TDR and ESET Endpint Integratin Guide
i WatchGuard Technlgies, Inc.
TDR and ESET Endpint Deplyment Overview Threat Detectin and Respnse (TDR) is a cllectin f advanced malware defense tls that crrelate threat indicatrs frm Firebxes and Hst Sensrs t enable real-time, autmated respnse t stp knwn, unknwn, and evasive threats. As part f the TDR slutin, yu install TDR Hst Sensrs t prvide endpint prtectin. This dcument includes infrmatin abut the integratin f a TDR Hst Sensr with a hst that runs ESET Endpint. This dcument des nt describe the prcedure t set up yur Threat Detectin and Respnse accunt. Fr infrmatin abut hw t set up yur TDR accunt, TDR deplyment best practices, and hw t enable TDR n a Firebx, see Quick Start Set Up Threat Detectin and Respnse. Integratin Summary T avid cnflicts between the TDR Hst Sensr and ESET Endpint, add these exclusins: Exclusin in TDR fr ESET Endpint Fr Windws: C:\Prgram Files\ESET\ C:\Prgram Files(x86)\ESET\ C:\PrgramData\ESET\ Exclusins in TDR fr ESET Endpint Fr Mac: /Applicatins/ESET Endpint Security.app /Library/Applilcatin Supprt/ESET/ /private/var/flders/zz/zyxvpxvq6csfxvn_ n0000000000000/c/pkinstallsandbxmanager/*.activesandbx/rt/applicatins/eset Endpint Security.app/ Exclusin in ESET Endpint fr TDR Hst Sensr Fr Windws: 64-bit Windws C:\Prgram Files (x86)\watchguard\threat Detectin and Respnse\ 32-bit Windws C:\Prgram Files\WatchGuard\Threat Detectin and Respnse\ Exclusin in ESET Endpint fr TDR Hst Sensr Fr Mac: /usr/lcal/watchguard If the Hst Sensr and ESET detect and respnd t a threat at the same time, this can cause high utilizatin f system resurces such as CPU, Memry, and Disk I/O. TDR and ESET Endpint Integratin Guide 1
Cnfiguratin Details T cmplete this deplyment, yu must have: An active Threat Detectin and Respnse subscriptin with Hst Sensr licenses TDR hst sensr 5.2.1.8015 Firebx with Fireware v12.0 r higher ESET Endpint Security 6.6.2046.0 ESET Endpint Antivirus 6.6.2046.0 The Windws test envirnment fr this deplyment included: Windws 7, 8,10 Enterprise 64-bit Operating System Memry (RAM) 8 GB Prcessr 2 CPU Cres The Mac test envirnment fr this deplyment included: Sierra versin 10.13.2 Memry (RAM) 8 GB Prcessr 2.6 GHz Intel Cre i5 2 WatchGuard Technlgies, Inc.
Cnfigure Exclusins in TDR In yur TDR accunt, add the exclusins t manually identify paths fr files and prcesses that yu d nt want Hst Sensrs t mnitr. The Hst Sensr and ESET Endpint bth detect and prevent threats. T prevent cnflicts between the Hst Sensr and ESET Endpint, we recmmend add an exclusin in TDR. Exclusins fr Windws: C:\Prgram Files\ESET\ C:\Prgram Files(x86)\ESET\ C:\PrgramData\ESET\ Exclusins fr Mac: /Applicatins/ESET Endpint Security.app /Library/Applilcatin Supprt/ESET/ /private/var/flders/zz/zyxvpxvq6csfxvn_ n0000000000000/c/pkinstallsandbxmanager/*.activesandbx/rt/applicatins/eset Endpint Security.app/ T add an exclusin in TDR: 1. Lg in t yur TDR accunt r managed accunt as a user with Operatr privileges. 2. Select Cnfiguratin > Exclusin. 3. Click Add Exclusin. The Add Exclusin dialg bx appears. 4. In the Path text bx, type the path t exclude. 5. Click Save & Clse. TDR and ESET Endpint Integratin Guide 3
Cnfigure Exclusins in ESET Endpint In ESET Endpint add the exclusins t identify the paths fr files and lcatins t exclude. T prevent cnflicts between the Hst Sensr and ESET Endpint, we recmmend yu add exclusins in ESET Endpint fr the paths used by the TDR Hst Sensr. T exclude TDR Hst Sensr files n 64-bit Windws add an exclusin fr: C:\Prgram Files (x86)\watchguard\threat Detectin and Respnse T add an exclusin in ESET Endpint fr Windws: 1. Select Setup n the left panel. 2. Click Advanced setup. The Advanced setup page appears. 3. Select Web and Email, n the left panel. 4. Expand Excluded applicatins n right panel. 5. Click Edit. The Excluded applicatins page appears. 6. Click Add. Click Brwse t g t the Hst Sensr path. 7. Select hst_sensr.exe. 8. Click OK. T exclude TDR Hst Sensr files n macos add an exclusin fr: /usr/lcal/watchguard T add an exclusin in ESET Endpint fr macos: 1. Click ESET > Prferences. 2. Click Startup Prtectin > Setup. 3. Select Exlusins and add the TDR path. 4. Click OK. Fr infrmatin abut the integratin testing methdlgy, see TDR Testing Methdlgy. 4 WatchGuard Technlgies, Inc.
Abut This Guide Guide Type Dcumented Integratin WatchGuard r a Technlgy Partner has prvided dcumentatin demnstrating integratin. Guide Details WatchGuard prvides integratin instructins t help ur custmers cnfigure WatchGuard prducts t wrk with prducts created by ther rganizatins. If yu need mre infrmatin r technical supprt abut hw t cnfigure a third-party prduct, see the dcumentatin and supprt resurces fr that prduct. Infrmatin in this guide is subject t change withut ntice. Cmpanies, names, and data used in examples herein are fictitius unless therwise nted. N part f this guide may be reprduced r transmitted in any frm r by any means, electrnic r mechanical, fr any purpse, withut the express written permissin f WatchGuard Technlgies, Inc. Guide revised: 2/6/2018 Cpyright, Trademark, and Patent Infrmatin Cpyright 1998 2018 WatchGuard Technlgies, Inc. All rights reserved. All trademarks r trade names mentined herein, if any, are the prperty f their respective wners. Cmplete cpyright, trademark, patent, and licensing infrmatin can be fund in the Cpyright and Licensing Guide, available nline at http://www.watchguard.cm/wgrd-help/dcumentatin/verview. Abut WatchGuard WatchGuard Technlgies, Inc. is a glbal leader in netwrk security, prviding best-in-class Unified Threat Management, Next Generatin Firewall, secure Wi-Fi, and netwrk intelligence prducts and services t mre than 75,000 custmers wrldwide. The cmpany s missin is t make enterprisegrade security accessible t cmpanies f all types and sizes thrugh simplicity, making WatchGuard an ideal slutin fr Distributed Enterprises and SMBs. WatchGuard is headquartered in Seattle, Washingtn, with ffices thrughut Nrth America, Eurpe, Asia Pacific, and Latin America. T learn mre, visit WatchGuard.cm. Fr additinal infrmatin, prmtins and updates, fllw WatchGuard n Twitter, @WatchGuard n Facebk, r n the LinkedIn Cmpany page. Als, visit ur InfSec blg, Secplicity, fr real-time infrmatin abut the latest threats and hw t cpe with them at www.secplicity.rg. Address 505 Fifth Avenue Suth Suite 500 Seattle, WA 98104 Supprt www.watchguard.cm/supprt U.S. and Canada +877.232.3531 All Other Cuntries +1.206.521.3575 Sales U.S. and Canada +1.800.734.9905 All Other Cuntries +1.206.613.0895 TDR and ESET Endpint Integratin Guide 5