Good Afternoon Colleagues
I hope you are doing good . I am new reseller for PaloAlto in Egypt . I will offer to one of my customers Palo Alto firewall 850 . He needs also endpoint protection . Before offer to him PaloAlto traps , I need to know if traps has a version that can work On-premise or it is working on cloud only ?
Thx in advance.
The on-premise Traps Endpoint Security Manager (ESM) end of life has been announced. The date can be found here:
Cortex XDR Prevent (and Pro) offers an on-premise broker to serve as a proxy; however, the management component is in the cloud.
Good Afternoon David
Thx for your detailed replay . So if i choose to use Traps cloud version , Will traffic be inspected locally on clients workstations that have traps installed before leave to the Internet or traffic will be inspected at Palo Alto servers at Cloud before leave to the Internet ?
Most everything is handled locally, with the exception of malware verdicts. Instead of leveraging signature files, the agent will check with WildFire via a SHA-256 hash. If the file is known, it will respond accordingly. If it is unknown, local analysis will score the file and make a temporary verdict. At the same time the file is uploaded and detonated in WildFire. After analysis, the file is known. This logic is the same logic that applied in the on-premise ESM.
Do you have connectivity challenges or are you trying to limit internet traffic?
Good Morning David
Many thanks for your fast response and your willing to help . The case that the customer is governmental entity and cloud solution not allowed for governmental solution . The reason that for normal cloud solution - as per my knowledge- , All files should be sent to cloud to be inspected first before leave to the internet.
Based on you last replay , I would like to summarize the below:
Is there any major difference between the two solutions from your point of view ?
There are quite a few differences between ESM and Cortex XDR. You get significantly more features in Cortex XDR. Some differences include:
1. Management server location (Cloud vs on-Prem)
2. Cortex XDR has more prevention features (Behavior Threat Protection, etc)
3. Agent communication (Cortex XDR - communicates over internet / ESM - communicates while on network, VPN, or DMZ exposed Core)
4. EDR capabilities available in Cortex XDR
5. Cortex XDR has device control features (USB Device control, Host-based firewall, bitlocker support)
6. Cortex XDR allows response capabilities
WildFire is used in both solutions. WildFire is cloud-based.
So TMS doesn't technically exist anymore. The features previously available within TMS are now available within Cortex XDR Prevent. Cortex XDR Pro (which includes the features in Prevent) gives you the additional features that were not available in TMS. This includes features such as IOCs, BIOCs, hunting, analytics, etc.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!