Questions about the ENS 10.7 Update

[User85411543]

With our National Deployment of ENS 10.7.0 (ENS Security Platform 10.7.0.1675 and ENS Threat Prevention 10.7.0.1705) we have received the following inquiries from one of our IT Security shops. Questions/Concerns from the IT Security shop: I have reviewed your responses below and also taken time to review the release notes for the updated software and I would like to clarify some of the details related to the new functions / capabilities/ bug fixes. Questions in Green with supporting text from the McAFee documentation. 1. Can you let us know what the status of testing has been up to now and if data was examined from outside Fitz? 2. Can you clarify how performance impact was monitored? I ask because I think we were just talking about issues with performance over the past months on the VMs so I am wondering if these will see improvement or more performance impacts? 3. Are the updates expected to be collected directly from McAfee servers or from the internal servers, or both depending on the status of the device? Features for 10.7.+ Advanced Detection and Remediation extension — View Story Graph and remediation data reported by the Advanced Detection and Remediation extension that's now included in the Endpoint Security installation package. The Story Graph is a visual representation of events leading up to a detected threat. 4. Have there been significant network bandwidth usage or endpoint resource increases in existing testing? This seems like a much heavier use of data locally. Is this data then sent up to ePO or is this “Story Graph” generated again on ePO independently? I have other questions that I will be attaching to the SR

[yaz]

Hi @User85411543 

Thank you for reaching out to community. 

Please find the answers below. 

1. Can you let us know what the status of testing has been up to now and if data was examined from outside Fitz?

Answer: Testing of the products will be carried out by our Engineering. This depends on the product issues and customer environments. 

2. Can you clarify how performance impact was monitored? I ask because I think we were just talking about issues with performance over the past months on the VMs so I am wondering if these will see improvement or more performance impacts?

Answer: As far as the performance issues are concerned, this will depend on the environment. However from engineering perspective we ensure proper testing and internal coding is done to address performance issues to the least. 

3. Are the updates expected to be collected directly from McAfee servers or from the internal servers, or both depending on the status of the device? Features for 10.7.+ Advanced Detection and Remediation extension — View Story Graph and remediation data reported by the Advanced Detection and Remediation extension that's now included in the Endpoint Security installation package. The Story Graph is a visual representation of events leading up to a detected threat.

Answer: This depends on the configuration you set it up on the environment. Story Graph feature is introduced from ENS 10.7 and will need to configure if you are running on ENS 10.6.1. Kindly refer to the KB below. 

https://kc.mcafee.com/corporate/index?page=content&id=KB92289&locale=en_US

4. Have there been significant network bandwidth usage or endpoint resource increases in existing testing? This seems like a much heavier use of data locally. Is this data then sent up to ePO or is this “Story Graph” generated again on ePO independently? I have other questions that I will be attaching to the SR

Answer: Story Graph relates to the Events in the ePO. kindly refer to the document below. 

https://docs.mcafee.com/bundle/endpoint-security-10.7.x-common-product-guide-windows/page/GUID-5B58D...

The document above gives information on what data it collects and what are the details that is present. 

You can disable story graph as well if needed and monitor performances. 

If SR is already open, can you share those details. 

Was my reply helpful?

If yes, please give me a Kudo. If I have answered your query, kindly mark this as solution, so that together we help other community members.