Skip to main content
This guide applies to Mac computers and Windows computers
The Endpoint Detection and Response add-on is required to use this Library Item.

​
About EDR Library Item Configuration

The EDR Library Item is the core component of Iru Endpoint EDR. Configure detection settings, posture modes, end-user notifications, and custom allow and block lists to meet your organization’s security requirements.

​
Adding an EDR Library Item

To add this Library Item to your Iru Endpoint Library, follow the steps in Library Overview.
1

Set the title

Open the Iru Endpoint Web App and navigate to your Library. Add a new EDR Library Item and set the title.
2

Set install platforms

Under Install on, select the platforms this Library Item installs on.
3

Choose Assignment Maps

Under Assignment Maps, select + Assign to assign the Library Item to the Blueprints that contain the devices you want to protect.
EDR Library Item with the title, Install on, and Assignment Maps
Configuration differs by platform. Select macOS or Windows below.

​
File detections

Set Malware Response and PUP Response. Detect Only lists detections in the Detections table. Protect (Recommended) automatically quarantines threats. Protect is currently macOS only.
1

Configure Malware Response

Select Detect Only or Protect (Recommended) for Malware Response.
2

Configure PUP Response

Select Detect Only or Protect (Recommended) for PUP Response.
3

Alert the user

If either response is set to Protect, select Alert the user when a Malware or PUP is quarantined.
File detections with Malware Response, PUP Response, and the quarantine alert

​
Behavioral Threat Protection

Behavioral Threat Protection is turned on by default. Turn the switch off to disable it. When the switch is on, it shows Managed.
Suspicious behavioral detections are automatically listed in the Detections table with an informational status to highlight unusual activities that may warrant attention. These detections are designed to provide visibility and cannot have their response configured.
1

Turn on Behavioral Threat Protection

Turn on Behavioral Threat Protection.
2

Configure Malicious Behavior Response

Under Apple only settings, select Detect Only or Protect (Recommended) for Malicious Behavior Response.
  • Detect Only lists detections in the Detections table.
  • Protect automatically blocks and isolates threats.
3

Alert the user

If Malicious Behavior Response is set to Protect, select Show the user a System Alert when a malicious behavior is blocked.
Behavioral Threat Protection with Malicious Behavior Response and the System Alert option

​
Security Events in Self Service

End users can view a list of quarantined files and blocked processes on their Mac computers by opening Self Service and selecting Security events from the left-hand navigation menu.
Configure the EDR Library Item step or screen

​
Configuring Allow and Block Lists

Allow and Block lists ensure that specific files or applications are always allowed or blocked in your environment, regardless of whether they appear in Iru Endpoint EDR’s threat feeds.
Block items are considered Malware and require Malware Response to be set to Protect to be blocked on the device.
1

Add New Item

Select the + Add item button.
Allow and Block list configuration interface
2

Configure Item Details

Give the item a Name.
3

Set Item Action

Select Allow to permit a file or application. Select Block to block it.
4

Select Item Type

Specify the item type Hash or Path for the file or application.
5

Enter Item Information

If Path was selected, enter the application or file path. If Hash was selected, enter the file hash.For Path entries, wildcard matching is supported:
  • * matches characters within a single path segment.
  • ** matches one or more directory levels (recursive matching).
Examples: /usr/*/file.*, **/file.bin.
6

Add Item to List

Select Add to add the item to the Allow and Block list.Optionally, toggle Add another item in the lower-left corner to continue adding items.
Add item dialog for Allow or Block list
7

Save Configuration

Select Save in the lower-right corner. Settings deploy and activate automatically on enrolled devices in the assigned Blueprints.

​
Determine Hash Value

The Hash item type is only supported for files. The Path item type is supported for both files and applications.
Use Terminal to determine the SHA256 hash value of a file:

​
Considerations

  • Response selection: Choose Detect Only to list detections without blocking, or Protect to quarantine known file threats on a Mac
  • Behavioral detection: Enable behavioral detections to monitor threats; consider impact on performance and false positive rates
  • User alert management: Configure user alerts to balance security awareness with user experience when files are quarantined
  • Device isolation: EDR provides device isolation for quarantining compromised devices from the network
  • Allow and block list management: Maintain accurate lists to prevent legitimate applications from being blocked while ensuring malicious software is identified
  • Hash vs. path configuration: Use hash-based entries for specific file versions and path-based entries for applications that may update frequently
  • Testing and validation: Test configuration changes on a pilot device before broad deployment

​
Viewing Edit History in the EDR Library Item

You can review edits to the EDR Library Item on its Activity tab or in Activity.
1

Open Activity

Select Activity on the EDR Library Item, or select the Activity icon in the top-right navigation bar to open Activity.
2

Review the edit

Select the disclosure triangle next to Library Item Edited. The entry shows who edited the Library Item and when.
Activity tab with Library Item Edited expanded, showing Edited By and Edited

Endpoint Detection & Response (EDR) Overview

Review EDR capabilities for Mac and Windows

Testing EDR malware detection

Validate file detection with the EICAR test file

Testing EDR behavioral detections

Validate behavioral detection in Detect and Protect

Understanding the Detections Page

Review detections, filters, and the threat detail panel