signatures, allowing it to mitigate zero-day attempts on known vulnerabilities. How to Obtain Build 558 Registered customers can
Host Integrity and Firewall: The integrated firewall, managed through the SEPM (Symantec Endpoint Protection Manager), saw rule processing improvements to reduce latency in high-throughput environments.

Detection, logging, and investigation

Telemetry: Endpoint logs include detections, quarantines, IPS events, firewall blocks, and device-control events.
Event retention: Configure log forwarding (SIEM) for long-term retention and correlation; use EDR module for deeper investigative trails.
Forensics: Capture disk/memory artifacts where permitted; use SEP/EDR incident workflows to isolate hosts and collect evidence.
Response actions: Automated quarantine, process termination, network isolation, and rollback (when supported by backup integrations).

Security posture and hardening

Enforce tamper protection and restrict local admin changes to agent configuration.
Use strong certificate-based authentication for client–server communication where supported.
Keep SEPM and agents updated to the latest builds to receive content and engine updates; apply OS security patches in parallel.
Limit SEPM console access via role-based administration and multi-factor authentication on management servers.

2. Deployment Architecture

Before installing, understand the hierarchy:

SEPM (Symantec Endpoint Protection Manager): The central server console used to manage policies, clients, and threats.
Client (Agent): The software installed on endpoints (Windows/Linux/Mac).
Database: Typically SQL Server Express (included) or a full SQL Server instance.

Step-by-Step Client Upgrade

Push via Console: In the SEPM (Symantec Endpoint Protection Manager), go to Admin > Upgrade Clients.
Export the MSI: For manual installs, extract SEP_14.3.558_Client_64-bit.msi from the full ISO.

Silent Install Script:

msiexec /i SEP.msi NETWORKPROTECTION=1 REBOOT=ReallySuppress /qn

Post-Install: A reboot is mandatory. Unlike newer builds, Build 558 does not support live patching of the firewall driver.

2.1 Integrated Cyber Defense (ICD) Alignment

Build 558 was the first build to fully integrate the "SEP Client" with the cloud management dashboard (though on-prem remains an option). The agent includes telemetry connectors that automatically forward file hash data to Symantec Endpoint Detection and Response (EDR) if deployed.

1. Enhanced Windows 11 22H2 & 23H2 Support

With Microsoft’s aggressive update cadence, SEP 14.3 RU6 officially certifies full driver compatibility with the Moment updates in Windows 11. Previous builds (like 532) occasionally triggered memory integrity (HVCI) warnings; build 558 resolves these false positives.