Enable EDR in CA Configuration Profile

As part of cloud agent installation and setup, enable EDR for the configuration profile and review/update EDR configuration settings.

Toggle Enable EDR module for this profile to ON. This is required for EDR data collection.
Configure what EDR artifacts are transmitted to the Qualys Cloud Platform. Defaults are provided as shown, so this step is optional. You can configure values for max event log size, payload threshold time, and maximum disk usage for EDR data. Toggle a configuration setting to ON before you use it. You must set at least one configuration setting to ON if you have enabled EDR for this profile.

We recommend you set up asset tags for your EDR assets using the Global IT Asset Inventory. This makes it easy to associate EDR assets with a CA configuration profile enabled for EDR.

EDR settings are available only when EDR is enabled for your subscription.

Configuration Profile Creation wizard - Sample CA configuration profile showing QES settings.

Configure settings constitute the time lapse after which the following types of EDR events are transmitted to the Qualys Cloud Platform:

Max event log size: EDR events are transmitted to the Qualys Cloud platform when the EDR event log file reaches the maximum specified size. You can specify a file size between 10 KB and 10240 KB. The default is 1024 KB. This value can be lower if the Payload threshold time is lower.
Payload threshold time: EDR events are transmitted to the Qualys Cloud platform when the EDR payload threshold time is hit; the specified seconds elapse after the previous payload was sent to the Qualys Cloud Platform. You can set a threshold between 30 seconds and 1800 seconds. The default is 60 seconds. This value is low to prevent data loss on busy systems.
Maximum disk usage for EDR Data: This is the maximum size on disk available to a Cloud Agent for caching EDR events to be sent to the Qualys Cloud Platform for processing. If the maximum size is reached, the oldest events are deleted to create space for newly generated events. You can specify a disk usage size between 100 MB and 2048 MB. The default is 1024 MB.