Quesions about ENS & ePO

[Jaeseok]

Hi,

I have some questions

1. Is it possible for me to change the ENS firewall policy on all endponits collectively through ePO?

2. There are endpoints in a closed network environment where the Internet is not available.
I'm going to install ePO+ENS+TrelixHX for these endpoints.

In this environment I have a few questions.

 2-1) Is this configuration possible in a closed environment? What should I be careful about when installing for the first time?

 2-2) How can I update the Security-contents (and AV Signature etc..) used by ENS and Trellix HX? Does it support the offline method? If the manual offline method is supported, can this be done through ePO?

 2-3) Because it is a closed-network environment where the Internet is not available, ENS cannot connect with external intelligence such as GTI. In this case, which of the many functions of ENS are constrained?

Thanks. 

[hnegishi]

Hi @Jaeseok 

Thank you for reaching out to our community.

1.

If you are enforcing ENS FW policies at "My Organization"  that is most top group of ePO system tree, you can change the policy setting at once. If not, you need to change each assigned policies.

2.

[Jaeseok]

Thanks for your reply.

can you explain further about my Question 2. ?

Thanks. 

[hnegishi · Accepted solution]

Hi @Jaeseok ]

Sorry I sent it on the way.

2-1,2-2

You can use ENS on the closed network but you need to apply XDAT daily to update AMCore DAT.

You can get V3 DAT from following link.

https://www.trellix.com/en-us/downloads/security-updates.html

2-3

Reputation check on ENS Firewall, Real time Scan on ENS ATP, and OAS/ODS on ENS Threat Prevention will be affected.