This video will walk through different steps which you can use to convert Cisco Secure Endpoint connectors from Audit to Protect mode.
To learn more, check out the community post:
You can also attend a live session Ask the Expert session. Look for an upcoming Getting Started: Cisco Secure Endpoint session from the schedule: https://community.cisco.com/t5/security-documents/converting-cisco-secure-endpoint-connectors-from-audit-to/ta-p/4637966
You can watch this video also at the source.