Symantec
™
Endpoint Detection and Response 4.5 Installation Guide for the S550
appliance
Task
Description
Setup sandboxing services.
By default, Symantec EDR submits files to Symantec’s Cynic cloud-based malware detonation
system for analysis. However, you can keep file analysis local and submit your files to a
customer-owned, on-premises Symantec Malware Analysis appliance for detonation and
analysis.
Enable scanning
After you configure the appliance settings, you'll want to enable scanning.
Configure the following settings on the
Settings > Users
page.
Add new EDR appliance console
accounts.
Add additional Admin, Controller, and User accounts for accessing the EDR appliance console.
Tip:
As a best practice, you should set up at least one additional Admin user account
immediately after installation in case there's an issue accessing the EDR appliance console with
the initial Admin account credentials.
Configure the following settings on the
Reports
page.
Set up reports.
Set up the reports that can be generated on a daily, weekly, or monthly schedule.
Testing Symantec EDR for successful monitoring or blocking
Symantec has a website that you can use to test that Symantec Endpoint Detection and Response monitors network data.
1. Open a web browser on a computer in the LAN that is connected to Symantec EDR.
2. On the Internet, go to the following URL:
The Broadcom website should display normally without any messages.
3. On the Internet, go to the following URL:
4. Click on each of the links on the test page.
You should see a corresponding incident in the database, whether you are in Tap mode or Inline Monitor mode. Cloud-
based sandboxing detections may be delayed during virtual execution.
If you are in Inline Block mode, file downloads (except the cloud-based sandbox new file submission) are interrupted.
Subsequent attempts to download the same file are denied.
About operating roles, operating modes, and network connections
Testing the appliance bypass mode
When the Symantec Endpoint Detection and Response appliance is in Inline mode, the appliance enters bypass mode
if it cannot function or is turned off. In bypass mode, Internet traffic is routed through the LAN port and the WAN port, but
no monitoring or blocking occurs. For bypass mode to function properly, ensure that you use the proper type of Ethernet
cables to connect to the LAN. LEDs on the back of the appliances indicate bypass mode if the appliance is not turned off.
NOTE
In the bypass mode, the Ethernet cables on the LAN port and the WAN port are interconnected. You must
ensure that the total length of the interconnected cables does not exceed the maximum Ethernet cable
length. The Ethernet cable length per ANSI/TIA/EIA cabling standards is 100m for Cat5e and Cat6. For more
information on the Ethernet cable length, refer the ANSI/TIA/EIA cabling standards.
To test the physical appliance bypass mode
1. On the left navigation pane, click
Settings > Appliances
, and then click on an appliance in the list.
The Appliance details page appears.
38
Summary of Contents for Symantec S550
Page 1: ...Symantec Endpoint Detection and Response 4 5 Installation Guide for the S550 appliance ...
Page 17: ...Symantec Endpoint Detection and Response 4 5 Installation Guide for the S550 appliance 17 ...
Page 18: ...Symantec Endpoint Detection and Response 4 5 Installation Guide for the S550 appliance 18 ...
Page 49: ......
