Moving from old TDR to new EDR Core
Now that WG is leaving TDR and moving the TDR users to the new EDR Core product, I was wondering if WG is planning on a instructional webinar or video series to help the new EDR users?
My TDR clients are now all running EDR using the default values, and I assume they are protected using these defaults.
One of these default values that is enabled is the maximum number of MBs that can be transferred in an hour. The default is 50.
For fun I copied a 3 gig .iso file from a file server to my pc, then back again. It copied fine so it appears the default security setting for file transfers isn't working, or is improperly configured. Most likely the latter.
Yes, I realize there are many technical documents I can read and plod my way through to troubleshoot this, but firewall / security is only a small part of my job. There is also a six minute video on EDR Core that doesn't explain much.
A simple 15-20 minute instructional video of EDR Core best practices & implementation would be huge to understanding EDR and securing customer networks.
Thanks WG!
- Doug
It's usually something simple.
Comments
https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Endpoint-Security/manage-settings/advanced-protection.html#NetworkUsage
WatchGuard Endpoint Security sends every unknown executable file found on user computers to WatchGuard Cloud for analysis.
This behavior is configured so that it has no impact on the customer’s network bandwidth:
WatchGuard Endpoint Security will only send a maximum 50 MB per hour per client to WatchGuard Cloud.
The endpoint agent sends each unknown file once only for all customers using WatchGuard Endpoint Security.
WatchGuard Endpoint Security has implemented bandwidth management mechanisms to prevent intensive usage of network resources.
To configure network usage, in the Network Usage section:
In the Maximum number of MBs that can be transferred in an hour text box, type the maximum number of MB to transfer between the computers and devices on your network and WatchGuard Cloud.
Most of this is covered under EPDR training videos as all "EDR Core" is, is the "EDR" piece from EPDR but provided by firewall licensing rather than EDR licensing.
If you are a WG partner I advise you go to learn.watchguard.com and review the Endpoint Security Essentials course. This course and the study guide that comes with it should be more than sufficient to get you started with EDR Core. The video training here is really good. It is in-depth but great if you are a visual learner that doesn't want to read documents when first learning something.
If you are NOT a WatchGuard partner, I advise reaching out to your partner for training.
These options I know aren't a "Quick video" but are what I would advise in the interim while waiting for a best practices video to be released.
Thanks for the input @Tristan.Colo and @kimmo.pohjoisaho, much appreciated. I didn't realize the max MBs transfer was to the WG Cloud and not between local machines. Just learned something :-)
I'll email my WG Partner (as I'm not one) and see if I can get access to the training videos.
It's usually something simple.