cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Rosie10
Level 8
Report Inappropriate Content
Message 1 of 5

Implement MvisionEDR 3.3 .X on McAfee ePO - Policy Configuration

Jump to solution

Hello,

I would like to know if it will be important / necessary to configure exclusions for EDR clients (Windows) that have McAfee product (VSE or ENS) with an exclusion list already configured in the policies of these products.

Please let me know also if there is a guide of best practices to configure our EDR Clients (policy) to save Disk and CPU Usage.

Thank you,

Best Regards

1 Solution

Accepted Solutions
AdithyanT
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 5

Re: Implement MvisionEDR 3.3 .X on McAfee ePO - Policy Configuration

Jump to solution

Hi @Rosie10,

That is an excellent question and the Answer is Yes indeed! We do recommend creating exclusions for folders and process that are absolutely trusted from your end and we recommend doing it under File hashing and trace.

It is important to note that although EDR does work with ENS, it does not honor the exclusions in OAS for it's own working.

So to avoid unnecessary use of disk and space along with CPU usage, we recommend adding exclusions as needed.

If you have machines already impacted by this issue, please help us with it's data folder copy via a Service Request where we can query into the db and understand what folders or processes are indeed using up your resources and suggest exclusions accordingly.

I sincerely hope this helps!

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Adithyan T

View solution in original post

4 Replies
AdithyanT
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 5

Re: Implement MvisionEDR 3.3 .X on McAfee ePO - Policy Configuration

Jump to solution

Hi @Rosie10,

That is an excellent question and the Answer is Yes indeed! We do recommend creating exclusions for folders and process that are absolutely trusted from your end and we recommend doing it under File hashing and trace.

It is important to note that although EDR does work with ENS, it does not honor the exclusions in OAS for it's own working.

So to avoid unnecessary use of disk and space along with CPU usage, we recommend adding exclusions as needed.

If you have machines already impacted by this issue, please help us with it's data folder copy via a Service Request where we can query into the db and understand what folders or processes are indeed using up your resources and suggest exclusions accordingly.

I sincerely hope this helps!

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Adithyan T

View solution in original post

Rosie10
Level 8
Report Inappropriate Content
Message 3 of 5

Re: Implement MvisionEDR 3.3 .X on McAfee ePO - Policy Configuration

Jump to solution

Hello @AdithyanT ,

We are in the process of setting up the EDR, it is already connected with an ePO we have in our lab environment before using it in Prod. This is one of some questions we had that we did not find answer in the documentation directly and we will take your answer into consideration.
If there is a particular case which requires a lot more as you say, we will notify you via an SR.

I have another question about Exclusions, please tell me if i can continue here or another Post.
thank you very much

AdithyanT
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 5

Re: Implement MvisionEDR 3.3 .X on McAfee ePO - Policy Configuration

Jump to solution

Hi @Rosie10,

Apologies for the delay in response. I am glad I could be of help. Please create a new post for new queries!

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Adithyan T
kylekat
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 5 of 5

Re: Implement MvisionEDR 3.3 .X on McAfee ePO - Policy Configuration

Jump to solution

Hello @AdithyanT,

I found your information about exclusions very useful (Great question @Rosie10). Id like to raise the bet and ask the following:

I am trying to figure out a good way to streamline my EDR collection policies. I can't decide what elements to collect and which to disable for systems that are in "normal state". I of course have a policy with all collection enabled (trace, netflows, process history, file hashing, etc.) for a situation in which a system is behaving suspiciously, but which of those are the most resource intensive and maybe recommended to keep turned off when outside an investigation?

I tried to find documentation about best practices, or ways to reduce MVISION EDR processing power on endpoints and servers, but have failed to do so. Can you share any insight on this? (or better yet, other community topics or KBs on the matter?)

Thanks

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community