{"id":8532,"date":"2021-03-24T08:54:29","date_gmt":"2021-03-24T07:54:29","guid":{"rendered":"https:\/\/www.nod32.com.hr\/podrska\/?p=8532"},"modified":"2023-12-22T13:28:47","modified_gmt":"2023-12-22T12:28:47","slug":"epx-preporucena-praksa-best-practices","status":"publish","type":"post","link":"https:\/\/www.nod32.com.hr\/podrska\/kb8532","title":{"rendered":"ESET Protect – Preporu\u010dene radnje (Best practices)"},"content":{"rendered":"\r\n

Tema<\/h2>\r\n

Preporu\u010dene radnje za konfiguriranje sustava ESET Protect.<\/p>\r\n\r\n

Uvod<\/h2>\r\n

Po instalaciji su navedeni serveri konfigurirani na na\u010din koji odgovara zahtjevima ve\u0107ine poduze\u0107a. No, inicijalne postavke ne moraju odgovarati uvijek i svima, stoga donosimo popis dijela radnji koje biste mogli primijeniti jednokratno\/dnevno\/tjedno ili ih promijeniti kako biste sustav prilagodili radu svoj mre\u017ee.<\/p>\r\n

Naravno da neke od ovih radnji ne\u0107e odgovarati va\u0161em okru\u017eenju (npr. zatvorene mre\u017ee ne\u0107e ra\u010dunalim dopustiti direktan izlaz na internet bez proksija i sl.) – provjerite prijedloge i primijenite one za koje mislite da \u0107e pove\u0107ati sigurnost i pojednostaviti administraciju.<\/p>\r\n\r\n

Postupak<\/h2>\r\n

Po instalaciji provjerite upute na stranici https:\/\/help.eset.com\/protect_admin\/latest\/en-US\/fs.html<\/a> (online<\/em> pomo\u0107 je dostupna i na hrvatskom, samo promijenite jezik u izborniku gore desno) i sljede\u0107e prijedloge:<\/p>\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
Kreirajte dodatnog administratora<\/td>\r\nhttps:\/\/help.eset.com\/protect_admin\/latest\/en-US\/admin_ar_create_native_user.html<\/a><\/td>\r\n<\/tr>\r\n
Iskoristite 2FA<\/td>\r\nhttps:\/\/help.eset.com\/protect_admin\/latest\/en-US\/admin_ar_two_factor_authentification.html<\/a><\/td>\r\n<\/tr>\r\n
Pregledajte policy za EMAgenta i po potrebi promijenite postavke<\/td>\r\nhttps:\/\/help.eset.com\/protect_admin\/latest\/en-US\/admin_ar_create_native_user.html?admin_pol.html<\/a><\/td>\r\n<\/tr>\r\n
Pregledajte policy za sigurnosne programe i po potrebi promijenite postavke<\/td>\r\nhttps:\/\/help.eset.com\/protect_admin\/latest\/en-US\/admin_ar_create_native_user.html?admin_pol.html<\/a><\/td>\r\n<\/tr>\r\n
Postavite lozinku na napredno pode\u0161avanje radi sprje\u010davanja promjena<\/td>\r\nhttps:\/\/help.eset.com\/ees\/8\/en-US\/idh_change_password.html<\/a><\/td>\r\n<\/tr>\r\n
Postavite lozinku na EMAgenta radi sprje\u010davanja deinstaliranja<\/td>\r\nhttps:\/\/help.eset.com\/protect_admin\/latest\/en-US\/admin_pol_password_protection.html<\/a><\/td>\r\n<\/tr>\r\n
Uklju\u010dite detekciju svih triju vrsta ne\u017eeljenih programa (*1)<\/td>\r\nhttps:\/\/help.eset.com\/ees\/8\/en-US\/idh_config_scanner.html<\/a><\/td>\r\n<\/tr>\r\n
Administratorima i naprednim korisnicima definirajte izuzetke (*2)<\/td>\r\nhttps:\/\/help.eset.com\/ees\/8\/en-US\/idh_detection_exclusions.html<\/a><\/td>\r\n<\/tr>\r\n
Iskoristite proxy (ostavite i mogu\u0107nost direktnog izlaska na internet) (*8)<\/td>\r\nhttps:\/\/help.eset.com\/protect_install\/latest\/en-US\/apache_http_proxy.html<\/a><\/td>\r\n<\/tr>\r\n
Podesite Dashboard<\/td>\r\nhttps:\/\/help.eset.com\/protect_admin\/latest\/en-US\/client_tasks_virus_db_update.html?dashboard.html<\/a><\/td>\r\n<\/tr>\r\n
Ograni\u010dite pristup nekim vrstama stranica<\/td>\r\nhttps:\/\/help.eset.com\/ees\/8\/en-US\/idh_page_setting_parental.html<\/a><\/td>\r\n<\/tr>\r\n
Nerije\u0161ene prijetnje:
\r\nuklonite taskom “On-Demand scan” (In-Depth)<\/td>\r\n		https:\/\/help.eset.com\/protect_admin\/latest\/en-US\/client_tasks_on_demand_scan.html<\/a><\/td>\r\n<\/tr>\r\n
Nerije\u0161ene prijetnje:
\r\nru\u010dno analizirajte svaku i ru\u010dno uklonite (*3)<\/td>\r\n		n\/a<\/td>\r\n<\/tr>\r\n
Nerije\u0161ene prijetnje:
\r\nprovjerite naj\u010de\u0161\u0107a ra\u010dunala \/ korisnike<\/td>\r\n		Ako ustanovite da uvijek isti korisnici imaju prijave prijetnji – podu\u010dite ih pravilnom kori\u0161tenju ra\u010dunala \/ interneta ili ih stavite u posebnu grupu u EPx i definirajte stro\u017ei policy<\/td>\r\n<\/tr>\r\n
Iskoristite dinami\u010dke grupe (*4)<\/td>\r\nhttps:\/\/help.eset.com\/protect_admin\/latest\/en-US\/admin_dg_dynamic_group_wizard.html<\/a>
\r\nhttps:\/\/help.eset.com\/protect_admin\/latest\/en-US\/dynamic_group_examples.html<\/a><\/td>\r\n<\/tr>\r\n
Instalirajte najnovije verzije ESET-ovih programa<\/td>\r\nhttps:\/\/help.eset.com\/protect_admin\/latest\/en-US\/outdated_applications.html<\/a><\/td>\r\n<\/tr>\r\n
Provjerite nadogra\u0111uju li se moduli i forsirajte ako ima problema<\/td>\r\nhttps:\/\/help.eset.com\/protect_admin\/latest\/en-US\/client_tasks_virus_db_update.html<\/a><\/td>\r\n<\/tr>\r\n
Nadogradnja operacijskog sustava<\/td>\r\nhttps:\/\/help.eset.com\/protect_admin\/latest\/en-US\/client_tasks_system_update.html<\/a><\/td>\r\n<\/tr>\r\n
Provjerite stanje taskova;
\r\nponovite neuspjele ili uklonite uzrok “pada”<\/td>\r\n		https:\/\/help.eset.com\/protect_admin\/latest\/en-US\/fs_post_installation_tasks.html?admin_ct_executions.html<\/a><\/td>\r\n<\/tr>\r\n
Iskoristite izvje\u0161\u0107a<\/td>\r\nhttps:\/\/help.eset.com\/protect_admin\/latest\/en-US\/reports.html<\/a><\/td>\r\n<\/tr>\r\n
Automatizirajte kreiranje izvje\u0161\u0107a;
\r\ndodatno ih obradite svojim skriptama (*5)<\/td>\r\n		https:\/\/help.eset.com\/protect_admin\/latest\/en-US\/reports.html?schedule_a_report.html<\/a><\/td>\r\n<\/tr>\r\n
Namjestite slanje obavijesti (Notifications<\/em>) u nekim uvjetima (*6)<\/td>\r\nhttps:\/\/help.eset.com\/protect_admin\/latest\/en-US\/admin_ntf_notifications.html<\/a><\/td>\r\n<\/tr>\r\n
Ostala upozorenja (*7)<\/td>\r\n\u00a0<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n

<\/p>\r\n

(*1) Ne\u017eeljene vrste programa – u pravilu krajnji korisnici nemaju potrebu za ovakvim alatima, ali mogu biti korisni administratorima i tehni\u010dkom osoblju, pa kreirajte odgovaraju\u0107a pravila (policy) i nekima uklju\u010dite detekciju svega, a drugima mo\u017eda dopustite malo slobodniji rad (na\u0161a preporuka je da uklju\u010dite sve kategorije, a da napravite pojedina\u010dne izuzetke alata kako je opisano u ovom dokumentu). Ovu stavku je mogu\u0107e definirati i u pravilu (policyju) EP servera.<\/p>\r\n

\u2022 Potentially unwanted applications<\/a>
\r\n\u2022 Potentially unsafe applications<\/a>
\r\n\u2022 Suspicious applications<\/a><\/p>\r\n

(*2) Preporu\u010dujemo da u izuzetke stavite konkretnu datoteku i\/ili konkretnu prijetnju. Stavljanje cijelog direktorija u izuzetak od detekcije mo\u017ee dovesti do toga da se u njemu na\u0111e prijetnja koja je izvan kontrole administratora antivirusnog sustava. Ovu stavku je mogu\u0107e definirati i u pravilu (policyju) EP servera.<\/p>\r\n

(*3) Naj\u010de\u0161\u0107e se dogodi da tijekom skeniranja korisnik odgodi brisanje prijetnji na kraj skeniranja, a u me\u0111uvremenu se uvjeti s datotekom promijene:<\/p>\r\n

\u2022 datoteka je zauzeta
\r\n\u2022 Endpoint je namje\u0161ten tako da ne bri\u0161e detekcije, nego ih samo prijavljuje
\r\n\u2022 datoteka se nalazi u sistemskom direktoriju i nije sigurno po OS ukloniti ju bez suradnje administratora
\r\n\u2022 datoteka vi\u0161e ne postoji (npr. browser cache je o\u010di\u0161\u0107en, vanjski ure\u0111aj je iskop\u010dan, ..)
\r\n\u2022 EFI\/UEFI detekcije – ne mogu se obrisati jer su u BIOS-u<\/p>\r\n

(*4) Npr. kreirajte dinami\u010dku grupu “DynGrp_Nerije\u0161ene_prijetnje”
\r\n\u2022 Neka grupa obuhvati ra\u010dunala koja ispune uvjet (“Dynamic group template expression<\/em>“): “Active detections – Detection handled” = “No”
\r\n\u2022 Kreirajte policy koji ima najstro\u017ea pravila i dodijelite ga grupi (https:\/\/help.eset.com\/protect_admin\/latest\/en-US\/amin_pol_assign_policy_to_group.html<\/a>)
\r\n\u2022 Kreirajte scheduled task “On Demand Scan” – “In-Depth Scan” koji \u0107e se pokrenuti (“trigger”) “Joined Dynamic Group Trigger”<\/p>\r\n

Na ovaj na\u010din \u0107e ra\u010dunala kod kojih se pojavi nerije\u0161ena prijetnja biti automatki uklju\u010dena u dinami\u010dku grupu, konfiguracija \u0107e im biti postavljena “na najja\u010de” i odmah \u0107e se pokrenuti dubinsko skeniranje. Ako imate ESET Endpoint Security mo\u017eete dodati i da se ra\u010dunalo izdvoji (isklju\u010di) s mre\u017ee – ostat \u0107e u kontaktu sa EPx serverom, ali sve druge mre\u017ene aktivnosti \u0107e biti sprije\u010dene.<\/p>\r\n

(*5) Automatizirana izvje\u0161\u0107a<\/p>\r\n

Izvje\u0161\u0107a (Reports) se mogu podesiti da se pokre\u0107u periodi\u010dno i da automatski po\u0161alju e-mail sa .PDF privitkom i spreme .CSV datoteku na disk. CSV datoteku mo\u017eete dodatno obra\u0111ivati svojim skriptama, uvoziti u baze itd.<\/p>\r\n

(*6) Aktivirajte obavijesti (Notifications) koje \u0107e se slati u va\u017enim situacijama (npr. ako se u periodu od 5 minuta pojavi vi\u0161e od 5 detekcija); kreirajte grupnu, distribucijsku e-adresu koju po potrebi mo\u017ee pratiti vi\u0161e osoba i reagirati. Nemojte namjestiti previ\u0161e obavijesti jer \u0107e dovesti do zasi\u0107enja administratora i one va\u017ene mogu kasnije biti ignorirane.<\/p>\r\n

(*7) Ostala upozorenja kojima treba posvetiti pozornost:<\/p>\r\n

\u2022 Anti-Phishing protection is non-functional
\r\n\u2022 Anti-Stealth is non-functional
\r\n\u2022 Computer restart required
\r\n\u2022 Detection Engine out of date
\r\n\u2022 ESET LiveGrid is not accessible
\r\n\u2022 ESET Management Agent is outdated
\r\n\u2022 Host Intrusion Prevention System (HIPS) is non-functional
\r\n\u2022 License expires
\r\n\u2022 Product malfunction
\r\n\u2022 Operating system is not up to date
\r\n\u2022 Presentation mode is enabled
\r\n\u2022 Product is installed but it is not running
\r\n\u2022 Product not activated
\r\n\u2022 Real-time file system protection is disabled
\r\n\u2022 Some of the functionality of this ESET Security Product is not supported on macOS Big Sur yet. Check for product updates regularly to get the unsupported functionality back on your macOS. More info: https:\/\/support.eset.com\/news7604
\r\n\u2022 Web control is non-functional
\r\n\u2022 Windows Security Center indicates that the feature is not installed or is not running properly
\r\n\u2022 Windows updates available
\r\n\u2022 Your product is outdated
\r\n\u2022 Your security product will reach End of Life soon<\/p>\r\n

(*8) HTTP proxy<\/p>\r\n

Kori\u0161tenje HTTP proksija koji dolazi s instalacijom administrativnog servera je naro\u010dito prakti\u010dno u okru\u017eenjima u kojima je pristup internetu na neki na\u010din ograni\u010den. Takva ograni\u010denja mogu smetati komunikaciji klijenata s ESET-ovim serverima, \u0161to se u slu\u010daju kori\u0161tenja proksija mo\u017ee rije\u0161iti tako da na firewallu perimetra propustite sav promet s EPx servera (preciznije – sa HTTP proksija na serveru) prema internetu, a klijenti komuniciraju s tim proksijem.<\/p>\r\n

Ako koristite ESETBridge uveden s ESET Protect v.10 obavezno pro\u0111ite kroz dokumente za konfiguraciju: https:\/\/help.eset.com\/ebe\/latest\/en-US\/?configure.html<\/a>\u00a0i privjerite odgovara li policy va\u0161im zahtjevima.<\/p>\r\n

<\/p>\r\n

Razno<\/h2>\r\n

n\/a<\/p>\r\n

<\/p>\r\n

Slike<\/h2>\r\n

<\/p>\r\n

\u2022 Arhitektura<\/p>\r\n\r\n

\"ESET<\/a>
ESET Protect EPx – Arhitektura Architecture<\/figcaption><\/figure>\r\n\r\n

https:\/\/help.eset.com\/protect_install\/latest\/en-US\/architecture.html<\/a><\/p>\r\n

\u00a0<\/h2>\r\n

<\/p>\r\n

\r\n

epx xepx bestpractices xbestpracticesx xpreporuceneradnjex emagent agent xemagent xagent policy xpolicy<\/p>

\"image_pdf\"<\/a><\/div>","protected":false},"excerpt":{"rendered":"Tema Preporu\u010dene radnje za konfiguriranje sustava ESET Protect. Uvod Po instalaciji su navedeni serveri konfigurirani na na\u010din koji odgovara zahtjevima ve\u0107ine poduze\u0107a. No, inicijalne postavke…","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_lmt_disableupdate":"no","_lmt_disable":"no","footnotes":""},"categories":[6],"tags":[126,59,50],"class_list":["post-8532","post","type-post","status-publish","format-standard","hentry","category-epx","tag-epx","tag-kakoda","tag-sysadmin","no-wpautop","wpcat-6-id"],"modified_by":"NORT","_links":{"self":[{"href":"https:\/\/www.nod32.com.hr\/podrska\/wp-json\/wp\/v2\/posts\/8532","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nod32.com.hr\/podrska\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nod32.com.hr\/podrska\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nod32.com.hr\/podrska\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nod32.com.hr\/podrska\/wp-json\/wp\/v2\/comments?post=8532"}],"version-history":[{"count":2,"href":"https:\/\/www.nod32.com.hr\/podrska\/wp-json\/wp\/v2\/posts\/8532\/revisions"}],"predecessor-version":[{"id":8535,"href":"https:\/\/www.nod32.com.hr\/podrska\/wp-json\/wp\/v2\/posts\/8532\/revisions\/8535"}],"wp:attachment":[{"href":"https:\/\/www.nod32.com.hr\/podrska\/wp-json\/wp\/v2\/media?parent=8532"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nod32.com.hr\/podrska\/wp-json\/wp\/v2\/categories?post=8532"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nod32.com.hr\/podrska\/wp-json\/wp\/v2\/tags?post=8532"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}