Best Practices Guide for SonicWall Endpoint Security (SES)

This guide summarizes practical best practices for deploying and operating an Endpoint Detection and Response (EDR) solution, grounded in SonicWall Endpoint Security (SES) capabilities documented in the SES Administration Guide, and supplemented with widely, not a accepted industry EDR guidance.

Deployment & Agent Hygiene

• Remove conflicting agents first. Uninstall or disable any existing NGAV/EDR product before installing the SES agent; running two endpoint agents concurrently causes conflicts and blind spots.
• Use a visible install method. Deploy via msiexec with /q or /qb! (Basic UI). Avoid /qn silent installs for SES, since a visible progress dialog helps confirm success and surfaces failures immediately.
• Handle Windows Server separately. Manually disable Microsoft Defender on Windows Server hosts only; this is not required or recommended for standard endpoints.
• Protect the uninstall path. Set and safeguard an uninstall password. Command-line uninstall/upgrade requires a SHA-256–hashed password, not plain text — store the hash generation script securely, not the password itself.
• Standardize the agent version. Prefer Auto Update (Latest) for most fleets; pin a specific version only for change-controlled or regulated environments and track pinned versions in a CMDB. Should be exactly opposite for maximum safety.
• Monitor the agent’s health. Ensure the agent’s connection status shows as “connected” on all SES deployed endpoints. Periodically review EDR console’s endpoint tab to investigate “offline” endpoints. Inspect agent debug logs for connectivity issues.

Note: General EDR guidance: agent tamper-resistance and update currency are consistently cited (MITRE, NIST SP 800-83) as top predictors of EDR effectiveness — an outdated or disabled agent is functionally equivalent to no agent. General EDR guidance: Set the operational target to maximize protection. Ensure SES deployments cover 100% of critical assets, >99% of the endpoints covered with telemetry enabled and continuous deployments on new onboarded endpoints.

Policy & Detection Configuration

• Roll out gradually
  • Pilot new sensor or custom-rule policies in Detect Only Mode on a representative subset of endpoints before enabling Kill/Quarantine fleet-wide.
  • Move to enforcement in phases (pilot → department → fleet), monitoring false-positive rate at each phase.
• Tune exclusions and blocklists deliberately
  • Prefer hash-based exclusions (SHA-256) over broad file-mask paths; a path exclusion is easy to widen accidentally and becomes a durable blind spot. Limit the number of exclusions to minimum possible.
  • Document the business justification for every exclusion and review the exclusion list on a fixed cadence (e.g., quarterly). When reviewed, remove the exclusions if no longer required.
  • Use the Blocklist for confirmed-malicious hashes only — it is a denylist of last resort, not a substitute for behavioral detection.
• Use policy inheritance intentionally
  • Set baseline Sensor, Exclusion, Blocklist, Device Control, and Custom Rule policies at the Account or Tenant level, and let Groups inherit by default.
  • Reserve inheritance overrides for groups with a genuinely different risk profile (e.g., servers vs. laptops, or a regulated business unit).
• Apply RTDMI and Device Control based on risk tolerance
  • Use Block Execution Until RTDMI Verdict for high-value or high-risk endpoint groups where latency is an acceptable trade-off for stronger pre-execution assurance.
  • Restrict USB mass storage broadly by default (block the DiskDrive device class) and allow only specific approved vendor devices, rather than allowing USB storage broadly and blocking exceptions.

Access Control & Administration

• Apply least privilege to console roles. Grant Tenant read-only access to auditors and stakeholders who need visibility only; reserve Admin rights for operators who actively manage policy.
• Treat Service User tokens like credentials. Scope tokens to the minimum required level (Read-only where possible), set the shortest workable expiration, and rotate them on a defined schedule rather than issuing long-lived tokens by default.
• Enable Anti-Tamper everywhere. Anti-Tamper protection should be on by default across all groups; disabling it should require a documented exception.
• Log and review administrative activity. Periodically review the Activities log for policy changes, especially disabled protections or newly added exclusions, as part of change management.

Monitoring, Threat Hunting & Response

• Turn on full telemetry before you need it. Enable Process, File, Registry, Network, and Security Activity collection, plus Telemetry Cloud Upload, in advance — historical threat hunting is only as good as the data already being collected.
• Establish a hunting cadence. Run scheduled Live Queries or Historical Threat Hunting queries for known indicators and living-off-the-land patterns, rather than relying solely on automated alerts.
• Build hunting around behaviors. Look for abnormal process relationships, Users, Network activity, persistence instead of building hunting around Hash, IP or Domains.
• Use severity consistently for triage. Route High-severity detections to immediate response, and use Custom Rules to encode organization-specific severity for known internal tooling that would otherwise generate noise.
• Contain before you clean. On a suspected active compromise, isolate the endpoint before taking remediation or uninstall actions, to prevent lateral movement while preserving forensic state.
• Correlate with external threat intelligence. Use the MITRE ATT&CK tactic/technique mapping and VirusTotal lookups on detections to validate severity and to identify related campaigns.

Note: General EDR guidance: response speed matters more than response completeness in the first few minutes — isolate and contain first, perform full investigation and root-cause analysis second.

Governance & Reporting

• Generate recurring (24-hour, 7-day, or 30-day) threat-trend reports and review them with business stakeholders, not just security staff, to keep EDR value visible.
• Configure severity-based email notifications so the right team is alerted at the right threshold, rather than routing every Info-level event to on-call staff.
• Use Auto Decommission and Auto Delete to keep the endpoint inventory accurate, so reporting and licensing reflect the real fleet, not stale devices.
• Treat policy changes (new exclusions, disabled protections, inheritance overrides) as change-managed events with an owner and an expiration or review date.