TDR and Trend Micr Integratin Guide
i WatchGuard Technlgies, Inc.
TDR and Trend Micr Deplyment Overview Threat Detectin and Respnse (TDR) is a cllectin f advanced malware defense tls that crrelate threat indicatrs frm Firebxes and Hst Sensrs t enable real-time, autmated respnse t stp knwn, unknwn, and evasive threats. As part f the TDR slutin, yu install TDR Hst Sensrs t prvide endpint prtectin. In sme cases, the TDR Hst Sensr might have cnflicts with the antivirus sftware installed n yur endpints. T reslve this issue, yu can cnfigure exclusins in the antivirus sftware and in TDR. This dcument includes infrmatin abut the integratin f a TDR Hst Sensr with a hst that runs Trend Micr sftware. It des nt describe the prcedure t set up Threat Detectin and Respnse. Fr infrmatin abut hw t set up yur TDR accunt, hw t enable TDR n a Firebx, and hw t install a Hst Sensr, see Quick Start Set Up Threat Detectin and Respnse. TDR and Trend Micr Integratin Guide 1
Integratin Summary Exclusins in TDR fr Trend Micr Wrry-Free Business Security Services Fr Windws: C:\Prgram Files (x86)\trend Micr\ C:\Prgram Files\Trend Micr\ Exclusins in TDR fr Trend Micr Wrry-Free Business Security Services Fr Mac: /Library/Applicatin Supprt/TrendMicr Exclusins in TDR fr Trend Micr Smart Prtectin fr Endpint Suite Fr Windws: C:\Prgram Files (x86)\trend Micr\ C:\Prgram Files\Trend Micr\ Exclusins in TDR fr Trend Micr OfficeScan and Security fr Mac plug-in prgrams Fr Mac: Nt needed Exclusins in TDR fr Trend Micr Endpint Sensr Fr Windws: C:\Prgram Files\Trend Micr\ Exclusins in Trend Micr Wrry-Free Business Security Services Trend Micr Smart Prtectin fr Endpint Suite fr the TDR Hst Sensr Fr Windws: C:\Prgram Files (x86)\watchguard\threat Detectin and Respnse\ C:\Prgram Files\WatchGuard\Threat Detectin and Respnse\ Exclusins in Trend Micr Endpint Sensr fr the TDR Hst Sensr Fr Windws: Nt needed Exclusins in Trend Micr Wrry-Free Business Security Services fr the TDR Hst Sensr Fr Mac: /usr/lcal/watchguard/tdr/amd64/hst_sensr Exclusins in Trend Micr OfficeScan and plug-in prgrams Security fr Mac fr the TDR Hst Sensr Fr Mac: /usr/lcal/watchguard If the Hst Sensr and Trend Micr sftware detect and respnd t a threat at the same time, this can cause high utilizatin f system resurces such as CPU, memry, and disk I/O. Trend Micr Endpint Sensr des nt have a versin fr Mac. 2 WatchGuard Technlgies, Inc.
Cnfiguratin Details T cmplete this deplyment, yu must have: An active Threat Detectin and Respnse subscriptin with Hst Sensr licenses TDR Hst Sensr 5.2.1.8015 Firebx with Fireware v12.0 r higher Trend Micr Wrry-Free Business Security Services (Windws): Trend Micr Wrry-Free Business Security Services Agent 6.2.1169 Trend Micr Smart Prtectin fr Endpint Suite (Windws): Trend Micr OfficeScan XG Agent 12.0.4345 Service Pack 1 Trend Micr Vulnerability Prtectin Agent 2.0 Trend Micr Endpint Encryptin 6.0.0.1070 Trend Micr Wrry-Free Business Security Services (Mac): Trend Micr Security 2.0.1291 Trend Micr OfficeScan and plug-in prgrams Security fr Mac 3.0.3079 Trend Micr Endpint Sensr 1.6.0.3107 The Windws test envirnment fr this deplyment included: Windws 7, 8, 10 Enterprise 64-bit Operating System Memry (RAM) 8 GB Prcessr 2 CPU Cres The Windws test envirnment t test Trend Micr Smart Prtectin fr Endpint Suite, included: Windws Server 2012r 64-bit Operating System Memry (RAM) 10 GB Prcessr 2 CPU Cres The Mac test envirnment fr this deplyment included: macos 10.13 Memry (RAM) 8 GB Prcessr Intel cre i5 TDR and Trend Micr Integratin Guide 3
Cnfigure Exclusins in TDR In yur TDR accunt, add the exclusins t manually identify paths fr files and prcesses that yu d nt want Hst Sensrs t mnitr. Befre yu deply a Hst Sensr n cmputers that have Trend Micr installed, add exclusins fr the Trend Micr file paths as TDR Exclusins in yur TDR accunt. T exclude Trend Micr directries, add exclusins with these paths in yur TDR accunt. Flders specified in an exclusin must end with a backslash. Exclusins fr Windws: C:\Prgram Files (x86)\trend Micr\ C:\Prgram Files\Trend Micr\ Exclusins fr Mac (Trend Micr Wrry-Free Business Security Services): /Library/Applicatin Supprt/TrendMicr/ Exclusins fr Trend Micr Endpint Sensr: C:\Prgram Files\Trend Micr\ T add an exclusin in TDR: 1. Lg in t yur TDR accunt r managed accunt as a user with Operatr privileges. 2. Select Cnfiguratin > Exclusin. 3. Click Add Exclusin. The Add Exclusin dialg bx appears. 4. In the Path text bx, type the path t exclude. 5. Click Save. Repeat these steps t add each exclusin. 4 WatchGuard Technlgies, Inc.
Cnfigure Exclusins in Trend Micr Wrry-Free Business Security Services In Trend Micr Wrry-Free Business Security Services, add the exclusins t identify the paths fr files and lcatins t exclude. T prevent cnflicts between the Trend Micr Wrry-Free Business Security Services, we recmmend yu add exclusins in Trend Micr Wrry-Free Business Security Services fr the paths used by the TDR Hst Sensr. T exclude TDR Hst Sensr files n 64-bit Windws add an exclusin fr: C:\Prgram Files (x86)\watchguard\threat Detectin and Respnse\ T add an exclusin in Trend Micr Wrry-Free Business Security Services Fr Windws: 1. Lg in t the WFBS cnsle with yur accunt credentials. 2. Click Devices. A grup tree with all devices and servers appears. 3. Select the grup t cnfigure, click Cnfigure Plicy. 4. In the feature tree, select Antivirus/Anti-spyware. 5. On the Target tab, click [+]next t Exclusins. 6. Select the Enable Exclusins check bx. 7. Make sure the check bx fr D nt scan directries where Trend Micr prducts are installed is selected. 8. T exclude specific flders r directries, under D nt scan the fllwing directries, type the directry path, and then click Add. 9. Click Save. T exclude TDR Hst Sensr files n macos add an exclusin fr: /usr/lcal/watchguard/tdr/amd64/hst_sensr T add an exclusin in Trend Micr Wrry-Free Business Security Services Fr Mac: 1. Lg in t the WFBS cnsle with yur accunt credentials. 2. Click Devices. A grup tree with all devices and servers appears. 3. Select the grup that yu want t cnfigure. 4. In the right panel, click Cnfigure Plicy. 5. Click the Mac table. 6. In the feature tree, click Antivirus/Anti-spyware. 7. Under Exclusins, select the Enable Exclusinscheck bx. 8. Click Addt add the exclusin. TDR and Trend Micr Integratin Guide 5
Cnfigure Exclusins in Trend Micr Smart Prtectin fr Endpints Suite In Trend Micr Smart Prtectin fr Endpints Suite, add the exclusins t identify the paths fr files and lcatins t exclude. T prevent cnflicts between the Trend Micr Smart Prtectin fr Endpints Suite, we recmmend yu add exclusins in Trend Micr Smart Prtectin fr Endpints Suite fr the paths used by the TDR Hst Sensr. The Suite is deplyed n a server integrated with several prduct managers, yu shuld deply the agents via the managers r add cmputers t the managers. The prduct yu shuld add exclusins fr is OfficeScan XG. T exclude TDR Hst Sensr files n 64-bit Windws add an exclusin fr: C:\Prgram Files (x86)\watchguard\threat Detectin and Respnse\ There are tw methds t add an exclusin in OfficeScan XG. The first methd is t set the unlck passwrd (r set n passwrd) thrugh the web cnsle r unlck the agent n the endpint, then add exclusins. The secnd methd is t add exclusins in the OfficeScan XG web cnsle. We recmmend that yu add exclusins in the web cnsle: T add exclusin in the web cnsle: 1. Lg in t the OfficeScan XG web cnsle. 2. Select Agents > Agent Management. 3. T shw the endpints, in the left panel, duble-click yur dmain. 4. Chse the endpints t manage, and right-click the endpints. 5. Select Settings > Scan Settings > Real-Time Scan Settings. 6. Click Scan Exclusins. 7. Select Enable scan exclusin and Apply scan exclusin settings t all scan types. 8. In the Scan Exclusin List (Directries) panel, select Exclude directries where Trend Micr prducts are installed. 9. In the text bx, type the exclusin paths. Fr each path t add, click [+] nce and type a new path. 10. Click Save. T exclude TDR Hst Sensr files n macos add an exclusin fr: /usr/lcal/watchguard T add an exclusin in Trend Micr OfficeScan and Security plug-in prgrams fr Mac: 1. Lg in t the OfficeScan XG web cnsle. 2. Select Plug-ins n the tp. 3. Belw Trend Micr Security fr Mac, click Manage Prgram. 4. At the tp, click Agents. 5. Select the agent yu want t cnfigure. 6. Select Settings > Scan Exclusin Settings. 7. Belw Scan Exclusin List (File Extensins), in the Exclusins text bx, type the path. 8. Click Add. Fr infrmatin abut the integratin testing methdlgy, see TDR Testing Methdlgy. 6 WatchGuard Technlgies, Inc.
Abut This Guide Guide Type Dcumented Integratin WatchGuard r a Technlgy Partner has prvided dcumentatin demnstrating integratin. Guide Details WatchGuard prvides integratin instructins t help ur custmers cnfigure WatchGuard prducts t wrk with prducts created by ther rganizatins. If yu need mre infrmatin r technical supprt abut hw t cnfigure a third-party prduct, see the dcumentatin and supprt resurces fr that prduct. Infrmatin in this guide is subject t change withut ntice. Cmpanies, names, and data used in examples herein are fictitius unless therwise nted. N part f this guide may be reprduced r transmitted in any frm r by any means, electrnic r mechanical, fr any purpse, withut the express written permissin f WatchGuard Technlgies, Inc. Guide revised: 2/8/2018 Cpyright, Trademark, and Patent Infrmatin Cpyright 1998 2018 WatchGuard Technlgies, Inc. All rights reserved. All trademarks r trade names mentined herein, if any, are the prperty f their respective wners. Cmplete cpyright, trademark, patent, and licensing infrmatin can be fund in the Cpyright and Licensing Guide, available nline at http://www.watchguard.cm/wgrd-help/dcumentatin/verview. Abut WatchGuard WatchGuard Technlgies, Inc. is a glbal leader in netwrk security, prviding best-in-class Unified Threat Management, Next Generatin Firewall, secure Wi-Fi, and netwrk intelligence prducts and services t mre than 75,000 custmers wrldwide. The cmpany s missin is t make enterprisegrade security accessible t cmpanies f all types and sizes thrugh simplicity, making WatchGuard an ideal slutin fr Distributed Enterprises and SMBs. WatchGuard is headquartered in Seattle, Washingtn, with ffices thrughut Nrth America, Eurpe, Asia Pacific, and Latin America. T learn mre, visit WatchGuard.cm. Fr additinal infrmatin, prmtins and updates, fllw WatchGuard n Twitter, @WatchGuard n Facebk, r n the LinkedIn Cmpany page. Als, visit ur InfSec blg, Secplicity, fr real-time infrmatin abut the latest threats and hw t cpe with them at www.secplicity.rg. Address 505 Fifth Avenue Suth Suite 500 Seattle, WA 98104 Supprt www.watchguard.cm/supprt U.S. and Canada +877.232.3531 All Other Cuntries +1.206.521.3575 Sales U.S. and Canada +1.800.734.9905 All Other Cuntries +1.206.613.0895 TDR and Trend Micr Integratin Guide 7