Migrate from Traps Endpoint Security Manager to Traps Management Service

Activate the Traps Management Service.
As an existing ESM customer, you can use your ESM Auth code to activate Traps management service without purchasing additional licenses. Using the same Auth code enables you to apply the same license pool and expiration specifications to your Traps management service instance.
Log into the Hub to activate Traps management service. During activation you can also associate Traps management service with a Cortex Data Lake instance and Directory Sync Service instance.
Import hash overrides as hash exceptions in the Traps management service.
From the ESM Console, select
Settings
.
Generate
a Tech Support File and download it when it finishes.
Extract the
TechSupport
ZIP file which contains two zipped files (one for
Core
and one for
Console
).
Extract the
Console
ZIP file.
Open the
DBQueries
folder and locate the
Verdict_Override_Exports.csv
file.
This file contains all the hash overrides defined in the ESM Console.
Log in to Traps management service and select
Security
Exceptions
Hash Exceptions
.
Select
Actions
Import CVS
.
Select and then
Upload
the
Verdict_Override_Exports.csv
file.

If necessary, resolve any conflicts encountered during the upload and retry.
Select
Import
to confirm and then click
OK
when Traps management service finishes importing the hash exceptions.
Migrate trusted signers and whitelisted paths.
From Traps management service, Add a New Malware Security Profile for any platforms to which you want to add whitelisted signers or paths. Use the default profile settings, or modify an existing profile that you already created.
To allow trusted signers previously seen in your environment, add the signer name (Windows) or SHA256 of the certificate that signs the file (macOS) to the
Whitelist Signers
list of the relevant Malware Security Profile.
Evaluate the WildFire rule(s) for each platform on the ESM Console and identify any whitelisted paths that are still relevant and add them to the
Whitelist Folders
area of the appropriate Malware Security Profile on Traps management service.
There may be more than one WildFire rule with whitelists. While the ESM merges WildFire rules, this capability is not available in Traps management service.
Ensure that you migrate paths to the relevant Malware Security Profile for each platform:
Copy paths in macOS WildFire rules to the Mach-O Files whitelist in a macOS profile.
Copy paths in Windows WildFire rules for Executables or DLL files to the Portable Executables and DLLs whitelist in a Windows profile.
Copy paths in Windows WildFire rules for Office files to the Office Files whitelist in a Windows profile.
Configure a Policy Rule for each group of target objects to which the profile (and any associated hash exceptions) applies.
You can return to
Security
Profiles
Malware Profile
to specify the target objects after you upgrade the Traps agent.
Migrate rules which disable protection on processes.
For each remaining rule which disables protection on a specific process or disables a specific protection module on the process, record the endpoints target endpoints to which the exception applies, and then Create a Process Exception on the Traps management service. You can return to
Process Exceptions
to apply the exception to the specific endpoints after you upgrade the Traps agent.
Upgrade the Traps agent to Traps 5.0 or a later release.
To upgrade to Traps agent 5.0.3 or a later release, you must first upgrade Traps to 4.2.1 for all operating systems. To upgrade to Traps 5.0.0, 5,0.1, or 5.0.2 use the following guidelines for your Traps version:
Traps 4.1 (Windows and Mac) or Traps 4.2 (Linux) and later releases
From Traps management service, Create an Installation Package with an installation type as
Upgrade from ESM
.
Download the package to a location reachable to the ESM.
From the ESM Console, disable services protection and then create an agent action rule to upgrade the Traps agent using the package created from Traps management service.
Because this procedure is valid only for a specific version of Traps agents, we recommend using a condition for the action rule to upgrade the agents which specifies the Traps agent version.
Save and Apply
the rule.
Earlier Traps versions
There are three options for upgrading earlier Traps versions:
Upgrade the earlier version to a version which supports migration using action rules, and then use the previous workflow to upgrade the Traps agent.
Upgrade the Traps agent using a third-party software deployment tool such as JAMF or SCCM. With this method you must uninstall the agent and install a fresh installation package of Traps 5.0 instead of an upgrade package.
Manually uninstall the earlier Traps agent and install a fresh installation package of Traps 5.0.
After the upgraded Traps agent begins communicating with Traps management service. Endpoints that successfully check in with Traps management service are displayed on the Endpoints page and are eligible for assignment in Endpoint Groups and policy rules.
Return to
Policy Rules
and
Exceptions
to restrict by specific endpoints.