Overview

Troubleshooting issues in environments where EgoSecure operates alongside endpoint protection, antivirus, EDR, XDR, DLP, or other security solutions may require additional analysis. Since multiple security products can interact with the operating system at the kernel, file system, network, and process level, potential interactions between these products should be considered during root cause analysis. This article provides general troubleshooting recommendations and summarizes findings from previous support investigations involving EgoSecure and third-party security software.

The presence of a third-party security product does not necessarily indicate an incompatibility with EgoSecure, nor does it imply that the third-party product is responsible for the observed behaviour. The recommendations in this article are intended to support the troubleshooting process and help identify potential interactions that may contribute to an issue.

Possible Symptoms

Depending on the environment, you may observe symptoms such as:

• Security alerts or false positives
• Unexpectedly blocked applications
• Delays during file operations
• Performance degradation
• Unexpected process blocking
• Communication issues between the EgoSecure Agent and Windows
• Problems related to file, device or network operations
• Unusual network-related behaviour

These symptoms do not necessarily indicate that a third-party security software is the root cause.

Security Products Commonly Reviewed

The following products are frequently encountered during support investigations. This list is not exhaustive and does not imply any known incompatibility with EgoSecure.

Recommended Troubleshooting Steps

The following recommendations are intended to help identify potential interactions between EgoSecure and third-party security software. Depending on the environment and the products involved, not every step may be required. However, these checks have proven useful during previous support investigations and can help narrow down the root cause of an issue.

Step 1: Review Installed Security Software

Identify every security-related product installed on the affected system. Examples include:

• Antivirus
• Endpoint Protection
• EDR / XDR
• DLP
• Monitoring agents
• Security hardening tools

Document the exact product versions whenever possible.

Step 2: Configure Temporary Exclusions

If permitted by your organization's security policies, configure temporary exclusions for EgoSecure components. The EgoSecure installation directory is typically:

C:\Program Files\EgoSecure

or

C:\Program Files (x86)\EgoSecure

for legacy 32-bit agents. For the current list of EgoSecure drivers, services and optional components, please refer to EgoSecure Agent drivers. Depending on the security product, exclusions may need to be configured as:

• Path exclusions
• Process exclusions
• Driver exclusions 

Step 3: Review Loaded File System Filters

Review the currently loaded file system filter drivers by executing:

fltmc

Compare affected and unaffected systems whenever possible.

Step 4: Perform Comparative Testing

If organizational policies allow:

• Configure temporary exclusions
• Compare affected and unaffected systems
• Test on a dedicated test system
• Temporarily disable or uninstall the third-party security software

Known Cases

The following cases are based on previous support investigations and represent scenarios that have been observed in customer environments. They are intended to provide additional context and may help identify known patterns or interactions involving EgoSecure and third-party security software.

Case 1: Trend Micro Vision One Reports "Connection from Non-browser Application"

In some environments, Trend Micro Vision One may generate alerts such as "Connection from Non-browser Application to Twitter" or "Connection from Non-browser Application to Reddit", with the EgoSecure Agent identified as the originating process.

This behaviour is related to the EgoSecure HTTP Audit feature, which performs reverse DNS lookups through the Windows DNS API. Certain security products may interpret these DNS requests as browser-related network traffic and generate corresponding alerts. Based on previous investigations, this behaviour is considered expected and is not currently known to be caused by a defect in EgoSecure. In such cases, the alert is typically classified as a false positive generated by the security solution.

If these alerts are observed, review the exclusion and alerting configuration within Trend Micro Vision One. For the current list of EgoSecure drivers and components, refer to EgoSecure Agent drivers.

Case 2: Performance degradation with Trend Micro Worry Free Business Security and Application Control 

Performance degradation has been observed in environments where EgoSecure Application Control (APC) is used together with the Trend Micro Worry Free Business Security Agent. This issue was resolved in Endpoint Data Protection 25.4.0.4. According to the release notes, a performance degradation issue affecting Application Control when used alongside certain third-party security solutions, including Trend Micro Worry Free Business Security, was corrected.

Customers using both products should upgrade to Endpoint Data Protection 25.4.0.4 or later before performing further troubleshooting, as the issue may already be resolved in newer versions.

Additional Support 

If the issue persists after performing the troubleshooting steps described above, contact Matrix42 Endpoint Security Support and provide the following information: 

• EgoSecure version 
• Windows version 
• Third-party security software (including version) 
• fltmc output 
• Relevant EgoSecure logs (set to Debug level) 
• Relevant Windows Event Logs 
• Procmon trace (if requested)