Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Section
id1404768020
Section
id1404768040
Section
background-color$lightGrayColor
id1404768018

Protect your endpoints and unify IT security in one solution.

Table of Contents
maxLevel4
minLevel3

Section
id1404768030

How Do I Sign Up?


Follow these steps to start recording endpoint activity data:

Step 1

Sign up for a free Armor demo.

Step 2

Log into Armor EDR.

Step 3

Purchase your licenses in the Armor Management Portal (AMP).

Step 4

Install Armor Anywhere and the EDR subagent on the desired machines.


Product Overview


Incident Detection and Incident Response for Hybrid Deployments

Armor's Endpoint Detection and Response (EDR) is an advanced security detection and incident response solution delivering continuous visibility to Security Operations and Incident Response teams across an organization's end user IT estate. EDR can be installed on laptops, desktops, and servers, giving Customers a 360-degree detailed overview of endpoint activity.

EDR provides next-generation endpoint protection, identifying suspicious activities and events, and performing validation on detected threats, along with identifying anomalies and suspicious behavior patterns. The EDR product also provides next-gen anti-virus technologies to prevent malicious executables from firing in your environment.


Multimedia
nameEDR1.mp4
width600
height300


Features


Continuous Visibility

You can't stop what you can't see.

Investigations that typically take days or weeks can be completed in just minutes. EDR collects and visualizes comprehensive information about endpoint events, giving security professionals unparalleled visibility into their environments.

Scale the Hunt

Never hunt the same threat twice.

EDR combines custom and cloud-delivered threat intel, automated watchlists and integrations with the rest of your security stack to efficiently scale your hunt across even the largest of enterprises.

Respond Immediately

The days of constantly reimaging are over.

An attacker can compromise your environment in an hour or less. EDR gives you the power to respond and remediate in real time from anywhere in the world. EDR makes it easy to quickly contain threats and repair the damage to keep your business going.


Pricing


Pricing for EDR is per license purchased with an initial minimum of 25 licenses.

EDR Technical Information


Expand
titleSupported Operating Systems

WINDOWS

Currently, Armor is only operating on CB Cloud v3.5.1 for following Windows operating systems:

  • Microsoft Windows Server 2012
  • Microsoft Windows Server 2012 R2
  • Microsoft Windows Server 2016
  • Microsoft Windows Server 2019
  • Microsoft Windows 10
Note

We are not supporting Windows 11 at this time.


LINUX

Currently, Armor is only operating on CB Cloud v2.8.0 for following Linux operating systems:

OS

Version

CentOS

  • 7.X
  • 8.X

RHEL

  • 6.X
  • 7.X
  • 8.X
Ubuntu
  • 16.X
  • 18.X
  • 20.X
Amazon
  • 2
Oracle
  • 6.X
  • 7.X
Suses
  • 12
  • 15
Debian
  • 9
  • 10 (untested)


MacOS

Currently, Armor is only operating on CB Cloud v3.5.1 for following Mac operating systems:

  • macOS High Sierra
  • macOS Mojave
  • macOS Catalina
  • macOS Big Sur
    • installation on Big Sur requires special instructions, see documentation
Info
  • macOS 10.15 (Catalina) devices installed with macOS sensors 3.3.3+ may require a reboot.

  • macOS 10.13+ devices installed with macOS sensors 3.1+ require new Apple KEXT approval. Unapproved sensors will enter bypass mode.

Note

We are not supporting MacOS 12 Monterrey at this time.




Expand
titleSystem Requirements

Hardware

Network

  • CPU: 2GHz multi-core

  • RAM: 2GB

  • Disk Space: 500MB

    • +600MB if local scanning is enabled or using ThreatHunter.

  • Network Card: 100/1000 mbps

  • Additionally for Linux systems need 100 MB free space on the /opt partition and 4.1 GB free on the /var partition

  • TLS: 1.2 or later

  • Minimum Network used during light usage is 1k bytes/sec read/writes each

  • Primary port 443 and fail over port 54443

  • Firewall or proxy should be configured with a bypass rule to allow outgoing connections over TCP/443 as well as Cb Defense's alternate port TCP/54443.


Configure firewalls or proxies to allow outgoing and incoming connection to the following Destinations without packet inspection. Per link - https://www.dell.com/support/article/en-us/sln319296/vmware-carbon-black-cloud-endpoint-sensor-system-requirements?lang=en

Function

Primary Port

Backup Port

Destination

Administration

443

54443

defense-prod05.conferdeploy.net/

Client

443

54443

dev-prod05.conferdeploy.net/

Integration Services (API)

443

54443

api-prod05.conferdeploy.net/

Signature Updates

443

N/A

updates2.cdc.carbonblack.io

Online Certificate Status Protocol

80

N/A

ocsp.godaddy.com

Certificate Revocation List

80

N/A

crl.godaddy.com

Configure TCP/443 and TCP/54443 for the below destinations as well.

Signature URLs:

Third-party certificate validation URLs (sensor version 3.3+: optional but recommended and on by default):

Expand
titleEDR Features and Supported OS Types



Getting Started

Install and Uninstall

Troubleshooting Guide

FAQs

Armor Toolbox (Agent 3.0)


Was this helpful?