Best Practices for Hardening Symantec EDR appliance

Products

• Endpoint Detection and Response

Issue/Introduction

As an administrator of Endpoint Detection and Response (EDR) appliance, you seek best practices for further hardening.

Resolution

• Upgrade to the latest version of EDR Appliance software (Engineering tests for and resolves vulnerabilities during each development cycle.)
• Configure secure access to the EDR appliance console
• Add an Active Directory group to manage user access to EDR UI with roles
• Encrypt communication to the SEPM Database using certificates 
• Add a certificate during "Configuring the SEPM Controller"
• Periodically check whether certificates are soon to expire
• Periodically review local EDR users and membership in AD groups to confirm users are still active and remove or disable inactive users.