Create Decoy Files to help detect ransomware


I have deployed the EDR Core client on all machines running side by side with our Heimdal Security solution. All directories and processes from each other security vender is excluded from scanning.

As soon as the EDR Core client is installed, minimize and maximize windows, ecpecially in Outlook is painful slow, but also Chrome/Edge fanes becomes sluggish besides other application processes.

I have now disabled Create Decoy Files to help detect ransomware which seems to have helped enormuos for the better.

Any idea why this features does this?



  • Options
    David_CarroDavid_Carro WatchGuard Representative

    Hello Robert,

    Please send the EDR core version running on your devices.
    Also check if there is an upgrade available:
    Access the online console for the EDR core.
    At the top right there is a bell, and it might be having some notifications available.
    check if you can upgrade to the latest available on your console.
    Once upgraded (if available), create a copy of the profile, on the copy activate the decoy files, and apply that profile to one troubled device.
    check if solved, and if it is not solved, write back with the EDR version installed on that device.

    Kind regards


    David Carro | Technical support
    WatchGuard Technologies, Inc. | www.watchguard.com

  • Options

    Hi @David_Carro

    I believe, i am running the last and greatest, no updates available.

    Agent version 1.20.0000


Sign In to comment.