Epp 20260910

docs/endpointprotector/admin/dc_module/globalsettings.md

@@ -975,30 +975,52 @@ If Tamper Mode is enabled, the script only works on Windows.
 
 #### Windows
 
-**Step 1 –** Run the following script from PowerShell or Command Prompt:
+**Step 1 –** Run the following script from PowerShell or Command Prompt as an administrator:
 
 `"C:\Program Files\CoSoSys\Endpoint Protector\Resources\epp_collect_dpi_info.bat"`
 
 **Step 2 –** Wait for the script to finish. Some steps, such as listing installed apps and
 collecting console logs, can take a few minutes. Don't interrupt the script.
 
 **Step 3 –** Collect the generated files from the output folder the script prints at the end of the
-run, for example `C:\Users\<username>\AppData\Local\Temp\epp_logs`.
-
+run. By default, this is `%TEMP%\epp_logs`.
 
 #### macOS
 
 **Step 1 –** Run the following command as root:
 
-- With Deep Packet Inspection (DPI) on: `sudo /Applications/EndpointProtectorClient.app/Contents/Resources/epp_collect_dpi_info_mac.sh 1`
-- With DPI off: `sudo /Applications/EndpointProtectorClient.app/Contents/Resources/epp_collect_dpi_info_mac.sh`
+`sudo /Applications/EndpointProtectorClient.app/Contents/Resources/epp_collect_dpi_info_mac.sh`
 
 **Step 2 –** Enter the password when prompted. The script must run as root.
 
 **Step 3 –** Wait for the script to finish. Some steps, such as listing installed apps and
 collecting console logs, can take a few minutes. Don't interrupt the script.
 
-**Step 4 –** Collect the generated files from the output folder the script prints, `/tmp/epp_logs`.
+**Step 4 –** Collect the generated files from the output folder the script prints. By default, this
+is `/tmp/epp_logs`.
+
+#### Advanced Options
+
+Both scripts accept optional parameters to also collect Deep Packet Inspection (DPI) diagnostics
+(network, proxy, and certificate information) and to change the output folder. Both scripts delete
+the destination folder if it already exists and recreate it, then print the final path where they
+save the collected files.
+
+**Windows:**
+
+`epp_collect_dpi_info.bat -dpi --output="C:\epp_logs"`
+
+- `-dpi` (or `/dpi`, `--dpi`) — also collects DPI information (network, WFP, proxy). Without this
+  flag, the script only collects basic logs and configuration.
+- `--output="C:\path"` (or `-output`, `/output`) — sets the destination folder. Defaults to
+  `%TEMP%\epp_logs`.
+
+**macOS:**
+
+`sudo /Applications/EndpointProtectorClient.app/Contents/Resources/epp_collect_dpi_info_mac.sh 1 /tmp/epp_logs`
+
+- First parameter — `1` also collects DPI information (network, proxy, certificates); `0` skips it.
+- Second parameter (optional) — sets the destination folder. Defaults to `/tmp/epp_logs`.
 
 ### Data Obfuscation Rules
 

docs/endpointprotector/admin/systemdashboard.md

@@ -8,7 +8,7 @@ sidebar_position: 20
 
 After the Endpoint Protector Hardware or Virtual Appliance setup is complete, access the User Interface from the assigned IP address.
 
-The default Endpoint Protector Appliance IP address is https://192.168.0.201
+Use your assigned Appliance IP address, for example, `https://192.168.0.201`.
 
 :::note
 Always use the IP address with HTTPS (Hypertext Transfer Protocol Secure).
@@ -21,7 +21,7 @@ ticket through the
 
 To configure settings or create administrators, see [System Configuration](/docs/endpointprotector/admin/systemconfiguration/overview.md).
 
-![Page for default login credentials for the root account](login.webp)
+![Page for default login credentials for the root account](serverlogin.webp)
 
 ## Configuration Wizard
 
@@ -52,7 +52,7 @@ important activities logged by Endpoint Protector.
 You will view more specific dashboards on the Device Control, Content Aware Protection and eDiscovery
 sections.
 
-![View general information as graphics and charts related to the most important activities](general.webp)
+![View general information as graphics and charts related to the most important activities](dashboard.webp)
 
 ## System Status
 

docs/endpointprotector/gettingstarted.md

@@ -6,12 +6,13 @@ sidebar_position: 2
 
 # Getting Started
 
-Welcome to Netwrix Endpoint Protector, your solution for securing endpoint data. With features like
-Device Control, Content Aware Protection, eDiscovery, and Enforced Encryption, Endpoint Protector
-safeguards against data breaches originating from a wide range of endpoints, including portable storage devices
-such as USB flash drives, external HDDs, digital cameras, MP3 players, and iPods. These devices connect
-seamlessly to Windows, Mac, or Linux computers, increasing the risk of data theft or
-accidental loss. Ensure compliance and protect sensitive information with Netwrix Endpoint Protector.
+Welcome to Netwrix Endpoint Protector, a data loss prevention (DLP) platform that secures endpoint
+data across Windows, macOS, and Linux. With features like Device Control, Content Aware Protection,
+eDiscovery, and Enforced Encryption, Endpoint Protector safeguards against data breaches
+originating from a wide range of endpoints, including portable storage devices such as USB flash
+drives, external HDDs, digital cameras, MP3 players, and iPods. These devices connect seamlessly to
+Windows, Mac, or Linux computers, increasing the risk of data theft or accidental loss. Ensure
+compliance and protect sensitive information with Netwrix Endpoint Protector.
 
 ## System Requirements
 
@@ -45,6 +46,13 @@ For more information, see [System Configuration](/docs/endpointprotector/admin/s
 
 ## Configuring Device Control
 
+[Device Control](/docs/endpointprotector/admin/dc_module/dcmodule.md) governs data movement across
+dozens of device categories, including removable storage (USB flash drives, external hard drives,
+and memory cards), mobile devices (smartphones and tablets), imaging devices (digital cameras and
+webcams), connectivity interfaces (Bluetooth, Wi-Fi, Thunderbolt, and FireWire), and peripherals
+such as printers, card readers, and biometric devices. Device Control policies apply consistently
+across Windows, macOS, and Linux endpoints.
+
 - Create Device Control Policies:
 
     - Navigate to Device Control.
@@ -55,6 +63,16 @@ For more information, see [Device Control](/docs/endpointprotector/admin/dc_modu
 
 ## Configuring Content Aware Protection
 
+[Content Aware Protection](/docs/endpointprotector/admin/cap_module/capmodule.md) is Endpoint
+Protector's data loss prevention module for data in motion. It inspects file transfers, clipboard
+actions, print jobs, and network communications for sensitive content, combining content-aware
+detection (what the data contains) with context-aware detection (how and where it's being
+transferred) to block or report on policy violations before sensitive data leaves the
+organization. Content Aware Protection and eDiscovery policies also recognize labels from
+third-party document classification tools, including
+[Netwrix Data Classification](/docs/endpointprotector/admin/denylistsallowlists/denylists.md#ndc-classification)
+and [Microsoft Purview Information Protection](/docs/endpointprotector/admin/denylistsallowlists/denylists.md#microsoft-information-protection).
+
 - Create Content Aware Policies:
 
     - Navigate to Content Aware Protection > Content Aware Policies.
@@ -65,6 +83,12 @@ For more information, see [Content Aware Protection](/docs/endpointprotector/adm
 
 ## Configuring an eDiscovery Scan
 
+[eDiscovery](/docs/endpointprotector/admin/ed_module/edmodule.md) is Endpoint Protector's
+data-at-rest scanning module. It scans data stored on Windows, macOS, and Linux endpoints to
+discover, encrypt, or delete sensitive data wherever it resides. In addition to
+administrator-initiated scans, eDiscovery supports user-initiated scans, letting end users start
+their own data-at-rest scans directly from the Endpoint Protector Client.
+
 - Setup eDiscovery Scans:
 
     - Navigate to eDiscovery > Policies and Scans.
@@ -103,6 +127,11 @@ For more information, see [Offline Temporary Password](/docs/endpointprotector/a
 
 ## Deploying Agents
 
+The Endpoint Protector Client runs natively on Windows, macOS, and Linux distributions, including
+Ubuntu LTS and Red Hat Enterprise Linux (RHEL), with native ARM64 builds available. This lets
+administrators apply and enforce the same data protection policies across mixed-OS environments
+from a single console.
+
 - Deploy Netwrix Endpoint Protector Agents:
 
     - Access System Configuration > Client Software.
@@ -133,6 +162,15 @@ For remediation action details, see
 
 ## Deploying Enforced Encryption
 
+[Enforced Encryption](/docs/endpointprotector/admin/ee_module/eemodule.md) centralizes management
+of encrypted removable storage. It enforces FIPS 140-3 validated encryption on USB storage
+devices, and administrators can remotely reset a protected device to delete the sensitive data it
+holds. Administrators can also control whether Enforced Encryption launches on computers where the
+Endpoint Protector Client isn't installed, and whether it runs in
+[read-only mode](/docs/endpointprotector/admin/ee_module/eemodule.md#enforced-encryption-in-read-only-mode)
+on those unmanaged computers — for example, when a protected device is used outside the
+organization.
+
 - Automatic Deployment:
 
     - Go to Device Control > Global Rights.

docs/endpointprotector/requirements/client.md

@@ -6,6 +6,10 @@ sidebar_position: 20
 
 # Client
 
+The Netwrix Endpoint Protector Client runs natively on Windows, macOS, and Linux, on both x86
+64-bit and ARM64 hardware, enforcing the same data protection policies regardless of operating
+system or CPU architecture.
+
 ## Lightweight, Cross-Platform Design
 
 The Endpoint Protector Client doesn't require OS kernel-level integration. This design reduces the
@@ -59,6 +63,8 @@ active, and policies are configured for a stress test:
 | RAM       | 30 MB                                                                     | 30 MB (in general) > 30 MB (during scanning)                              | 30 MB (in general) > 30 MB (during scanning)                              |
 | Bandwidth | < 1 Kbs (when idle) > 1 Kbs (when sending logs or uploading shadow files) | < 1 Kbs (when idle) > 1 Kbs (when sending logs or uploading shadow files) | < 1 Kbs (when idle) > 1 Kbs (when sending logs or uploading shadow files) |
 
+These CPU figures apply equally to x86 64-bit and ARM64 architectures.
+
 ## Security Exclusions
 
 To maintain the optimal performance and stability of the Endpoint Protector Client, configure

docs/endpointprotector/requirements/components.md

@@ -7,6 +7,20 @@ sidebar_position: 10
 
 # Main components
 
+Netwrix Endpoint Protector is a client-server data loss prevention (DLP) solution that scales from
+small business environments to large, distributed enterprises. The Endpoint Protector Server
+enforces security policies across the organization, while the Endpoint Protector Client applies
+those policies locally on each Windows, macOS, or Linux computer, whether it runs on x86 64-bit or
+ARM64 hardware. This architecture delivers full
+Device Control alongside Content Aware Protection, eDiscovery, and Enforced Encryption, all
+configurable at a granular level, down to individual users, computers, and groups. Administrators
+can set each policy to log activity without blocking it, block it outright, or block it
+interactively with user remediation, so a single deployment can address a range of business and
+compliance use cases. For large enterprises, the
+[System Departments](/docs/endpointprotector/admin/systemconfiguration/adminandaccess.md#system-departments)
+feature splits the endpoint population into separate administrative divisions, each with its own
+delegated administrators managing only their own devices, computers, and users.
+
 Endpoint Protector's design centers on several physical entities:
 
 - Computers—the Windows, macOS, and Linux workstations that run the Endpoint Protector Client
@@ -17,8 +31,7 @@ The server side of Endpoint Protector has several parts working together:
 
 - **Endpoint Protector Hardware or Virtual Appliance**—contains the operating system, database, and supporting services
 - **MySQL Database**—stores configuration data, agent provisioning settings, information about users and groups, and policy definitions
-- **CrateDB**—a distributed SQL database that stores Device Control, Content Aware Protection, and eDiscovery logs. CrateDB, optimized for time-series log data, provides faster queries and horizontal scalability for environments with high log volumes
-- **Redis**—an in-memory data store that buffers incoming agent logs before Endpoint Protector ingests them into CrateDB
+- **CrateDB**—a distributed SQL database, optimized for time-series data, that stores Device Control, Content Aware Protection, and eDiscovery logs, providing faster queries and horizontal scalability for environments with high log volumes
 - **Web Service**—communicates with the Endpoint Protector Clients and stores the information they send
 - **Endpoint Protector User Interface**—manages the existing devices, computers, users, groups, and their behavior in the system
 
@@ -50,9 +63,9 @@ protection rules and logs activity for auditing purposes.
 The Endpoint Protector server uses a lastest MySQL LTS database that stores configuration data, agent provisioning settings,
 user activity logs, and incident reports. MySQL handles agent registration, policy definitions, entity management, and other provisioning data.
 
-**Relational Database Management System**
+**CrateDB**
 
-Relational Database Management System is a distributed SQL database optimized for time-series log data. Endpoint Protector uses RDBMS to store Device Control, Content Aware Protection, and eDiscovery logs. You can deploy RDBMS as a single node on the Endpoint Protector (EPP) server appliance or as a multi-node cluster for environments that generate high log volumes. You can add cluster nodes with minimal downtime and availability impact.
+CrateDB as Relational Database Management System is a distributed SQL database optimized for time-series log data. Endpoint Protector uses RDBMS to store Device Control, Content Aware Protection, and eDiscovery logs. You can deploy RDBMS as a single node on the Endpoint Protector (EPP) server appliance or as a multi-node cluster for environments that generate high log volumes. You can add cluster nodes with minimal downtime and availability impact.
 
 **Firewall/gateway device**