It works by isolating questionable files into a walled-off sandbox environment, where it runs them and analyzes their behavior to determine whether they're malicious. There's also Symantec Synapse. This technology correlates data with information from Symantec Endpoint Protection and Symantec Email Security.cloud.