Capture Client- Interoperability with Veritas Backup Exec (Symantec Backup)

03/26/2020 3 8799

DESCRIPTION:

This is a workaround to address Capture client Interoperability issues with Veritas Backup( Symantec Backup).

NOTE: If you deploy this solution, the Capture client (S1 Agent) will not be able to protect the affected endpoints from exploits directed at the application vulnerabilities.

RESOLUTION:

1) Go to https://captureclient.sonicwall.com and login to using your MysonicWALL credentials

2) Navigate to Security Policies>capture client policies and add a custom capture client policy (if there are not custom policies already)  and also add one custom threat protection policy (Ex:Veritas Exclusions)

 3) Navigate to Security Policies>Threat Protection policy>click on edit button on that custom policy and elect exclusion type as Path and specify Veritas path, type in description and select OS type and click on Add. Turn Off the Monitor option for each of Exclusions added.

4) Repeat the step 3 to add all the following Veritas folders under exclusions.

C:\Program Files\Symantec\Backup Exec\

A more detailed and granular list that is less aggressive than the summary above is to exclude these files: 

C:\Program Files\Symantec\Backup Exec\beremote.exe

C:\Program Files\Symantec\Backup Exec\beserver.exe

C:\Program Files\Symantec\Backup Exec\benetns.exe

C:\Program Files\Symantec\Backup Exec\pvlsvr.exe

C:\Program Files\Symantec\Backup Exec\BackupExec.exe

C:\Program Files\Symantec\Backup Exec\backupexecmanagementservice.exe

C:\Program Files\Symantec\Backup Exec\bedbg.exe

C:\Program Files\Symantec\Backup Exec\pdvfsservice.exe

C:\Program Files\Symantec\Backup Exec\spad.exe

C:\Program Files\Symantec\Backup Exec\spoold.exe

C:\Program Files\Symantec\Backup Exec\pddb\bin\pg_ctl.exe

5) Navigate to Security Policies>Threat Protection and click edit button on the policy you have added (Ex:Veritas Exclusions) and associate the capture client policy to which you would like to have the exclusions applied.

6) Navigate to Protect>Devices and update the policy to which you would like to have the exclusion policy pushed.