liveupdate -firewall

Hi I would ask about specific situation .I use SEP Firewall as individual firewall for my user station.

For my issue I notice SEP do some connection .for  liveupdate.symantecliveupdate.com several time .I don't allow him to connect .But SEP do this.And logs not show my this connection .Why it is doing and where I can stop it.Please advanced users about advice.

SEP put it here

C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.6867.6400.105\Data\Lue\Downloads

sepc$20submission$20control$20data_12.1$20ru6_symalllanguages_livetri

Attachment is on bottom.