Endpoint Detection and Response (EDR)
The Endpoint Detection and Response (EDR) feature is an event correlation component, capable of identifying advanced threats or in-progress attacks. As part of our comprehensive and integrated Endpoint Protection Platform, EDR brings together device intelligence across your enterprise network. This solution comes in aid of your incident response teams' effort to investigate and respond to advanced threats.
Important
The capabilities of the EDR feature may differ depending on the license included in your current plan.
Endpoint Detection and Response (EDR) is a lightweight solution that enables you to:
Detect activity that evades classic endpoint prevention mechanisms.
Take actions to eliminate vulnerabilities and eliminate the risk of recurrent attacks.
This provides you with easy-to-follow response workflows that enable incident response teams to limit lateral spread and stop ongoing attacks.
When installed in your environment as an independent endpoint detection and response solution, BitdefenderEDR is compatible with, and enhances any pre-installed Endpoint Protection Platform (EPP). It also provides you with flexible deployment options that can easily be upgraded to Managed Detection and Response services.
Components
eXtended Detection and Response is dependent on the following components:
GravityZone Virtual Appliance
Security agent (Windows)
Configure and install the feature
To start using this feature, follow the steps below:
Important
If your endpoints already have the BEST agent deployed, you can use a reconfigure client task to add the module to the endpoint. If no agent is installed, you will need to use an installation package to deploy BEST on your endpoints along with all required modules.
Below we have included both procedures.
Go to the Installation packages page.
Click the Create button in the upper-right side of the screen.
Type in the Name and Description for the new installation package.
Select the modules you wish to deploy.
Note
Make sure you include the EDR Sensor module.
Click Save.
Select the newly created package from the list of packages and click Send download links.
Enter the email addresses of the recipients and click Send.
Policies are used to enable and configure features both on endpoints and in terms of general functionality. Apply the following changes to the policy of your choice:
Go to the Policies page.
Edit the policy you want applied to the endpoints that use this feature.
Note
Alternatively, you can create a new policy.
Under Incident Sensors , enable the module.
Save your policy.
If you created a new policy, apply it on the endpoints where the feature is deployed:
Go to the Network page.
Select the endpoints you want to apply the policy to.
Click the
Assign Policy button at the upper side of the table.Select the policy you want to apply.
Click Finish.
Note
For more information, refer to Assigning device policies
If you have edited an existing policy, make sure it is applied to all endpoints where the feature is deployed.
This will ensure that the feature is enabled and configured to best suit your company's needs.