Skip to content

Endpoint agent settings

Coro provides specific endpoint device monitoring capabilities. To access these settings, navigate to Control Panel > Devices > Settings:

The following settings are available:

Heartbeat interval

The Heartbeat Interval defines how often Coro pings endpoints to monitor their security status. Choose a value from the drop-down list.

Tamper protection

Enable Temper Protection to prevent users and certain types of malware from tampering with important security features and disabling protection. The Coro agent tamper protection prevents malicious software from terminating or tampering with the Coro agent in any way.

Advanced threat control

When enabled, Coro monitors active processes for known and potential threats, and blocks processes (that are not explicitly allowlisted) that exhibit suspicious behavior.

VSS (Volume Shadow Copy Service) backup protection

When enabled, Coro enforces backup snapshots every four hours and blocks processes that exhibit risks to the backup. For further information, see Using VSS backup protection on your Windows endpoints

Enhanced EDR block mode

When Coro Endpoint Protection is used side-by-side with Windows Defender Antivirus, Coro provides added endpoint detection and response (EDR) from malicious artifacts. Enhanced EDR block mode stratifies this added protection by ensuring access to timely data that may otherwise be suppressed by the environment.


The Settings apply to all devices in the workspace.