Installing Endpoint Protection

This article explains how to install Cato's Endpoint Protection (EPP) solution on your endpoints

Overview

Cato's EPP solution is installed on your endpoints to protect them from attack. The solution is associated to your account using a unique token and can be distributed to endpoints using a Managed Deployment Solution, or manually. The EPP solution is Cato's software that runs the EPP engines to identify malicious files or processes. It is independent of the Cato Client and does not connect to any Cato PoPs. A unique Token that is used during the installation of the EPP Agent to associate it to your account.

Cato automatically upgrades the EPP solution when a new version is available.

Prerequisites

Before the EPP solution is installed on an endpoint, ensure they meet that the following requirements:

Distributing EPP to Endpoints

To distribute the Cato's EPP solution to endpoints in your environment, Cato supports using a Mobile Device Management system. Cato's EPP Agent can also be manually installed.

Associating EPP to your Account

The Agent Token is a unique token for your account that is used during the installation process. The Agent Token associates the EPP Agent to your account.

To show the Agent Token:

  1. From the navigation menu, click Security > Endpoint Protection.

  2. Click the Setting tab.

    The Agent Token is displayed

Note

Note: You can refresh your Agent Token by clicking the refresh button. After the token is refreshed there is no impact on endpoints that are already associated to your account. To associate new endpoints to your account, use the updated Agent Token.

Downloading EPP

You can download the EPP Client to distribute or install it on the endpoints in your environment. An EXE and MSI version are available for download.

Note

Note: The EEP solution is only available with an additional license. For more information, contact your sales representative.  

Download_Agent.png

To download EPP:

  1. From the navigation menu, click Access > Client Rollout.

  2. In the Windows EPP Client widget, click Download Client.

  3. Choose the file type you want to download.

    The EPP solution is downloaded.

Installing EPP with a MDM

To install EPP remotely, you can use a managed solution, for example Microsoft Intune, to deploy the EPP solution to endpoints in your environment.

To apply the Agent Token:

  • Use the command:

    msiexec.exe /i "<installer-path>" REGISTRATION_TOKEN=<Agent-Token>

Installing EPP Manually

After you download the installation file, follow the steps in the Cato Endpoint Protection Setup Wizard. When prompted, insert the Agent Token.

Reviewing Protected Endpoints

After registering Endpoints with your Agent Token, the solution starts reporting data, for example:

  • The version used on each endpoint

  • The profile applied to each endpoint

To review protected endpoints:

  • From the navigation menu, click Monitoring > Protected Endpoints.

    The Protected Endpoints screen opens.

Understanding the Protected Endpoint Table Columns

The following table is an explanation of the columns in the Protected Endpoints table.

Column

Explanation

Endpoint ID

Unique ID of the EEP agent.

Endpoint Name

Computer name of the endpoint.

User

Last user to log into the endpoint. On shared devices, the user may change over time.

IP

IP address of the endpoint.

OS Version

Endpoint operating system.

EPP Version

Version of the EPP solution installed on the Endpoint.

Profile

EPP profile assigned to the Endpoint.

The clock symbol displayed in this column means the Endpoint has not yet received the EPP profile. The EPP profile is assigned the next time the endpoint is online.

Quarantine Files

Number of quarantined files on the endpoint.

Status

Status of the EPP solution. The possible statuses are:

  • Starting: The EPP solution is installing on the endpoint

  • Protecting: The EPP solution is online and protecting the endpoint

  • Not Protecting: The EPP solution has a Profile with Anti-Malware set to Monitor

  • Error: The EPP solution has an error. See EPP Troubleshooting for more information

Protecting Cato's EPP Solution

Cato's EPP has Anti-Tampering protection enabled by default. This protects the processes, files, services and registries used by the EPP solution from malicious modifications or kill attempts. This also protects against unintentional enduser actions that might compromise security.

Disabling Protection of EPP

You can temporally unlock the Anti-Tamping protection for 15 minutes, for example if you need to uninstall solution. After this time, or if the endpoint is is rebooted, Anti-Tampering protecting is reenabled.

To unlock protection:

  1. From the navigation menu, click Monitoring > Protected Endpoints.

    The Protected Endpoints screen is displayed.

  2. Click the three dots (Three_Dots.png) on the endpoint that you are unlocking protection.

  3. Click Unlock Anti-Tamper.

    Anti-Tampering protection is temporally disabled.

EPP Troubleshooting

Errors may occur when installing EPP. Error messages are displayed in the Protected Endpoints table, under the Status column. If there is an error, the endpoint is not protected.

These are the error messages that could be displayed and how to resolve them:

  • Drivers are not installed correctly / Internal engine error: These errors mean that the solution has not been installed correctly and is unable to run the EPP engine(s). To resolve this issue, uninstall and then re-install the agent. If the issue persists, contact Support.

  • Installation not complete: Ensure the device has c++redist 2019 or later installed and reboot. If this issue persists, contact Support.
  • Error in module(s): atc/onaccess/selfprotect: There is an issue with the EPP engine(s). To resolve this issue, contact Support.

Understanding the Enduser Experience

The EPP solution is located in the Windows system tray and creates alerts for blocked activities according to the Protection level set in the Profile.

The EndPoint Protection Agent

image__3_.png

Endusers can use the Agent to confirm that the endpoint is protected and to display basic Statistics and Settings. For example the Profile and the engines that are running,

Anti-Malware and Behavioral Protection scans use minimal resources and are invisible to the enduser.

System Alerts

If malicious activity is identified on an endpoint a system alert is displayed to the enduser. The alert displays the path of the malicious file and the file status. This information is also visible in Windows notifications.

Access to the file is determined by the Protection level set in the Profile.

Note

Note: To receive system alerts, the EEP solution must be open and Windows notifications enabled on the endpoint. The Windows Notification Center can be used to snooze notifications.

 

Uninstalling Endpoint Protection

If EPP is no longer required on an endpoint, it can be uninstalled. After the solution is uninstalled, the EPP engines cannot scan for malicious activity and no Events are reported.

Follow these steps to uninstall EPP:

  1. Temporally unlock the Anti-Tamping protection
  2. Uninstall EPP from the endpoint
  3. Delete the endpoint from the Cato Management Application

Deleting an Endpoint

If EPP is no longer installed on an endpoint, the endpoint can be deleted from the Protected Endpoint table​​.

Note

Note: Do not delete an endpoint from the ​Protected Endpoint table​​ before EPP has been uninstalled.

To delete an endpoint:

  1. From the navigation menu, click Monitoring > Protected Endpoints​.
    The Protected Endpoints​ screen is displayed
  2. Click the three dots on the endpoint that you deleting.
  3. Click Delete Endpoint.
    The endpoint is deleted from the Protected Endpoints screen.

Was this article helpful?

0 comments

Add your comment