SonicWall Endpoint Security (SES) MDR : Frequently Asked Questions (FAQs)

Frequently Asked Questions about our SonicWall Endpoint Security (SES) Fully Managed - MDR offering.

 

SES MDR Onboarding Overview

Below is a high-level explanation of the onboarding process for prospects.

1. Enrollment

• • Once the partner signs up for the offering in the MySonicWall portal, the account moves to the SonicSentry team for onboarding.

2. Account Setup

• • SonicSentry opens an onboarding ticket and requests administrator information for the partner's MySonicWall organization. This administrator will deploy the SES agent and may provision additional tenants later.

3. Kickoff Scheduling and Prep

• • SonicSentry sends the partner a scheduling link to book the kickoff call. The scheduling form collects required contact information, so that support and the SOC team have the correct points of contact for communications. SonicSentry also sends an Excel document requesting a list of approved software for the client's environment. This information allows SonicSentry to manage policy exclusions and tailor SOC alerting appropriately for each customer.

4. Kickoff Call
During the call, SonicSentry does the following:

• • Confirms the partner can provision SES for the desired tenant(s) and knows where to obtain the install file and token.
  • Reviews the approved software list.
  • Outlines service and SOC responsibilities.
  • Establishes a deployment timeline, including when existing antivirus tools will be removed.

5. Deployment and Baseline

• • Devices are installed in alert-only mode. Once the partner confirms that the majority of machines for that customer are installed, SonicSentry begins the baseline process. This process takes two business days, during which SonicSentry reviews activity and applies exclusions for approved software to create a clean baseline.

6. Baseline Confirmation

• • SonicSentry sends the partner a list of allowed items for review and provides two business days for the partner to confirm or request changes. If no changes are requested within that window, SonicSentry proceeds to enable active protection.

7. Ongoing Protection

• • This is a fully managed MDR offering. Once active protection is enabled, any new installs for the client automatically receive protection, and the SOC team responds to all blocks within the platform. The SOC evaluates each alert by category and takes the appropriate mitigation action. The partner is then notified of the decision and retains the option to reverse it if desired. Additional follow-up calls may be scheduled as needed.

Reference:
Overview of our service/SOC responsibilities: (Fully Managed EPP SOC Alert Processing Summary)

GENERAL

Is a Proof of Concept (PoC) available?

Yes, we offer a 21 day Proof of Concept for our new partners.

What is involved with a Proof of Concept?

• Time Frame: 21 days, starting with the kickoff call
• Endpoint Limit: Unlimited
• Details outlining the PoC can be found here:
  • SES MDR POC : Frequently Asked Questions (FAQs)

Will my licensing automatically convert to production at the end of the PoC?

• Yes, we will convert the SES MDR accounts and associated tenant licensing to SES MDR monthly services at the end of the 21 day POC to continue protection and begin billing in the next billing phase
• You can opt out of moving to production prior to the end of your 21 day PoC

What are the responsibilities of the partner?

• Management of the deployment process
  • Deployment of the SES Agents to all devices in the environment
• Removal of any pre-existing AV software, timing coordinated with SonicSentry support/onboarding team
• Alert SonicSentry support/onboarding team when a device is decommissioned/uninstalled
• Alert SonicSentry support/onboarding team when you are ready to onboard an additional tenant/customer
• Inform SonicSentry of any updates/changes to the Approved Software List(s)
• Providing Tier 1 support to your users
• Contacting SonicSentry for any Tier 2 or Tier 3 issues that you are unable to resolve
• Further investigate alerts sent from the SonicSentry SOC

What are the Deliverables from SonicSentry Services?

• Initial configuration of the service platform architecture, including provisioning of portals and access for the MDR service
• Consultative guidance and support for onboarding and initial provisioning of endpoints within a multi-tenant architecture
• Guidance for migration of existing endpoint security licenses and agents during onboarding, including transitioning deployed agents into the MDR service or a managed security console, where supported
• Provisioning and pre-staging of recommended baseline policies to support service onboarding
• Ongoing changes to policies including enabling/disabling protection, configuring exclusions and blocklists, creating and managing custom rules and configuring device control rules
• Updating and maintaining Approved Software Lists(s) based on updates from partner
• Configuration and provisioning of log ingestion into the XDR/SIEM platform, including API-based integrations and syslog forwarding where applicable
• Provisioning of service-related training, support, and documentation
• Security Operations Center (SOC) monitoring services, including detection and alerting of abnormal, suspicious, or potentially malicious activity, along with initial investigations, response actions and remediation guidance
  • See the following article for more details on our SOC response: Fully Managed EPP SOC Alert Processing Summary
• Access to service-related management portals and dashboards, including the endpoint detection and response (EDR/XDR) platform, ticketing system, and associated SOC monitoring and reporting interfaces
• The MDR service empowers the SOC to take response actions, including host quarantine and process termination, these actions are executed without seeking additional permission, and will be discussed during service enrollment

IMPLEMENTATION

What devices do I need to install the SonicWall Endpoint Security (SES) agent on?

• The SES agent should be deployed on all supported devices in an environment

Is Multi-Tenancy supported?

• Yes, all SonicWall Endpoint Security accounts are setup with a ‘Parent-Child’ architecture
  • Partners will be able to create their own tenants and onboard additional clients as desired
  • Partners should communicate with our support team when spinning up new tenants and onboarding additional clients

SUPPORT

How do I contact support?

• To initiate a support request, visit https://msssupport.myportallogin.com
  • When prompted, select Endpoint Security, then choose SES Support
• Schedule a Meeting:
  • Up to 45 minute follow-up: Bookings: SES MDR Follow-Up
• Emergency Support:
  
  • Available 24/7 for our MDR Partners: Please call 703.565.2395
• Standard Support Hours:
  • Monday - Friday, 3:00 AM - 8:00 PM EST

How do I access SonicWall Endpoint Security (SES) documentation?

• Recommended resources are available at the following link: Sonicwall Endpoint Security KBs

Is training provided?

• SonicSentry fully manages the policies and any needed exclusions
• Training/Documentation is provided for installing the SES agent

MONITORING

How are SonicWall Endpoint Security (SES) logs retained?

• The SES agent syslogs are sent from the central management console to our SIEM/SOAR for SOC services
  • These logs are maintained for 1 year

Do I get access to the SIEM?

• MDR partners are granted access to our SIEM (by request) for visibility and reporting purposes

Is your SOC outsourced?

• No. Our SOC is a 24x7x365 in-house Security Operations Center
  • NOAM partners work with our US based and full time employees
  • EMEA partners work with our EMEA based and full time employees

How will partners be contacted about alerts or incidents?

• Each partner should provide designated contact information for the following:
  
  • SES General: General communications, updates, and release notes
  • SOC Alerts: Notification of detected threats or alerts from the SOC
  • SOC Emergency Contact: Emergency phone contact
• More details are available here: Fully Managed EPP SOC Alert Processing Summary

BILLING and LICENSING

How is licensing handled?

• For Monthly Billed Partners:
  • Every month on the 25th (+/- 2 days) a snapshot of current usage is taken and will be used to provide your next invoice
    • Please be sure to notify SonicSentry support/onboarding teams of any unwanted/duplicate devices etc.. by the 20th, at the latest, to avoid being billed for them
  • The invoice will then be provided by your distributor
  • The License Report is also available via MySonicWall on the 1st
• For Yearly Committed Partners:
  • If your monthly usage is over your annual commit, you will be invoiced for the overage for that month
  • Every month on the 25th (+/- 2 days) a snapshot of current usage is taken and will be used to provide your next invoice
    • Please be sure to notify SonicSentry support/onboarding teams of any unwanted/duplicate devices etc.. by the 20th, at the latest, to avoid being billed for them

How do I get a breakdown of my devices per customer?

• You can see current license usage when logged into MySonicWall under the Monthly Billing section
• Additional information for using MySonicWall and viewing usage is available at the following link, specifically License Report starting on page 30
  • MySonicWall MSSP Monthly Billing

Will duplicate or retired devices be billed?

• Yes. Please be sure to notify SonicSentry support/onboarding teams of any unwanted/duplicate devices etc.. to avoid being billed for them