250-580 Exam Dumps : Endpoint Security Complete - R2 Technical Specialist

Calculating storage requirements for Symantec Endpoint Security (SES) involves gathering specific information related to data retention and event storage needs. The required information includes:

Number of Endpoints:Determines the scale of data to be managed.

EAR Data per Endpoint per Day:Refers to the Endpoint Activity Recorder (EAR) data generated by each endpoint daily, affecting storage usage.

Number of Days to Retain:Indicates the data retention period, which impacts the total volume of stored data.

Number of Endpoint Dumps and Dump Size:These parameters define the size and number of memory dumps, which are essential for forensic analysis and troubleshooting.

This information allows accurate calculation of storage needs, ensuring adequate capacity for logs, dumps, and activity data.

InSymantec Endpoint Detection and Response (SEDR), theBlock Listfeature allows administrators to manually block a specific file hash identified as malicious. By adding the hash of the malicious file to the Block List, SEDR ensures that the file cannot execute or interact with the network, preventing further harm. This manual blocking capability provides administrators with direct control over specific threats detected in their environment.

To integrateSymantec Endpoint Detection and Response (SEDR)withSymantec Endpoint Protection (SEP)effectively, the recommended configuration order isECC, Synapse, then Insight Proxy.

Order of Configuration:

ECC (Endpoint Communication Channel): This establishes the communication layer for SEDR and SEP integration, which is foundational for data exchange.

Synapse: This integration uses data from ECC to correlate threat intelligence and provide context to detected threats.

Insight Proxy: Configured last, Insight Proxy adds cloud-based file reputation lookups, enhancing detection capabilities with reputation scoring.

Why This Order is Effective:

Each component builds on the previous one, maximizing the value of integration by ensuring that foundational communication (ECC) is established before adding Synapse correlation and Insight Proxy reputation data.

References: Configuring ECC, Synapse, and Insight Proxy in this order is considered best practice for optimizing integration benefits between SEDR and SEP​.