Correct integration/installation [EDR Optimum]

[Antipova Anna]

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.

This article will help you to check EDRO component correct installation and integration. 

What you need to know about EDRO

1 EDRO working with KES 11.7+, KSWS 11.0.1 and KSV LA 5.2 (Windows only), so called EPP

https://support.kaspersky.com/KEDR_Optimum/2.3/en-US/216855.htm 

2 You must use NWC for EDRO

3 You can't use only KEA for EDRO scenario. It always integrates with EPP.

How to check that EDRO component installed correctly

First of all you need to check whether KEA component was installed or not. And if it's installed then was it integrated with EPP. 

KES

Starting with KES 11.7 EDRO agent is integrated in the KES.

First of all, check component status in MMC or NWC

MMC

NWC

If you see Not supported by license, pay attention to the version. If you see 0.0.0.0 or N/A, it means that component is not installed. Not supported by license doesn't mean that there is no license for EDRO, it may mean that component is not installed on the host.

When component is installed but not activated, you'll see installed component version:

MMC

NWC

If component was installed and was not activated, it will look like this in the KES GUI:

If component is not installed, then there will be no Detection and Response section in the KES GUI (in case MDR is installed, then there will be section Detection and Response, but there will be no Endpoint Detection and Response Optimum like you see above).

 

How to check EDRO license in the KES UI

You can check license components in the KES GUI. If there is no Optimum word, license do not support EDRO. For example:

And there's an example when license key supports EDRO:

KSWS

During KSWS installation you must enable Endpoint Agent, even if KEA was already installed on the host. KSWS detects it and enables connector with existing KEA (KEA will not be reinstalled).

This is how correctly installed KSWS + KES looks like in the MMC:

And if it not installed:

KSV LA

There is no change components task. You can change them only during the upgrade or installation. Reinstallation requires reboot.

During installation you need to choose Custom installation and enable integration with KEA

Remember that you can enable integration in the installation package properties in the KSC.

How to check NWC setup for EDRO

What to do if there is no Alerts section in the NWC.

How it looks If there is no Alerts section in the WEB UI

Go to the settings:

And enable EDR alerts:

In the KSC NWC there will be EDRO plugin by default. It installs with the console. So the only way to reinstall it - reinstall NWC.

How detection looks without installed EDRO component 

If you see detection but without enriched information, you'll see it like this:

In the Enrichment and response section you'll see only Basic. It means where was a detection but no additional information about it was collected. Main reason why this may happen is that there's no EDRO component on the host.