Integrating Endpoint Security Server with NDR

The NDR Series appliance can integrate, or pair, with an Endpoint Security Server to index host information from private IP addresses monitored by endpoints. After the two appliances are paired, you can use CLI or the API to index hostnames at a customized frequency. Host destination and source can then be used to retrieve usernames associated with them in the Web UI. Pairing requires Endpoint Security version 4.8 or later.

This section includes the following:

Exporting alerts from Endpoint Security Server
Integrating the Endpoint Security Server for hostname data
Verifying the Endpoint Security Server and NDR integration
Changing NDR and Endpoint Security Server configuration settings after integration
Retrieving metadata from a paired Endpoint Security Server

Important

Pairing an Endpoint Security Server to your NDR Series appliance may reduce the performance of the NDR.