Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 24 additions & 6 deletions docs/endpointprotector/5.9.4.2/admin/agent.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,25 +13,37 @@ You can download the Endpoint Protector Agent directly from the Endpoint Protect
information about downloading the Endpoint Protector Agent, refer to the
[Client Software](/docs/endpointprotector/5.9.4.2/admin/systemconfiguration/overview.md#client-software) topic.

**NOTE:** You can use tools like Active Directory or JAMF to deploy the Endpoint Protector Agent in
:::note
You can use tools like Active Directory or JAMF to deploy the Endpoint Protector Agent in
large networks.
:::

**NOTE:** Starting with Endpoint Protector Server version 5.8.0.0, an additional security feature is

:::note
Starting with Endpoint Protector Server version 5.8.0.0, an additional security feature is
available to protect the integrity of the Agent. This feature, accessible via Device Control on the
Global Settings page, is known as the Tamper Mode setting. It is designed to prevent unauthorized
termination or modification of the Endpoint Protector Agent.
:::


## Agent Installation

For Windows and Mac, your input in installing the Endpoint Protector Agent is minimal. The
Installation folder and Server information are already pre-configured, and downloadable from the
Endpoint Protector Server.

**NOTE:** For Linux installation instructions, read the readmeLinux.txt file available under the Read
:::note
For Linux installation instructions, read the readmeLinux.txt file available under the Read
this before installing link.
:::


**NOTE:** You can also install the Agent from a repository for Endpoint Protector Linux Agents
:::note
You can also install the Agent from a repository for Endpoint Protector Linux Agents
starting with version 1.4.0.4., as described in the topic below.
:::


The following are several examples of supported distributions:

Expand Down Expand Up @@ -124,11 +136,14 @@ and **allow** the Endpoint Protector Client Extension.

At this point, the macOS Endpoint Protector Client installation is completed.

**NOTE:** If EPPNotifier is not visible or notifications do not display after the installation or
:::note
If EPPNotifier is not visible or notifications do not display after the installation or
upgrade of the Endpoint Protector Client on macOS, please resolve this issue by restarting your
machine. In situations where the Endpoint Protector Client is installed and then uninstalled on
macOS, you may still see EPPNotifier in the Notification settings. To remove it from the list, simply
right-click and select "Reset notifications."
:::


### Debian Based Distributions

Expand Down Expand Up @@ -210,5 +225,8 @@ This could be:
- `wsl.exe --help` – This entry will target the specific command `wsl.exe --help`.
- `wsl --list`– This entry will target the `wsl --list` command.

**NOTE:** Endpoint Protector Client cannot directly control the usage of WSL Bash command-line tools
:::note
Endpoint Protector Client cannot directly control the usage of WSL Bash command-line tools
on Windows.

:::
15 changes: 12 additions & 3 deletions docs/endpointprotector/5.9.4.2/admin/alerts.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,12 @@ sidebar_position: 100
From this section, you can define E-mail Alerts for the main events detected by Endpoint Protector:
System Alerts, Device Control Alerts, Content Aware Alerts, and Enforced Encryption Alerts.

**NOTE:** Before creating alerts, make sure the Endpoint Protector E-mail Server Settings have been
:::note
Before creating alerts, make sure the Endpoint Protector E-mail Server Settings have been
configured from the System Configuration, System Settings section. You also have the option to verify
these settings by sending a test E-mail.
:::


For each Administrator to appear in the list of recipients for the Alerts, this has to be provided
under the Administrator details from the System Configuration, System Administrators section.
Expand All @@ -35,8 +38,11 @@ Follow the steps to add a new Alert.
- Updates and Support – set an alert regarding each module’s maintenance status (Device Control,
Content Aware Protection, and eDiscovery)

**NOTE:** You can disable the Update and Support system alert from General Dashboard, System
:::note
You can disable the Update and Support system alert from General Dashboard, System
Status.
:::


- Endpoint Licenses – set an alert to be notified of the percentage of used Endpoint Licenses and
eliminate the risks of having unprotected endpoints as each network is constantly growing. Define
Expand Down Expand Up @@ -136,8 +142,11 @@ Follow the steps to create a content aware alert.

The alert sent on the email will also include a CSV file with a report of the threats found.

**NOTE:** Before creating the alert, ensure the selected Content Aware Policy is enabled on the
:::note
Before creating the alert, ensure the selected Content Aware Policy is enabled on the
chosen Computer, User, Group, or Department.
:::


![Creating a Content Aware Alert](/img/product_docs/endpointprotector/5.9.4.2/admin/alerts/creatingcontentawarealertinfo.webp)

Expand Down
77 changes: 61 additions & 16 deletions docs/endpointprotector/5.9.4.2/admin/appliance.md
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,10 @@ In this section you can set a preferential time zone and/or sync the appliance t
- How often to synchronize – select from the drop-down a time interval when to synchronize of go
with the default selection

**NOTE:** The appliances are prefigured to sync once a week with pool.ntp.org.
:::note
The appliances are prefigured to sync once a week with pool.ntp.org.
:::


- Current server time – the field displays the current server time
- Automatic NTP Synchronization – opt in or out to trigger the NTP synchronization automatically
Expand All @@ -46,8 +49,11 @@ In this section you can set a preferential time zone and/or sync the appliance t
In this section you can change the network settings for the appliance to communicate correctly in
your network.

**NOTE:** Once you change the IP address, close and open again the Internet browser and then access
:::note
Once you change the IP address, close and open again the Internet browser and then access
the Endpoint Protector Administration and Reporting Tool with the new IP address.
:::


![ Change the network settings for the appliance to communicate correctly in your network](/img/product_docs/endpointprotector/5.9.4.2/admin/appliance/ipconfg.webp)

Expand All @@ -63,7 +69,10 @@ From this section, you can register and then verify the Endpoint Protector Clien
signature. The client registration certificate is an additional security measure enabling
certificate-based authentication.

**CAUTION:** The Client Registration Certificate feature is not available for Linux!
:::warning
The Client Registration Certificate feature is not available for Linux!
:::


**Step 1 –** Enable the custom certificate setting and then upload the certificate chain, Root CA and
Intermediate;
Expand All @@ -84,8 +93,11 @@ just for testing the signature (for example the Endpoint Protector Client certi
**Step 3 –** Click **Save** and allow 2 minutes for the information to be validated. You will view a
successful message confirming the custom certificate was added and the test certificate is valid.

**NOTE:** The client registration authentication certificate and the Endpoint Protector server
:::note
The client registration authentication certificate and the Endpoint Protector server
certificate must be issued by the same CA.
:::


For this feature to work, there must be cryptographic identities signed by the root CA deployed on
the endpoints.
Expand All @@ -102,16 +114,25 @@ From this section, you can configure Server Certificate Validation, which ensu
used for all communication requests on Endpoint Protector clients are validated. This feature is
crucial for maintaining secure communication between various Endpoint Protector products.

**NOTE:** All certificate validation statuses will be reported to the Endpoint Protector Server and
:::note
All certificate validation statuses will be reported to the Endpoint Protector Server and
stored for debugging purposes in Endpoint Protector Client logs.
:::

**CAUTION:** Please use this feature responsibly, as improper certificate usage with certification

:::warning
Please use this feature responsibly, as improper certificate usage with certification
validation might disrupt Endpoint Protector Client to Endpoint Protector Server communication. For a
successful connection, both server and client certificate validation must be enabled.
:::


**NOTE:** Starting from the 5.9.0 or later, enabling this option activates Endpoint Protector Server
:::note
Starting from the 5.9.0 or later, enabling this option activates Endpoint Protector Server
Certificate Validation for all Endpoint Protector Client communication. This strengthens security by
ensuring trusted and valid certificates are used.
:::


### Appliance Operations

Expand All @@ -123,7 +144,10 @@ In this section you can perform appliance operations such as Reboot or Shutdown.

In this section you can manage user access to the Appliance through the SSH protocol.

**_RECOMMENDED:_** Set this option to **Enable** before requesting Support access.
:::info
Set this option to **Enable** before requesting Support access.
:::


![Manage user access to the Appliance through the SSH protocol](/img/product_docs/endpointprotector/5.9.4.2/admin/appliance/sshserver.webp)

Expand All @@ -136,7 +160,10 @@ enables Endpoint Protector to transfer activity events to a SIEM server for anal
In this section, you can add, edit or delete an existing SIEM Server integration. To edit or delete
a SIEM Server you need to select an available SIEM server integration.

**CAUTION:** You can configure a maximum number of 4 SIEM Server integrations.
:::warning
You can configure a maximum number of 4 SIEM Server integrations.
:::


![Add, edit or delete an existing SIEM Server integration](/img/product_docs/endpointprotector/5.9.4.2/admin/appliance/siemserverintegration.webp)

Expand All @@ -145,39 +172,54 @@ To create a SIEM Server, click **Add New** and provide the following information
- SIEM Status – toggle switch to enable/disable the SIEM server
- Disable Logging – toggle switch to enable/disable logging

**NOTE:** If you disable logging, logs will be stored on the Endpoint Protector server or on the
:::note
If you disable logging, logs will be stored on the Endpoint Protector server or on the
SIEM server when SIEM is installed.
:::


- Server Name – add a server name
- Server Description – add a description
- Server IP or DNS – add the IP or DNS
- Server Protocol – select the UDP or TCP server protocol

**NOTE:** Based on the protocol you select you can enable [SIEM Encryption](#siem-encryption).
:::note
Based on the protocol you select you can enable [SIEM Encryption](#siem-encryption).
:::


- Server Port – add a port
- Exclude Headers - toggle switch to enable/disable log headers

**NOTE:** If you disable log headers, you will only export data to SIEM.
:::note
If you disable log headers, you will only export data to SIEM.
:::


- Log Types – select from the available options the logs to send to the SIEM Server

![SIEM Intergration - Adding a New Server](/img/product_docs/endpointprotector/5.9.4.2/admin/appliance/siemintegrationnewserver.webp)

**CAUTION:** Please be aware that the SIEM integration feature in Endpoint Protector comes with
:::warning
Please be aware that the SIEM integration feature in Endpoint Protector comes with
certain limitations. To make use of the latest features of this SIEM integration, your environment
must meet specific criteria. It should have been installed from image version 5.6.0.0 or a more
recent version, and maintain an active HTTPS connection. Please note that SIEM integration is only
accessible in environments that meet these stringent prerequisites.
:::


### SIEM Encryption

When using the TCP protocol, you have the option to encrypt communication to each SIEM server. In
order to do so, enable the Encryption setting and then Upload the root CA that was used to sign the
server certificate for the SIEM server in .pem format.

**CAUTION:** The certificate used on the SIEM server must be signed by the same CA as the one
:::warning
The certificate used on the SIEM server must be signed by the same CA as the one
uploaded to the Endpoint Protector Server.
:::


Endpoint Protector will check the following:

Expand All @@ -189,8 +231,11 @@ certificate; if any certificate of the chain is invalid, the connection will b

Make sure you update the certificate files when they expire.

**NOTE:** If you applied the latest patch using the option, and cannot view the SIEM encryption
:::note
If you applied the latest patch using the option, and cannot view the SIEM encryption
setting, please contact Customer Support.
:::


### SIEM Export log formats

Expand Down Expand Up @@ -325,7 +370,7 @@ The standard format for the E-Discovery fields is as follows:

#### Other SIEM Logs

User Login/User Logout
**User Login/User Logout**

The standard format for the Other SIEM Logs fields is as follows:

Expand Down
15 changes: 12 additions & 3 deletions docs/endpointprotector/5.9.4.2/admin/cap_module/capmodule.md
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,11 @@ accidental or intentional file transfers of sensitive company data, such as:
- Confidential files: sales and marketing reports, technical documents, accounting documents, customer
databases, etc.

**CAUTION:** Endpoint Protector cannot scan encrypted files or applications that use encryption to
:::warning
Endpoint Protector cannot scan encrypted files or applications that use encryption to
secure communication.
:::


To prevent sensitive data leakage, Endpoint Protector closely monitors all activity at various exit
points:
Expand All @@ -39,13 +42,19 @@ Content Aware Protection comes as the second level of data protection available
Protector. The module is displayed but requires a simple activation by pressing the Enable button.
If not previously provided, the contact details of the Main Administrator will be required.

**NOTE:** Any details provided will only be used to ensure the Live Update Server is configured
:::note
Any details provided will only be used to ensure the Live Update Server is configured
correctly and that the Content Aware Protection module was enabled successfully.
:::


![The module is displayed but requires a simple activation by pressing the Enable button](/img/product_docs/endpointprotector/5.9.4.2/admin/contentawareprotection/activation.webp)

**NOTE:** The Content Aware Protection module is separate from Device Control or eDiscovery modules,
:::note
The Content Aware Protection module is separate from Device Control or eDiscovery modules,
and requires separate licensing.
:::


## Dashboard

Expand Down
Loading
Loading