In this article, you will learn everything you need to know about the settings you can perform on the HEIMDAL client-side products from the HEIMDAL Dashboard -> Endpoint Settings. To go to the Endpoint Settings, you have to log in to the HEIMDAL Dashboard, click the Endpoint Settings button (top-right corner), and select a Group Policy.
1. Endpoint Settings
2. General
3. DNS Security
4. Patch & Assets
5. Endpoint Detection
6. Privileged Access Management
ENDPOINT SETTINGS
In the Endpoint Settings, you have a section dedicated to macOS endpoints where you can create and manage Group Policies that are applied to the endpoints inside your organization. In the Linux GP tab, you can see all the Group Policies; you can edit their priorities according to your needs (by using drag & drop), you can enable/disable them, or you can duplicate them.
Reseller Master GP Distribution is a feature that allows resellers to deploy a Reseller Group Policy to all the customers who have selected to opt-in to the Reseller Master GP. The Reseller Master GP Distribution feature can be activated only from the Reseller account and enables the Opt-in Reseller Master GP functionality on the reseller's customers. A reseller can create one or multiple Reseller GPs.
Opt-in Reseller Master GP allows the customer (or the reseller) to apply the Group Policy settings configured by the Reseller in the Reseller Master GP. This GP cannot be edited or disabled by an Enterprise customer, but its priority can be changed in the Group Policy list.
The Download button allows you to download an Excel file with all the Group Policies and the settings in each Group Policy.
GENERAL
General Settings
In the General Settings tab, you can configure Group Policy settings that refer to GP assignment, check intervals, language, and other additional settings.Policy Name - add a name for the Group Policy.
Agent language - select the language for the Heimdal Agent UI. Available options vary by product and market.
Priority - shows the Group Policy priority number. To change the Group Policy priority, use drag-and-drop to reorder them in the Endpoint Settings.
Specific Azure AD Groups - select Azure AD groups to apply the current Group Policy to endpoints that are members of the specified Azure AD groups.
External IPs - allows you to automatically assign the Group Policy to endpoints matching the specified public IP address or addresses. You can add a single public IP address or multiple IP addresses by separating them with commas.
AD Computer Group - links the Group Policy to an Active Directory Group. Computers that are members of the specified Active Directory Group will automatically receive and apply this Group Policy.
AD User Group - links the Group Policy to an Active Directory Group. Users that are members of the specified Active Directory Group will automatically receive and apply this Group Policy.
Policy check interval - adjusts the interval the Heimdal Agent uses to automatically synchronize the Group Policy settings with the Heimdal Dashboard and servers. The default time is 180 minutes.
Licensing check interval - adjusts the interval the Heimdal Agent uses to check the Heimdal license.
Proxy Settings
This feature allows the Heimdal Agent to communicate with the Heimdal Dashboard when the endpoint is placed behind a proxy server. You can choose between proxy options or specify proxy settings manually.
No proxy - the Heimdal Agent does not use any proxy when communicating with the Heimdal Core service.
Manual proxy - explicitly define the proxy settings (Host, Port, Domain, Username, Password) that the Heimdal Agent should use for communication with the Heimdal Core service. The fields are:
- Host - the proxy server IP address (for example: x.x.x.x)
- Port - the proxy port number (for example: xxyyy)
- Domain - the proxy domain (for example: example.com)
- Username - the proxy authentication username
- Password - the proxy authentication password
Agent Settings
Include in the Release Candidate program - enroll the Heimdal Agent in the Release Candidate (RC) Program. When enabled, the Heimdal Agent automatically receives the latest RC updates, providing early access to new features and improvements before general release.
DEVICE INFO NOTIFICATIONS
Alert when a Heimdal Agent process is disabled by an Admin - Notifies the HEIMDAL Dashboard administrator that a critical Heimdal process has been stopped by a local administrator. You can contact the user and instruct them to navigate to System Preferences -> Login Items and re-enable all Heimdal processes.
Identical notifications recurrence threshold [days] - When enabled, the Heimdal Agent will not trigger new notifications, unless the selected number of days, set in the threshold slider, passed since the generation of the last notification of the same type, has been surpassed.
DNS Security
DNS Security is structured into 2 modules: DarkLayer Guard and VectorN Detection. This Group Policy section is designed to manage the HEIMDAL DNS Security engine embedded in the HEIMDAL Agent. By enabling the DarkLayer Guard engine, the HEIMDAL Agent will enable the network filter that will protect the computer from getting infected. The settings are described here.
PATCH & ASSETS
Patch & Assets is structured into 2 modules: 3rd Party Patch Management and OS Updates. This Group Policy section is designed to manage the HEIMDAL Patch & Assets components embedded in the HEIMDAL Agent.
3RD PARTY PATCH MANAGEMENT
The 3rd Party Patch Management module allows the user(s) to install or update a specific 3rd Party Application from the list of applications managed by HEIMDAL Security. The settings are described here.
OS UPDATES
Operating System Updates - turn ON/OFF the Operating System Updates product. The System Updates and Security Updates can be deployed by the module. Other updates can be deployed using the Infinity Management module. The settings are described here.
ENDPOINT DETECTION
Endpoint Detection currently includes the Next-Gen Antivirus. This Group Policy section is designed to manage the HEIMDAL Endpoint Detection components embedded in the HEIMDAL Agent.
NEXT-GEN ANTIVIRUS
The Next-Gen Antivirus will allow you or the users to perform scan operations on the endpoints in your environment to keep viruses and other threats away. The settings are described here.
The Ransomware Encryption Protection module detects processes that perform encryption operations on files on the endpoint with malicious intent. The module is processing kernel events for IO reads, writes, directory enumeration, and file execution. Patterns are matched against the collected events after studying the same patterns that are being created by actual ransomware. The engine will allow 3 files to get encrypted until it gives the verdict that the process is suspicious. Once flagged, details about the suspicious process are gathered and sent to the Heimdal servers. The settings are described here.
PRIVILEGES & APP CONTROL
Privileges & App Control allows you to control user permissions in your organization and enables you to manage elevations and special permissions to applications that are used on each endpoint.
PRIVILEGED ACCESS MANAGEMENT
The Privileged Access Management module will allow you to give users the ability to install software they need for a period of time you select, using the Administrator Session or the Run with Privileged Access Management option for single file elevation. Rights granted can be revoked at any time, and actions are logged for a full audit trail. This is the feature that allows an end-user to request admin privileges over their machine by sending a request to the Heimdal Dashboard System Administrator, who can deny or accept their request. The settings are described here.