See This
Integration with Symantec Advanced Threat Protection: Endpoint (ATP: Endpoint)
ATP: Endpoint is an on-premises virtual appliance that detects advanced threats on endpoints in your network. ATP: Endpoint delivers actionable data so that you can quickly analyze and respond to the threats. You can select threats to block and add them to the ATP: Endpoint policy. When ATP: Endpoint sends the policy to the Symantec Endpoint Protection Manager, read-only file fingerprints from ATP: Endpoint appear in the system lockdown configuration. You can also configure Symantec Endpoint Protection Manager client groups to use ATP: Endpoint for reputation queries and submissions.
Configuring client groups to use private servers for reputation queries and submissions
https://support.symantec.com/en_US/article.HOWTO111068.html
Interaction between system lockdown and ATP: Endpoint blacklist rules
https://support.symantec.com/en_US/article.HOWTO111075.html
What's new in Symantec Endpoint Protection 12.1.6
https://support.symantec.com/en_US/article.HOWTO111067.html
see chetan articles
https://www-secure.symantec.com/connect/articles/symantec-releases-symantec-endpoint-protection-12161686000-121-ru6