Endpoint Security Analytics (ESA)
This section lists features that are available only with the uberAgent ESA product (info on the UXM and ESA products).
Enabling uberAgent ESA
uberAgent ESA is enabled or disabled through the configuration setting
EnableESA. In the default configuration file,
EnableESA is set to
true. However, the endpoint agent enables ESA only if one of the following is also true:
- Valid UXM and ESA licenses are available (i.e., the product is properly licensed)
- Neither UXM nor ESA licenses are available (demo mode)
ESA Enables EnableExtendedInfo
When ESA is enabled,
EnableExtendedInfo is automatically enabled, too, irrespective of the configuration setting of the same name.
EnableExtendedInfo ensures that GUIDs are added to process events so that individual process instances can be identified and tracked over time.