Throttling options for the Dissolvable Agent Server

Products

• Endpoint Detection and Response Cloud
• Endpoint Detection and Response

Issue/Introduction

When deploying a SEDR Cloud DAS, you may need to throttle the DAS to compensate for busy or low bandwidth networks, busy clients, or a DC with low resources.

You may see errors in the DAS logs about RPC exhaustion:

Connect share: The RPC server is too busy to complete this operation (1723).

Connect share: The specified network name is no longer available (64).

Cause

RPC initialization and network exhaustion errors can also be caused by latency between the Endpoints and their Domain Controller, since they need to authenticate the Domain Admin credentials provided by the DAS. This can overwhelm a DC and authentication requests time out before they can be answered.

Resolution

There are a few DAS registry settings available to help with throttling how many connections are made to Endpoints. The following keys can be defined under [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\OutlierSecurity]

1. ChannelThrottle - The registry key, "ChannelThrottle" defines the maximum number of concurrent connections per channel.
   It's recommended that you test the effect on the VDI with different values to determine which value provides acceptable CPU utilization levels. Channel throttle values of 5 or 10 are common.
    
2. MaxParallelism - Default value for this is computed by (CPU Cores * MaxCoreParallelism)
   This setting is used to override the computed value above. It throttles the number of parallel RPC connections to endpoints at any given time from the DAS server.
   Example: Assuming an 8 core dual socket machine, that equals 16 cores * 25 which equals a maximum of 400 RPC connections in parallel that will be allowed by default.
    
3. MaxCoreParallelism - Default value is 25.
   This is the number of parallel scans per CPU core on the DAS server and is used to compute the MaxParallelism value #2 above, unless you've specifically overridden it.