CCES (Harmony Endpoint Specialist) key terms

Central component that stores endpoint policies, manages client deployments, and distributes updates to endpoint agents. It coordinates communication between administrators and managed endpoints and holds the endpoint security database.

Software installed on a managed host that enforces security policies, runs anti-malware scans, and reports status to the management server. It receives policy and blade updates and applies them locally.

Modular security component within the endpoint client, each providing a distinct protection capability such as anti-malware, firewall, or threat extraction. Blades can be enabled or disabled per policy.

Named collection of settings for one or more blades that defines behavior for a group of endpoints. Profiles are assigned to rules and applied based on the endpoint's identity and location.

Ordered statement that matches endpoints by user, group, or computer and assigns a policy profile. Rules are evaluated top-down, and the first match determines the applied policy.

Process by which the management server pushes updated policies and configuration to endpoint agents. Agents typically pull updates at intervals or receive immediate notification of changes.

Rule that overrides a policy setting for specific files, paths, processes, or users, such as excluding a known application from scanning. Exceptions reduce false positives but widen the attack surface if misused.

Core protection component that scans files and processes for malicious content using signatures, heuristics, and behavioral analysis. It blocks, quarantines, or deletes detected threats according to policy.

Downloadable package containing detection patterns for newly identified malware. Endpoints retrieve updates from the management server or a designated update source to maintain current detection coverage.

Detection technique that identifies malicious behavior or code structure without relying solely on known signatures. It can catch new or modified threats but may raise false positives.

Monitoring of process and file activity at runtime to detect suspicious actions such as mass encryption or credential access. It complements static signatures by catching threats that evade pattern matching.

Isolated storage location where detected malicious files are held so they cannot execute. Administrators can review, restore, or delete quarantined items and use them for investigation.

Cloud-based lookup that rates files and URLs by prevalence and known risk. Endpoints query it to decide whether an unknown file should be allowed, blocked, or inspected further.

Layered defenses designed to stop previously unknown exploits and malware, typically combining emulation, behavioral detection, and reputation checks. It addresses threats that lack existing signatures.

Technique that blocks attempts to abuse software vulnerabilities, such as memory corruption or code injection, regardless of whether a signature exists. It hardens applications against known and unknown exploits.

Feature set that detects and blocks unauthorized encryption of user files, often by monitoring protected folders and process behavior. It can also back up files before suspected encryption occurs.

Defensive technique that removes risky active content from documents and delivers a sanitized version to the user. It reduces exposure to malicious macros, scripts, and embedded objects.

Process of rebuilding a file from its safe components, stripping potentially malicious elements while preserving usability. It is applied to documents and archives before delivery to endpoints.

Blade that filters network traffic by rule and identifies applications to allow or block. It enforces segmentation and prevents unauthorized application communication on managed endpoints.

Data captured by the endpoint agent when a security event occurs, including process trees, file activity, and network connections. Investigators use it to reconstruct what happened on the host.

Structured process for detecting, containing, eradicating, and recovering from a security incident. In endpoint security it relies on telemetry, isolation, and remediation actions coordinated from the management console.

Action that restricts a compromised endpoint's network communication to only the management server. It contains the threat while preserving administrative access for investigation and cleanup.

Set of actions that remove or neutralize a threat and restore the endpoint to a trusted state, such as deleting malicious files, killing processes, or reverting changes. It follows detection and investigation.

Proactive search through endpoint telemetry and historical data for signs of compromise that automated detection may have missed. It uses queries and indicators to uncover stealthy activity.

Observable artifact such as a file hash, IP address, or registry key that suggests a system has been breached. Analysts use these indicators to scope and confirm incidents.

Structured output summarizing an investigation, including affected hosts, timeline, evidence, and recommended actions. It supports decision-making and may be shared with stakeholders or responders.

Record of administrative and security-relevant events, such as policy changes and logins, kept for accountability and troubleshooting. Logs help trace who changed what and when.

Console views that display endpoint health, threat detections, and policy compliance in near real time. They surface trends and alerts so administrators can prioritize responses.

Systematic process of diagnosing endpoint or server issues using logs, status indicators, and connectivity tests. Common causes include policy conflicts, update failures, and communication problems.

Secure, authenticated channel between endpoint agents and the management server, often using certificates and encryption. It prevents rogue servers or clients from injecting or intercepting policy data.

Legitimate file or activity incorrectly flagged as malicious. Excessive false positives disrupt users and lead administrators to create risky exclusions, so tuning detection settings matters.

Configuration that removes specified files, folders, or processes from scanning or monitoring. Exclusions improve performance but must be tightly scoped and reviewed to avoid blind spots.

Installer bundle containing the endpoint agent and its initial configuration, used to roll out protection to new hosts. It may be distributed manually or through software management tools.

Logical container of endpoints used to organize policy assignment and reporting. Group membership can be static or derived from directory attributes and influences which rules apply.

Component that forwards endpoint and management events to external systems such as SIEM platforms. It enables correlation with other data sources and long-term retention for investigations.

Ongoing checks of endpoint agent status, including update level, blade state, and last communication time. It helps identify unprotected or misconfigured hosts before incidents occur.