Migration from VSE to ENS

[ryan190]

Hi

I have been using ENS are years now but there are still a few very sensitive servers that I have running VSE

Im worried that if I install ENS it will block a few processes that could have a huge knock on.

Is there a way I can install ENS and have it enter a "allow all" state but still create logs that "would have blocked" if they were using a different set of rules?

VSE had this and i could see in the logs lots of "would have blocked" 

[rfranci]

Hi @ryan190 ,

Thank you for reaching us on community!

I would first recommend, migrating VSE policies to ENS by using 'endpoint upgrade assistance'. This would ensure that the same settings in VSE policies are configured for ENS as well . once the policy is migrated, you can assign this to the servers that you wish to upgrade from VSE  to ENS.

Also, i would recommend to check the VSE to ENS policy mapping o understand the policy migration :
https://docs.mcafee.com/bundle/endpoint-security-10.5.0-migration-guide-epolicy-orchestrator-windows...

In case if you want to just the current ENS policy to work with "would have blocked" event, you can enable "report " only for all the rules in ENS - > Access protection policy and ENS -> exploit prevention policy . But, do note that this could be a major security risk to change all rules to "allow ".

I hope you find this helpful!
- Rohit Francis