Threat Detection and Response (TDR), is a collection of advanced malware defense tools that correlate threat indicators from Fireboxes and Host Sensors to enable real-time, automated response to stop known, unknown, and evasive threats. As part of the TDR solution, you install TDR Host Sensors to provide endpoint protection.
As part of the TDR solution, you install TDR Host Sensors to provide endpoint protection. In some cases, the TDR Host Sensor might have conflicts with the antivirus software installed on your endpoints. To resolve this issue, you can configure exclusions in the antivirus software and in TDR.
This document includes information about the integration of a TDR Host Sensor with a host that runs Webroot software. It does not describe the procedure to set up Threat Detection and Response. For information about how to set up your TDR account, how to enable TDR on a Firebox, and how to install a Host Sensor, see Quick Start — Set Up Threat Detection and Response.
To avoid conflicts between the TDR Host Sensor and Webroot, add these exclusions:
- Exclusions in TDR for Webroot — For Windows:
- C:\Program Files\webroot\
- C:\Program Files(x86)\webroot\
- Exclusion in TDR for Webroot SecureAnywhere — For Mac:
- /Applications/Webroot SecureAnywhere.app/Contents/
- Exclusions in Webroot for the TDR Host Sensor — For Windows:
- 64-bit Windows — C:\Program Files (x86)\WatchGuard\Threat Detection and Response\amd64\host_sensor.exe
- 64-bit Windows — C:\Program Files (x86)\WatchGuard\Threat Detection and Response\amd64\TDRSensorStatus.exe
- 32-bit Windows — C:\Program Files (x86)\WatchGuard\Threat Detection and Response\amd64\host_sensor.exe
- 32-bit Windows — C:\Program Files\WatchGuard\Threat Detection and Response\amd64\TDRSensorStatus.exe
- Exclusions in Webroot for the TDR Host Sensor — for Mac:
- The Webroot SecureAnywhere Endpoint Protection for Mac can use default settings
- No exclusions are required.
To complete this deployment, you must have:
- An active Threat Detection and Response subscription with Host Sensor licenses
- Webroot SecureAnywhere Endpoint Protection v22.214.171.124-windows
- Webroot SecureAnywhere Endpoint Protection v126.96.36.199-Mac
The TDR and Fireware versions tested for this deployment included:
- TDR Host Sensor 188.8.131.5251
- Firebox with Fireware v12.3 or higher
The Windows test environment for this deployment included:
- Windows 7, 8.1, 10 Enterprise 64-bit Operating System
- Memory (RAM) — 8 GB
- Processor — 2 CPU Cores
The Mac test environment for this deployment included:
- macOS 10.13
- Memory (RAM) — 8 GB
- Processor — Intel Core i5
If the Host Sensor and Webroot detect and respond to a threat at same time, this can cause high utilization of system resources such as CPU, Memory and Disk I/O.
Configure Exclusions in TDR
In your TDR account, add the exclusions to manually identify paths for files and processes that you do not want Host Sensors to monitor. Before you deploy a Host Sensor on computers that have Webroot installed, Add exclusions for the Webroot file paths as TDR Exclusions in your TDR account.
In your TDR account, add the TDR exclusions for the paths shown in the Integration Summary.
Unless otherwise noted, configure each TDR exclusion with these options, which are selected by default:
- Also exclude subfolders
- Entities to exclude: Files and Processes
To add an exclusion in TDR:
- Log in to your TDR account or managed account as a user with Operator privileges.
- Select Configuration > Exclusion.
- Click Add Exclusion.
The Add Exclusion dialog box appears.
- In the Path text box, type the path to exclude. Folders specified in an exclusion must end with a backslash.
- To apply the exception to all hosts, in the Hosts / Groups text box, specify the group All Hosts.
- Click Save & Close.
Repeat these steps to add each exclusion.
Configure Exclusions in Webroot SecureAnywhere Endpoint Protection
To exclude directories used by the TDR Host Sensor, add the exclusions for the paths listed in the Integration Summary.
To add an exclusion in Webroot SecureAnywhere Endpoint Protection for Windows:
- Open Webroot SecureAnywhere Endpoint Protection UI.
- Click Settingsof PC Security.
- Click Block/Allow Files.
- Click Add Files.to exclude allow.
- Click Settingsof Identity Protection.
- Click Application Protection.
- Click Add Application , to exclude TRD Application allow.
The Webroot SecureAnywhere Endpoint Protection for Mac can use default settings .
For information about the integration testing methods, see TDR Testing Methodology.