I need a solution
I found TECH article # 186925 (http://www.symantec.com/docs/TECH186925) that the Symantec Endpoint Manager 12.1 writes to the Application Log. However, it has been my experience that you can find Events in the Symantec Endpoint Protection Log as well.