EPM-DEF: CyberArk Defender EPM Certification

VirusTotal performs file analysis after the sample is uploaded to the VirusTotal service; its API accepts a file upload for analysis. Therefore, using it requires transmitting the suspect file externally. WildFire can also be deployed as an appliance, allowing local analysis. VirusTotal: Upload a file Palo Alto Networks: WildFire API Resources

The Authorized Applications application group provides the centralized application exclusion mechanism for CyberArk EPM Threat Protection modules, allowing the specified application to be excluded across those protections.

CyberArk Endpoint Privilege Manager’s Privilege Deception capability places local administrator deceptive accounts in an endpoint attack path as credential lures, enabling detection when an attacker attempts to use those credentials.

CyberArk Endpoint Privilege Manager policies can target EPM Sets, computers in Active Directory security groups, Active Directory users, and Active Directory security groups.

Mutual exclusions prevent CyberArk EPM and third-party security software from repeatedly scanning or intercepting each other’s files and processes, which can impair endpoint performance. The appropriate initial remediation is to place the third-party security solution in EPM’s Files To Be Ignored Always configuration and exclude CyberArk EPM from the third-party solution.