Implement MvisionEDR 3.3 .X on McAfee ePO - Policy Configuration

[Rosie10]

Hello,

I would like to know if it will be important / necessary to configure exclusions for EDR clients (Windows) that have McAfee product (VSE or ENS) with an exclusion list already configured in the policies of these products.

Please let me know also if there is a guide of best practices to configure our EDR Clients (policy) to save Disk and CPU Usage.

Thank you,

Best Regards

[AdithyanT · Accepted solution]

Hi @Rosie10,

That is an excellent question and the Answer is Yes indeed! We do recommend creating exclusions for folders and process that are absolutely trusted from your end and we recommend doing it under File hashing and trace.

It is important to note that although EDR does work with ENS, it does not honor the exclusions in OAS for it's own working.

So to avoid unnecessary use of disk and space along with CPU usage, we recommend adding exclusions as needed.

If you have machines already impacted by this issue, please help us with it's data folder copy via a Service Request where we can query into the db and understand what folders or processes are indeed using up your resources and suggest exclusions accordingly.

I sincerely hope this helps!

[Rosie10]

Hello @AdithyanT ,

We are in the process of setting up the EDR, it is already connected with an ePO we have in our lab environment before using it in Prod. This is one of some questions we had that we did not find answer in the documentation directly and we will take your answer into consideration.
If there is a particular case which requires a lot more as you say, we will notify you via an SR.

I have another question about Exclusions, please tell me if i can continue here or another Post.
thank you very much

[AdithyanT]

Hi @Rosie10,

Apologies for the delay in response. I am glad I could be of help. Please create a new post for new queries!

[kylekat]

Hello @AdithyanT,

I found your information about exclusions very useful (Great question @Rosie10). Id like to raise the bet and ask the following:

I am trying to figure out a good way to streamline my EDR collection policies. I can't decide what elements to collect and which to disable for systems that are in "normal state". I of course have a policy with all collection enabled (trace, netflows, process history, file hashing, etc.) for a situation in which a system is behaving suspiciously, but which of those are the most resource intensive and maybe recommended to keep turned off when outside an investigation?

I tried to find documentation about best practices, or ways to reduce MVISION EDR processing power on endpoints and servers, but have failed to do so. Can you share any insight on this? (or better yet, other community topics or KBs on the matter?)

Thanks