Data Loss Prevention

Hello ,

I have to deploy the enpoint agents in several branch office of the company and they have different speed of internet connections, no more of 10 or 20 computer for branch office and y have 2 questions,

1_How is the bandwidth to consume this agent , is any way to test?

2_Its possible to copy the file from the computer to the enforce server when the incident its create ?

I have create 1 configuration of agent groups for each branch office, this a example of this settings:

Hello,

1 - For such a small number of agents/machines you shouldnt get worried with that.. For sure the average bandwidth utilization during the day won't be relevant.

2 - If you set a policy with a response rule to retain the attachments, they will be visible/available in the Enforce console (along with all other incident details)

BR,

Morgado

Morgado,

Thank for the info about retain the attachments, i test this configurations right now :D

additional use the setting which is mentioned in this KB

https://support.symantec.com/en_US/article.TECH220915.html

Regards

Its possible to change the time of the enpoint server send any change on rules to enpoints agents? how its the config values for change that? 

Answering your last question, that's the heardbeat setting (agent config / advanced settings). Agent is always comunicating with the endpoint servers / enforce - in order to send information related to the incidents and to receive policies/configuration changes from the Enforce.

Do you mean to this configuration?

What is the difference with the configurarion in the Aggregator.properties according this KB

https://support.symantec.com/en_US/article.TECH221057.html

In my case is set to inactiveConnectionTimeout = 300000

The time between agent connecting to Endpoint Server is controlled by changing System > Agent > Agent Configuration > Advanced Agent Settings > ServerCommunicator.CONNECT_POLLING_INTERVAL_SECONDS

Setting this to 10 is the lowest it can go (10 seconds).

You can set the bandwidth throttling as low as 50 kbps fairly easily if you aren't keeping copies of attachments. For remote sites that have bad or average links - you definately do NOT want to retain attachments, as you'll saturate the link.

Refer to this link for additional considerations: https://support.symantec.com/en_US/article.TECH220832.html