Can a stand-alone install of ENS be updated by a ePO

[ScootyPuffJr]

Needing to have multiple instances of ENS that can't be connected to the internet or have connection to a server with an instance of an ePO. Wondering if an ePO could be installed on a laptop that will also never be connected to the internet, but a portable hard drive connected to a internet connected device to move packages to the laptop ePO, then using  package designer to alter the package for exactly what is wanted. That then could be connected to the standalone ENS to update. Is this possible or am I dreaming?

[Pravas]

Hi @ScootyPuffJr ,

You may use Package Designed to customize a ENS installer. Then use Standalone V3 AmCore to have them update manually.

Thanks

[ueno]

Hi @ScootyPuffJr .

Thank you for reaching out our community. 

I am not sure I understand exactly what you want to do this time, but please note that Package Designer can only be used on systems with a stand-alone ENS installed. please refer KB86438 about Package Designer.

And If you install ENS with the standalone installer, you can still update ENS with ePO afterwards by putting the installed Trellix (McAfee) Agent into administrative mode. Please see the product guide below for instructions on how to put the Trellix (McAfee) Agent into administrative mode.

[Change from unmanaged to managed mode on Windows systems]
https://docs.trellix.com/bundle/agent-5.7.x-product-guide/page/GUID-B66FC65A-B4CE-4077-94CB-64F7826E...

If your system configuration is a bit more complex, there are limits to what the community can do, so please contact us by a Service Request.

[ScootyPuffJr]

Ok I understand my mistake, the package designer is for tailoring what is included in an install of standalone ENS. A laptop with epo installed and trillex agent could have a dat given to it for updating the definitions of each of the standalone ens. If not all of the definitions are wanted, could the dat file be altered to remove definitions that interfere with the software on the devices with the ens?

[Pravas]

Hi @ScootyPuffJr ,

I believe you're referring to False Detection. If any file is incorrectly flagged by ENS, you're requested to submit it as Sample and its relevant logs for analysis.

We should be able to suppress the detection if appropriate and issue an EXTRA DAT 

Please refer the section Suspected False Positive in the link KB below.

https://kcm.trellix.com/corporate/index?page=content&id=KB91459

Thanks

[ScootyPuffJr]

More like whitelisting or blacklisting. The standalone devices have sensitive programs that may not function correctly if AV interferes. Could we ask that certain parts of the definitions be ignored completely?

[ueno]

Hi @ScootyPuffJr ,

I cannot answer precisely because I do not know what exactly "parts of the definitions" is, but if you are concerned that ENS functions may affect, I would recommend it if you could disable each ENS function and check its steps according to the following KB.

Troubleshoot if Endpoint Security blocks third-party applications (trellix.com)

[ScootyPuffJr]

Can certain definitions be blacklisted/whitelisted in the event that those specific definitions prevent a program function. So removing part of a definition list, not a part of a definition. Sorry for the confusion.

[ueno]

Hi @ScootyPuffJr ,

I think that that is probably not feasible in ENS, but since your question is going to be a bit complicated, I think it would be best to get the details in Service Request.

[Pravas]

Hi @ScootyPuffJr ,

You may reach out to application vendor to discuss necessary exclusions. It helps to avoid any issues that the application may suffer due to a scan.

Incase you're unsure about the application behavior, its best to run it on a test machine and monitor for any issues.

Thanks.