Sensor Settings

The SonicWall Endpoint Security policy enables to manage the SES version on the endpoint devices.

To configure the Sensor Settings

1. Log into the SES Management Console and select the Tenant to configure the Sensor settings.
2. Navigate to Policy > Sensor.
3. In the Sensor settings section, enable the Protection settings. These settings define how the sensor detects, analyzes, and prevents threats across memory, files, and system behavior.
   • Memory Detection - Identify the malicious memory detected file on the endpoint.

   • Behavior Detection - Identify the malicious behavior on the endpoint.

4. Enable the File Detection to reduce the risk and detect the malicious file on the endpoint.

   • Either enable or disable the RTDMI Verdict Block option.

     Despite its name, this option does not itself block execution. When enabled, the SES agent allows the process to execute while the RTDMI cloud analysis runs in parallel; the process is not paused pending the verdict.

   • Either enable or disable the Block Execution Until RTDMI Verdict option.

     When enabled, the SES agent pauses (blocks) execution of the detected process until the RTDMI cloud verdict is returned. This provides stronger protection at the cost of potential execution latency.

5. In the Sensor settings section, enable the Telemetry settings.These settings are critical for behavioral analysis and threat hunting. Any change to the following settings requires a system reboot.
   • Process Activity - To collect the process activity from the endpoint.
     • File Activity - To collect the file activity from the endpoint.
     • Registry Activity - To collect the registry activity from the endpoint.
     • Network Activity - To collect the network activity from the endpoint.

   • Security Activity - To collect the security activity from the endpoint.

   • Telemetry Cloud Upload - This setting send the collected telemetry to our secured cloud. It essentially parse the Winevents that were collected as part of Process & Security Activity based on the policy configuration.

6. In the Deployment Settings section:
   • Under the Sensor tab, on the Deployment Settings section. click the drop-down in the Version field.

   • Choose the Auto Update (Latest) to automatically update the Agent when the latest release version is available.

     or

     Choose the preferred version and the same version gets upgraded in the Agent.

7. In the Configuration section:

   • Select the Anti-Tamper to apply all the anti-tamper settings.

   • Select the Detect only mode option to detect only mode, no execution happens.

     In the Detect only mode, a file will be detected even if it is blocked in the block mode until the system is rebooted.

   • Select the Debug Logs option to generate the debug logs for reference.

8. Enable the inherited Sensor settings from Parent to apply the settings from the Main Account level to the Tenant level.
9. In the Policy Inheritance Settings section:
   • Enable the Inherited Exclusion policies from Parent to apply the settings Main Account level to the Tenant level.

   • Enable the Inherited Blocklist policies from Parent to apply the settings Main Account level to the Tenant level.

   • Enable the Inherited Device Control policies from Parent to apply the settings Main Account level to the Tenant level.

   • Enable the Inherited Custom Rule policies from Parent to apply the settings Main Account level to the Tenant level.

10. Click Save.