Broadcom Symantec S550, Installation Manual

Symantec

™

 Endpoint Detection and Response 4.5 Installation Guide for the S550

appliance

Post-installation tasks

Completing setup tasks

Tasks to complete Symantec Endpoint Detection and Response installation

 lists the tasks that Symantec recommends

you take immediately after you complete the preliminary Symantec Endpoint Detection and Response installation.
Click the context-sensitive help tokens in the EDR appliance console for more information about performing these tasks.

Table 12: Tasks to complete Symantec Endpoint Detection and Response installation

Task

Description

Access EDR appliance console.

Perform the post-installation tasks and configurations in EDR appliance console.

Accessing the EDR appliance console

Configure the following settings on the 

Settings > Global

 page.

Set up Synapse correlation.

If SEP or Email Security.cloud protect your network, configure Synapse to correlate incident data

from these sources with Symantec EDR.

If you intend to use Symantec

Endpoint Protection with Symantec

EDR. configure the SEPM

Controller connection.

You can integrate Symantec Endpoint Detection and Response with Symantec Endpoint

Protection to:

•

Collect conviction events from your SEPM, and correlate them with events from your other

control points

•

Configure Symantec EDR to proxy reputation requests from your endpoints

•

Send commands to your SEPM (for example, to update your SEPM deny list)

•

Send commands to your endpoints (for example, to delete a file, or quarantine an endpoint)

•

Retrieve information from your SEPM (for example, a list of your endpoints and their online

status)

•

Retrieve information from your endpoints (for example, a dump of all its events)

Configure backups.

Configure one or more backup schedules and locations.

Configure secure access to the

EDR appliance console.

Upload a certificate to encrypt EDR appliance console sessions.

For Inline Block operation, you may

also want to customize the blocking

page.

Blocking pages are used only when you operate in Inline Block mode and scanning is turned on.

When Symantec Endpoint Detection and Response blocks access to a website or prevents the

download of a potentially malicious file, a blocking page appears. The blocking page informs the

user that the page is blocked and who to notify for more information.

Configure the following settings on the 

Settings > Appliance

 page.

Configure Internal Network

settings.

When you define internal networks, you specify which computers are part of your network

and which computers belong to the world outside. With this information, Symantec EDR can

distinguish between protected computers and the computers that are outside of the network.

Configure Network Proxy and

Enterprise Proxy settings, if

these proxies are present in the

environment.

Symantec EDR supports the following types of proxy configurations:

•

A network proxy. Symantec EDR uses a network proxy to access the external network.

•

An enterprise proxy within an enterprise environment. Symantec EDR treats the traffic that

is routed to an enterprise proxy (which may have an IP address within an internal network)

differently than the traffic that is routed through a network proxy.

If you use proxies, each Symantec EDR appliance, whether in CIU, standalone, or scanner role,

must have the IP addresses of existing proxies.

Configure syslog server

connections.

Connect to one or more syslog servers (a SIEM, for example) to capture and report data

externally.

37