Last Updated: December 16, 2025

Overview

The Multi-platform deployment removes the need to install an antivirus application on every VM, and it is the original agent-based deployment option.

The Multi-platform deployment option offloads all scanning to a dedicated VM — an SVM — that runs Trellix Endpoint Security (ENS) Threat Prevention software. Guest VMs are no longer required to run antivirus software locally, which improves performance for antivirus scanning, and increases VM density per hypervisor.

The Multi-platform deployment option:

• Uses ePO - On-prem to manage the Trellix MOVE AntiVirus configuration on the client systems, SVM, and SVM Manager.

• Uses the Trellix Agent for policy and event handling.

• Uses ePO - On-prem for reports on viruses that are discovered on the VMs.

• Uses Trellix® Threat Intelligence Exchange (TIE) and Trellix Intelligent Sandbox technologies to perform in-depth analysis of suspect files (using local, global, and enterprise-level caches), define threat reputation and take the required actions.

First-time installation workflow (Multi-platform)

To install and configure the Trellix MOVE for Multi-Platform environment, see the first-time installation high-level workflow diagram shown below:

Upgrade installation workflow (Multi-platform)

To upgrade the Trellix MOVE for Multi-Platform software and remain updated with the new features, see the Upgrade (Multi-platform) workflow diagram shown below:

System and hardware requirements

Make sure that each of your guest VMs is running a supported version of Microsoft Windows and confirms to these requirements

Hypervisor requirements

All hypervisors are supported, but only those listed were tested.

• VMware ESXi 6.0 or later

• Citrix XenServer 6.0 or later

• Microsoft 2012 R2 Hyper-V or later

• Nutanix AHV 20170830.395 or later

SVM requirements

The SVM requires a dedicated virtual machine with Endpoint Security Threat Prevention November 2021 update or above installed.

Note: You need to first deploy Trellix Agent, followed by Trellix ENS software and then MOVE SVM package.

The virtual machine must meet these requirements:

Note: Make sure that the Windows security updates are up to date.

Note:

Trellix MOVE AntiVirus requires Microsoft Visual C++ 2019 Runtime and it is bundled with SVM package.

SVM Manager requirements

Important

It is recommended to keep SVM on the same host where most of the clients are located, it improves the performance of the SVM.

Note:

SVM Manager is shipped as an OVF package (Linux, Ubuntu 20.04 (64-bit)) and comes preinstalled with the required software.

Client system requirements

The Trellix MOVE AntiVirus client software requires a Trellix Agent for one of these operating Trellix MOVE AntiVirus systems:

Note

Trellix MOVE AntiVirus (Multi-platform) requires Microsoft Visual C++ 2019 Runtime and it is bundled with client package.

Supported Trellix management platform and software

You must have specific versions of Trellix management platform and software installed.

Ports for Multi-platform deployment

Following are the ports that are open and not reserved for other purposes:

Note

If required, you can customize the default ports.

Installation prerequisites

Begin the installation once the environment meets the specified requirements.

Pre-installation tasks

You can check-in the software and extensions on ePO - On-prem server in either ways:

• Manually download software extensions and packages and check-in to ePO - On-prem server

• Check-in the extensions and packages to ePO - On-prem using ePO - On-prem Software Catalog

Note

In the ePO - On-prem version 5.10.0 and above, the term Software Manager is identified as Software Catalog.

Download software extensions and packages

If not using Software Catalog, you can download these software extensions and product packages from the Trellix download site (https://www.trellix.com/en-us/downloads) and check in them to ePO - On-prem server.

The software package consists of Trellix MOVE AntiVirus extensions.

• MDCC_5.3.x.xx.zip

• VSPHEREDCEXTN_5.4.x.xx.zip

• DC__GS__4000_4.10.x.xx.zip

• DC__AM__4000_4.10.x.xx.zip

• MOVEAVLIC400_4.10.x.xx.zip

Note

Make sure that you download the required extensions and packages from the Trellix download site.

Check in the extensions and packages to ePO - On-prem manually

The Trellix MOVE for Multi-Platform extensions and Trellix ENS extensions must be installed on the ePO - On-prem server before you can manage Trellix MOVE for Multi-Platform on your virtual machines.

Make sure that the extension files are in an accessible location on the network.

Trellix ENS is only licensed for the SVM, not for other Windows systems in your environment.

(Optional) Install the Trellix ENS for Linux Threat Prevention extension to manage the Trellix ENS for Linux Threat Prevention policy on the SVM Manager. Trellix ENS for Linux Threat Prevention is only licensed for the SVM Manager, not for other Linux systems in your environment.

Note

Install the extensions Trellix Data Center Control, vSphere Connector Extension, and Trellix MOVE AntiVirus specific extensions (MOVE AntiVirus, MOVE AntiVirus Common) on the ePO - On-prem server manually. It also checks in the Trellix MOVE AntiVirus SVM and Client packages to the Main Repository.

1. Log on to ePO - On-prem as an administrator.

2. To check in the packages, select Menu → Software → Main Repository → Check In Package.

3. For File path, browse and select the individual packages as mentioned below, then click OK

4. If you are using individual extensions instead of meta package, check in the extension and packages individually:

1. Select Menu → Software → Extensions → Install Extension.
           The Install Extension page opens.

2. Browse and select the extension files in the same order as mentioned below, then click Open → OK:

c. Review the extension details and click OK.

d. To check in the packages, select Menu → Software → Main Repository → Check In Package.

e. For File path, browse and select the individual packages as mentioned below, then click OK:

Check in the extensions and packages to ePO - On-prem from Software Catalog

If you have Software Catalog, you can check in the software extensions and packages to the Main Repository without downloading them.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Software, then click Software Catalog.

3. From Software (by Label) → Endpoint Security, select these extensions, then click Check In.

All extensions and packages are checked in to the Main Repository from the Software Catalog.

Note

You must download other Trellix MOVE Multi-Platform packages from the Trellix download site (http://www.trellix.com/us/downloads/).

Register a VMware vCenter account with ePO - On-prem

To use Trellix MOVE for Multi-Platform to manage the security of the virtual machines in your data center, you must first add your VMware vCenter to the ePO - On-prem server.

Make sure that:

• You have configured your VMware vCenter server that manages the ESXi servers, which host the guest VMs.

• You have installed the Trellix MOVE for Multi-Platform software extension on the ePO - On-prem server.

1. Log on to ePO - Onprem as an administrator.

2. Select Menu → Configuration → Registered Cloud Accounts.

3. From the bottom-left click Actions → Add Cloud Account to open the Add Cloud Account dialog box.

4. From the Choose Cloud Provider drop-down list, select VMware vSphere and click OK.

5. On the vCenter Account Details page, configure these options.

Note

You must have a vCenter Server user account with administrator rights to use the autoscale feature.

6. Click Test Connection to validate VMware vCenter account details and verify the connection to the VMware vCenter, then click Next → Finish.

7. When prompted to confirm, click OK to register the vCenter account and wait for vCenter sync to complete.

This action registers the VMware vCenter and imports all discovered virtual machines, which are unmanaged, into the System Tree. The instances are imported with the same organization as the VMware vCenter.

Note

The virtual machines that are already added and managed by ePO - On-prem are retained with the existing policy settings, but the virtualization properties for these systems are added.

Set up a general configuration for deployment

Before deploying Trellix MOVE AntiVirus SVM Manager, configure settings on the ePO - On-prem server, so that they are retrieved and used for every Trellix MOVE AntiVirus SVM Manager deployment.

Make sure that you have registered a VMware vCenter account with the ePO - On-prem.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Automation → MOVE AntiVirus Deployment.

3. In the Configuration tab, click General under General list.

   The General Configuration page opens.

4. Enter and confirm the password for ePO - On-prem Credentials section.

ePO - On-prem credentials

5. Enter and confirm password for SVM (Agentless) and SVM Manager (Multi-Platform) Configuration section.

Note

The SVM (Agentless) and SVM Manager (Multi-Platform) Configuration section shows a default password.

Caution

The password you enter is set to the SVM Manager and you can't update it once it is deployed. This password is not applicable to the SVM Manager, which is already deployed.    

If required, change the password.

SVM (Agentless) and SVM Manager (Multi-platform) Configuration

Note

The password configured for SVM (Agentless) and SVM Manager (Multi-platform) Configuration is assigned to SVM Manager which is deployed from SVM Manager Configuration page.    

6. Click Save to store these configurations, so that you can use them for every Trellix MOVE AntiVirus SVM Manager deployment.

SVM assignment made easy

    An SVM can generally be assigned to 150–300 endpoints, depending on the load of the endpoints.

    Assigning policies to the SVM manually is a time-consuming task. The SVM Manager creates assignments based on IP address and tags where a range of endpoints are automatically assigned to a group of SVMs.

SVM autoscaling

The virtual environments are dynamic with the number of instances depending on time of the day and day of the week.

Provisioning your SVMs to accommodate this variation manually is not a scalable solution. You might end up running more SVMs than you require to accommodate peak load. Or, you might end up running fewer SVMs, resulting in endpoints not being protected.

The security administrator can define the number of backup SVMs that are ready to protect your client systems. Calculate the number of ready SVMs required for the maximum number of clients that need protection at any time of the day. The standby SVMs are automatically deployed based on the backup SVM value. For example, if you specify the backup SVM as 4, two standby SVMs are deployed automatically. The SVMs automatically scale up and down depending on the number of endpoints connected.

The SVM deployment automatically transitions between three modes:

• Standby — Standby SVMs are created and are ready to transition to the backup SVM mode. The standby SVMs are automatically deployed based on the backup SVM value. These SVMs are turned off.

• Ready — Backup SVMs that are ready for protecting your client systems. You need to calculate the number of ready SVMs required for the maximum number of clients that would need protection at any time of the day. These SVMs are turned on, but not protecting the client systems.

• Running — These SVMs are currently protecting the client systems.

Multi-platform deployment process using Trellix MOVE AntiVirus autoscaling with SVM Manager

Using Trellix MOVE AntiVirus SVM autoscaling, the overall Trellix MOVE AntiVirus SVM deployment of the Multi-Platform option consists of the following tasks.

1. Install the extensions on ePO - On-prem and register a VMware vCenter account with ePO - On-prem

2. Install Trellix Agent on the endpoints

3. Configure ePO - On-prem details for deployment and create or edit the infrastructure group on ePO - On-prem

4. Deploy SVM Manager        

   1. Deploy Trellix MOVE AntiVirus SVM

   2. Assign the SVM Manager to SVM

   3. Configure assignment rules in SVM Manager Settings policy

5. Export the SVM template and specify the Trellix MOVE AntiVirus SVM path in ePO - On-prem.

Note

This is required only when you are using autoscaling method.

a.  Create or edit the infrastructure group on ePO - On-prem

b.  Configure the SVM Autoscale Settings in SVM Manager Settings policy and assign it to SVM Manager

6.  Deploy the Trellix MOVE AntiVirus Client using ePO - On-prem

The SVM ready pool is now created based on the number of backup SVMs specified. The backup SVMs that you specified in ePO - On-prem are deployed automatically.

A Trellix MOVE AntiVirus SVM can generally be assigned to 150–300 endpoints, depending on the load of the endpoints. The security administrator can define the number of backup SVMs that are ready to protect your client systems. Calculate the number of ready SVMs required for the maximum number of clients that need protection at any time of the day.

The standby SVMs are automatically deployed based on the backup SVM value. For example, if you specify the backup SVM as 4, 2 standby SVMs are deployed automatically. The SVMs automatically scale up and down depending on the number of endpoints connected.

When a Trellix MOVE AntiVirus client system starts communicating with the SVM Manager, one SVM from the ready pool moves to the running pool and protects the client system. The transition from the ready pool to running pool occurs when no running SVMs exist or all running SVMs have reached their client limit. The ready pool is again replaced with one Trellix MOVE AntiVirus SVM from the standby pool.

One Trellix MOVE AntiVirus SVM is automatically deployed to the standby pool to retain the number of standby SVMs, which is specified in ePO - On-prem.

Configure Multi-platform product without SVM Manager

The overall Trellix MOVE AntiVirus Multi-platform SVM deployment consists of the following tasks.

1. Install the extensions on ePO - On-prem

2. Install Trellix Agent on the endpoints

3. Deploy the Trellix MOVE AntiVirus SVM

4. Deploy the Trellix MOVE AntiVirus client

5. Configure the Trellix MOVE AntiVirus SVM details in the Options policy

Note

Configuring the Multi-platform product without SVM Manager is recommended only if you are planning to have one SVM.

Create or edit an infrastructure group in ePO - On-prem for SVM Manager deployment

After registering your vCenter account, your default group is added to the MOVE AntiVirus Deployment wizard when you access the Infrastructure Details option under General. You can edit the details of the default infrastructure group, as needed.

• You installed the Trellix MOVE AntiVirus Meta Package extension on the ePO - On-prem server.

• You registered your VMware vCenter account with ePO - On-prem.

You can deploy the SVM Manager to any infrastructure group using ePO - On-prem. With the Infrastructure Details option, you can create or edit a hypervisor-based or cluster-based infrastructure group. You can then customize and select the infrastructure group for SVM Manager deployment.

You can include individual infrastructure groups for SVM Manager deployment.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Automation → MOVE AntiVirus Deployment.

3. On the Configuration tab, click Infrastructure Details.

4. Edit the default infrastructure group options, as needed.

5. (Optional) Click Actions → Create and configure properties for the custom infrastructure group. You don't need to configure the custom group options when the default group is available.

6. Click Save to store the infrastructure group details.

Check in the SVM Manager OVF package using ePO - On-prem

Check in the SVM Manager OVF package to the ePO - On-prem server, so that ePO - On-prem can deploy it to your hypervisor.

Make sure that:

• You have installed the Trellix MOVE AntiVirus extension on the ePO - On-prem server.

• You have registered a VMware vCenter account with ePO - On-prem.

• You have set up a general configuration for deployment.

• You must add Global_GCC_Code_Signing.cer, Global_Code_Signing.cer, and GlobalSign.cer to the vCenter certificate store. These certificates are available in Global_Certificate.zip package.

• Add certs as Trusted root certificates in vCenter.

• To add a certificate, logon to vCenter → Administration → Certificates → Certificate Managment → Add as Trusted Root Certificate.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Automation → MOVE AntiVirus Deployment.

3. On the Configuration tab, click SVM Manager Configuration to open the SVM Manager OVF Details page with these SVM Manager options.

4. Click Actions → Add SVM Manager to open the Check-in SVM Manager OVF (zip) File page.

5. Under SVM Manager OVF Check-in, configure these options:

   • Select SVM Manager OVF (zip) file to check-in — Browse to and select the SVM Manager OVF package (MOVE-AV-MP_SVM_Manager_OVF_ 4.9.0.195.zip).

   • Specify the location of Trellix ePO - On-prem system — Specify the SVM Manager OVF package location on the ePO - On-prem server (for example, C:\SVM Manager). The package is taken from this location during deployment to the hypervisor.

6. Click OK to check in the package.

Note

Make sure you create a new virtual machine using MOVE-AV-MP_SVM_Manager_OVF_4.10.1.168 package as the SVA Manager OVF upgrade from the MOVE AntiVirus Deployment page is not supported. In the Option Policy, replace the existing SVA Manager IP with the newly created SVA Manager IP once ePO - On-prem is connected and the previous SVA Manager IP can be deleted from the vCenter.

The SVM Manager OVF package appears in the specified folder on the ePO - On-prem server. Also, the SVM Manager details appear on the SVM Manager OVF Details page.

To deploy SVM Manager in a VMware vCenter environment, see

Deploy SVM Manger from Trellix MOVE AntiVirus deployment page

Using the ePO - On-prem console, deploy the SVM Manager to your hypervisors, so that it automatically assigns the SVM to a group of clients.

Note

You need to have the vendor specific tool for conversion installed on your systems to deploy SVM Manager on Citrix Xenserver and Microsoft Hyper-V environments.

Make sure that:

• You have installed the Trellix MOVE AntiVirus extension on the ePO - On-prem server.

• You have registered your VMware vCenter account with ePO - On-prem.

• Your VMware vCenter account is synced successfully.

• You have configured your ePO - On-prem details about the General page under Menu → Automation → MOVE AntiVirus Deployment → Configuration.

• You configured your Infrastructure Group.

• You have checked in the SVM Manager OVF package to the ePO - On-prem server.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Automation → MOVE AntiVirus Deployment.

   The default password for the SVM Manager svaadmin account is Svaadmin$1

   You can change the password from the SVM Manager (Multi-Platform) Configuration option under Menu → Automation → MOVE AntiVirus Deployment → Configuration → General.

3. On the Configuration tab, click SVM Manager Configuration to open the SVM Manager OVF Details page.

4. Under Deployment Configuration, configure these options.

   • Infrastructure Group — Select the Default Group or an infrastructure group you created. The SVM Manager is deployed on this infrastructure group.

   • Checked-in OVF — Select the SVM Manager OVF package that is checked in to the ePO - On-prem server.

   • SVM Manager Settings policy — Select the SVM Manager Settings policy, so that it is assigned to the SVM Manager.

5. Click Deploy SVM Manager to open the Confirm SVM Manager Deployment dialog box.

6. Click OK to deploy the SVM Manager.

On a successful deployment, an SVM-Manager VM is created on the configured infrastructure group. Now, the SVM Manager service can communicate with ePO - On-prem through the Trellix Agent. Also, the selected SVM Manager Settings policy is applied to the SVM Manager.

Check the SVM Manager deployment status

After deploying the SVM Manager, you can view the deployment details on the Deployment Status tab under MOVE AntiVirus Deployment wizard on the ePO - On-prem server.

• You installed the Trellix MOVE AntiVirus extension on the ePO - On-prem server.

• You initiated the SVM Manager deployment using ePO - On-prem.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Automation → MOVE AntiVirus Deployment.

3. On the Deployment Status tab, view the SVM Manager deployment details.

4. Click any SVM Manager deployment job to view these Task Status Details.

Deployment status

Task status

Task type and status details

These are the task types that specify the internal tasks of a deployment job. The task list for one job is displayed in sequence with Start Time, End Time, and Failure Reasons, if applicable.

During SVM Manager deployment

During rollback

SVM Manager in Hyper-V environment

To deploy the SVM Manager on Hyper-V, you must convert the .vmdk file, part of SVM Manager appliance, into a .vhd file.

Note

You need to have the vendor specific tool for conversion installed on your systems to deploy SVM Manager on Citrix Xenserver and Microsoft Hyper-V environments.

Make sure the MOVE-AV-MP_SVM_Manager_OVF_4.10.x.x.zip file is in accessible location.

1. Unzip the MOVE-AV-MP_SVM_Manager_OVF_4.10.x.x.zip file.

2. Using the Microsoft Virtual Machine Converter software, convert the .vmdk file into a .vhd file.

3. Attach the .vhd file as a hard disk to a new VM in Hyper-V.

Setup SVM Manager on vCenter environment manually

You must set up and configure the SVM Manager before deploying the SVM and assigning it to a group of clients. You can use this method for all type of hypervisors.

• You must have administrator rights to perform this task.

• The SVM Manager OVF package is in an accessible location on the network.

1. Open the VMware vSphere client, then click File → Deploy OVF Template.

2. Browse to and select the SVM Manager OVF package (MOVE-AV-MP_SVM_Manager_Pkg.4.10.x.x.zip) on your computer, then click Next to start the installation wizard.

3. Complete the steps in the wizard, accepting the default values or entering different values as needed.

4. When finished, select Power On to turn on the virtual machine and open a Console window to configure the SVM Manager appliance.

5. At the prompt, log on with these credentials:        

   • User name: svaadmin

   • Password: svaadmin

6. Configure the VM appliance with these details:

• Time zone

• Network — DHCP or Static
  (Recommended: select a Static IP address for SVM Manager)

• DNS servers

• IP Address or Hostname of the ePO - On-prem server

Note

It is recommended to use ePO - On-prem IP, even if the hostname resolves from new SVA-manager box.

ePO - On-prem credentials

Check for the correct format of the user name, for example: domain\\user name.

7. Verify that these communication ports are open and reachable on the SVM Manager:

• 8080 — For communication between SVM Manager and the client

• 8081 — For communication between Trellix Agent and ePO - On-prem

• 8443 — For communication between SVM Manager and the SVM

Tip

Best practice: By default, these ports are already opened through the firewall installed on the appliance. However, verify that the firewall settings in your environment are configured to allow communication on these ports.

8. Use this command to manually run the configuration script: sudo /home/svaadmin/.sva-config.

Now, the SVM Manager service can communicate with ePO - On-prem through the Trellix Agent. You must now set the required policies in ePO - On-prem.

Create a SVM deployment client task

Create an SVM deployment client task, so that you can assign that task to virtual machines.

Make sure that:

• You have installed the Trellix MOVE AntiVirus extension on the ePO - On-prem server.

• The Trellix Agent and Trellix ENS 10.x.x are installed on the target virtual system.

Note

Make sure that you check for AMCore Content (DAT) update before deploying the SVM.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Policy → Client Task Catalog.

3. Select Product Deployment in the Client Task Types menu, then select Actions → New Task.

4. Select Product Deployment from the list, then click OK to open the Client Task Builder wizard.

5. Type a name for the task you are creating, and add any descriptive information in the Description field.

6. Make sure that Windows is the only target platform selected.

7. For Products and components:        

   1. For SVM, select Trellix MOVE AV [Multi-Platform] SVM 4.10.x.x from the drop-down list.

   2. Set the action to Install, set the language to Language Neutral, and set the branch to Current.

   3. Leave the Command line setting blank.

8. Review the task settings, then click Save.

The task is added to the list of client tasks for the selected client task type.

Assign an SVM deployment client task

After creating the SVM deployment client task, you must assign that task to virtual machines.

The Trellix Agent must already be deployed to target virtual systems.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Policy → Client Task Assignments, then click the Assigned Client Tasks tab.

3. Click Actions → New Client Task Assignment.

4. Configure these settings, then click Next.        

   • Product — Trellix Agent

   • Task Type — Product Deployment

   • Task Name — The name of the task you used when you created the client task

5. On the Schedule tab, specify the schedule for running the client task, then click Next.

6. Examine the settings on the Summary tab, then click Save to assign the task.

The Trellix MOVE AntiVirus SVM is deployed to systems in the selected group in the System Tree.

Assign the SVM Manager to an SVM

Configure the SVM Manager details in Trellix MOVE AntiVirus Options policy and assign it to the SVMs, so that the SVM Manager and SVMs can communicate to each other.

Make sure that:

• You have installed the Trellix MOVE AntiVirus extension on the ePO - On-prem server.

• You have deployed the Trellix MOVE AntiVirus SVM Manager.

• You have deployed the Trellix MOVE AntiVirus SVM package to the target virtual systems.

1. Log on to ePO - On-prem as an administrator.

2. Click Menu → Policy → Policy Catalog, select MOVE AntiVirus 4.10.x from the Product drop-down list, then select Options

3. Click New Policy or click the name of an existing policy to edit it.

4. Type a name for the new policy (for example, MOVE AV SVM Manager Policy), then click OK.

5. Under SVM Assignment on the policy settings page, select Assign SVM using SVM Manager and configure the SVM Manager details, then click Save.

   • Enter the SVM Manager IP address or FQDN (domain name)

   • Enter the SVM Manager Port. Default is 8080.

6. Assign the configured policy to your SVMs.

The SVM Manager and the SVMs communicate, so that the clients can request the SVM Manager when they require an SVM. SVM Manager serves them an SVM based on the filtering rules created in the SVM Manager Settings policy.

Add or edit an SVM Manager assignment rule using IP address

Using their IP address range, assign a set of endpoints to a selected SVM or multiple SVMs, so that those endpoints are protected by the SVM Manager assignment rule.

Make sure that:

• You have installed the Trellix MOVE AntiVirus extension on the ePO - On‑prem server.

• You have deployed the SVM Manager.

• You have deployed the Trellix MOVE AntiVirus SVM package to the target virtual systems.

Things to remember:

• You can define different rules to overwrite the autoscale settings. After defining the generic SVM autoscale requirements in SVM Autoscale Settings, you can also define rule-based autoscale settings.

• Rule-based autoscale settings can overwrite the regular SVM Autoscale Settings.

• You can separate IP addresses or ranges with a comma (,) or a new line.

1. Log on to ePO - On‑prem as an administrator.

2. Select Menu → Policy → Policy Catalog, select MOVE AntiVirus 4.10.x from the Product drop-down list, then select SVM Manager Settings from the Category drop-down list.

3. Click New Policy or click the name of an existing policy to edit it.

4. Type a name for the new policy (for example, MOVE AV SVM Manager Policy), then click OK.

5. On the Assignment Rules tab on the Policy Settings page, click Add to open the Add/Edit SVM IP Assignment Rule dialog box and configure these settings as needed.

If you are using the autoscale SVM feature, configure these settings.

Note

The Assign SVM if no rule is defined for the above client option is used to assign the SVM to endpoints, which are not defined in any of the rules. By default, this option is enabled.

1. (Optional) Select Enable to get SVM preference from the same subnetto assign an SVM from the same subnet. For details, see SVM preference.

2. Click OK to save your changes.

Add or edit an SVM Manager assignment rule using ePO - On-prem tag

Assign a set of endpoints to a selected SVM using their tag group, so that they are protected by the SVM Manager assignment rule.

Make sure that:

• You have installed the Trellix MOVE AntiVirus extension on the ePO - On-prem server.

• You have deployed the SVM Manager.

• You have deployed the Trellix MOVE AntiVirus SVM package to the target virtual systems.

Things to remember:

• You can define different rules to overwrite the autoscale settings. After defining the generic SVM autoscale requirements in SVM Autoscale Settings, you can also define rule-based autoscale settings

• Rule-based autoscale settings overwrite the regular SVM Autoscale Settings.

• Separate tag names with a comma (,)

• Tag-based assignment rules take priority over IP-based assignment rules

1. Log on to ePO - On-prem as an administrator

2. Select Menu → Policy → Policy Catalog, select MOVE AntiVirus 4.10.x from the Product drop-down list, then select SVM Manager Settings from the Category drop-down list

3. Click New Policy or click the name of an existing policy to edit it

4. Type a name for the new policy (for example, MOVE AV SVM Manager Policy), then click OK

5. In the Tag Assignment Rules tab on the Policy Settings page, click Add to open the Add/Edit SVM Tag Assignment Rule dialog box and configure these settings as needed

If you are using the autoscale SVM feature, configure these settings.

6. (Optional) Select Enable to get SVM preference from the same subnet to assign an SVM from the same subnet. For details, see SVM preference

7. Click OK to save your changes

SVM preference

Selecting the Enable to get SVM preference from the same subnet option, you can assign an SVM to the clients from the same subnet when clients migrate from one hypervisor to another. You must define tag or IP-based rules specifying the SVM's IP address or tag of respective hypervisor/subnet.

For example, consider a scenario where:

• SVM-1, SVM-2, and SVM-3 are in ESXi-1, ESXi-2, and ESXi-3 servers respectively

• You have a client that keeps migrating from one hypervisor to another

• You want to protect the client by an SVM that belongs to the same subnet

With these assumptions, selecting the Enable to get SVM preference from the same subnet option, when the client migrates from one hypervisor to another, it is protected from an SVM that belongs to the same subnet.

Default rule vs custom rules (tag-based or IP-based)

After registering your vCenter account, your default infrastructure group is added to the MOVE AntiVirus Deployment wizard when you access the Infrastructure Details option under Multi-Platform.

When you enable the autoscale SVM feature based on the specified SVMs value under Customize SVM Settings, a default SVM pool is created, then Ready and Standby SVMs are deployed to the default infrastructure group for the default SVM assignment rule.

When you create SVM assignment rules (tag-based or IP-based), you can specify the number of backup SVMs for the rule, then new SVMs are deployed to the selected infrastructure group. The infrastructure group can be default group or user-defined group.

The clients that are not under a tag-based or IP-based rule are protected by the default SVM pool corresponding to the default SVM assignment rule.

• If you bring up the client system that is not part of the SVM assignment rules (tag-based or IP-based), the client system is protected by the SVM pool that is created for the default SVM assignment rule.

• If you bring up the client system that is part of the SVM assignment rules (tag-based or IP-based), the client system is protected by the SVM pool that is created for the custom SVM assignment rule.

Creating more rules consumes more computing resources for deploying SVMs. For example, if you create 10 SVM assignment rules (tag-based or IP-based) specifying backup SVMs as 2, then 2 Ready and 1 Standby SVMs are deployed for each rule.

How autoscale SVM works

A default infrastructure group is added to the MOVE AntiVirus Deployment wizard when you access the Infrastructure Details option under Multi-Platform.

When you enable the autoscale SVM feature, based on the specified SVM's value under Customize SVM Settings, a default SVM pool is created then Ready and Standby SVMs are deployed to the default infrastructure group for the default SVM assignment rule (The SVM assignment rule is created by default for the clients that are not part of user-defined SVM assignment rules. The default SVM assignment rule does not appear on the ePO - On-prem page).

For user-defined SVM assignment rule, the number of backup SVMs can be specified on the Add/Edit SVM Tag Assignment Rule or Add/Edit SVM IP Assignment Rule dialog box under Customize SVM Settings.

Example 1

Consider a scenario where:

• The number of clients — X

• The number of Ready SVMs specified in ePO - On-prem — Y

• The number of Standby SVMs — Z

Depending on the value Y, the time it takes to start protecting the X number of clients varies. If the value of Y is less (considering each SVM protects 250 clients), then for the first time, it takes more time to protect the X clients because that number of required SVMs must be deployed. But eventually all X clients are protected.

You can also bring all these X clients to the Trellix MOVE AntiVirus environment in different batches. For example, if you have 10000 clients in your environment, you can bring them in 2 batches (5000 clients in each batch), so that there is no gap in protecting the clients by SVMs.

Example 2

Consider a scenario where:

• The total number of client systems — 15000

• The number of static client systems (All time turned on) — 6000

• The number of dynamic clients (Keep turned on and off when needed) — 9000

  These 9000 clients are part of 3 SVM assignment rules (a default, one tag-based, and one IP-based rule) — 3000 client systems per each rule

• The number of client systems with a tag-based SVM assignment rule — 3000

• The number of client systems with an IP-based SVM assignment rule — 3000

• The number of client systems with a default SVM assignment rule — 9000 (3000 dynamic and 6000 static)

These 9000 dynamic client systems need immediate protection when they are up and running. These 9000 dynamic client systems can be protected by using the autoscale SVM feature.

You configured the number of Ready SVMs as 4 and the number of Standby SVMs as 2 for each SVM assignment rule (default, tag-based, and IP-based) to protect these 9000 dynamic client systems.

With these 4 Ready and 2 Standby SVMs, dynamic and static client systems must be protected.

Protecting dynamic client systems

• During the peak time, say 9000 client systems are up and running, then first 3000 clients (1000 clients per each rule) are protected immediately [As the 12 Ready SVMs (4 Ready SVMs of each rule) would immediately transition to Running state and protect the first 3000 clients]. But for next 6000 dynamic clients, the new Ready SVMs need to be deployed and they keep transitioning from Standby → Ready → Running state depending on the client load. It takes some time to protect these 6000 dynamic client systems. So to keep protecting the total 9000 dynamic clients, 36 Running SVMs (12 SVMs per each rule) are required.

• When clients systems are turned off, the corresponding Running SVMs are transitioned to Standby state so that the computing resources are saved.

Protecting static client systems

These 6000 static clients are protected by the respective SVM pool that is created for the corresponding SVM assignment rule (default, tag-based, and IP-based).

• To protect 6000 static client systems, 24 Running SVMs (6000/250 = 24 Running SVMs) are required.

• These initial 24 Running SVMs creation takes some time, as this is an initial setup and fresh Ready and Standby SVMs need to be deployed. The transition from Standby → Ready → Running happens in phase by phase manner. But eventually all X clients are protected.

To protect 12,000 static clients at once, you can also bring all these 12,000 clients to the Trellix MOVE AntiVirus environment in different batches, for example, you can bring them in 12 batches (1000 clients per batch) so that there is no gap in protecting the clients by SVMs.

Configuring an SVM OVF template for autoscaling

An SVM OVF template is a primary image of a virtual machine that can be used to create and deploy many SVMs.

When you export an SVM, you create a copy of the entire virtual machine, including its settings, installed software, and other configuration settings. Exporting the SVM saves time when you are deploying many SVMs. You can create and configure a single SVM, then deploy it multiple times, rather than creating and configuring each SVM individually.

When you deploy an SVM from OVF template, the resulting SVM is independent of the original SVM or template. Changes to the original SVM or template are not reflected in the deployed SVM, and changes to the deployed SVM are not reflected in the original SVM or template.

Note

Exporting an SVM OVF template is required only when you are using autoscaling method.

You can configure an SVM OVF template using one of these options:

• Export an existing SVM or create and export from a VM — You can export a template from an SVM system or can create an SVM and export it to make a primary image of the SVM, from which you can deploy many SVMs.

• Specify the SVM OVF location available on the McAfee ePO system — You can export an SVM OVF template using the export utility, then copy the exported SVM OVF template to the ePO - On-prem server. Then specify the location of the SVM OVF template that is available on the ePO - On-prem server, so that Trellix MOVE AntiVirus can deploy SVMs, as needed.

Export an SVM OVF template

Using the Export an existing SVM or create and export from a VM option, you can export a template from an SVM system or can create an SVM and export it to make a primary image of the SVM, from which you can deploy many SVMs. create an SVM system, then export it to make a primary image of an SVM, from which you can deploy many SVMs. When you use this option, Trellix MOVE AntiVirus installs Trellix ENS and the SVM package (if they are not installed) on the VM, then exports it to the ePO - On-prem server.

Make sure that:

• You have installed the Trellix MOVE AntiVirus 4.10.x extensions on the ePO - On-prem server.

• Your VMware vCenter account is synced successfully.

• (If you are creating and exporting from a VM) You have a VM with one of these Plain Vanilla Windows Server platforms: 2008 R2 SP1 (64-bit), 2012 R2 (64-bit), 2016, or 2019.

• (If you are exporting from an existing SVM) Make sure that the SVM package is upgraded to the latest version of 4.10.x.

• The latest VMware Tools are installed on the VM.

• The VM is managed by ePO - On-prem.

• The VM has no snapshots.

• The VM has only one hard disk.

• The VM is turned on.

• (If your environment includes more than one domain) Make sure that the VM is not part of any domain, so that the exported SVM template is a generic one and can be deployed to any domain.

• Do not configure the SVM Manager IP details under SVM Manager Assignment in Options policy until you create and export the SVM template.

Note

To use autoscale SVM feature, the minimum supported Trellix ENS version is 10.7.0 or later.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Automation → MOVE AntiVirus Deployment.

3. On the Configuration tab, under Multi-Platform, click SVM Configuration to open the SVM OVF Details page with these SVM OVF details and actions.

4. Click Actions → Add SVM to open the Configure SVM OVF page.

5. Under Configure SVM OVF template, select Export an existing SVM or create and export from a VM and configure these options.

6. Click Export to open the Export SVM OVF Confirmation dialog box.

7. Click OK to create an SVM system and export it to make an SVM OVF template.

The SVM OVF template files (**.ovf and **.vmdk) are created on the ePO - On-prem server. Also, the exported SVM OVF template details are available on the SVM OVF Repository page under MOVE AntiVirus Deployment → Configuration → Multi-Platform → SVM Configuration.

Check the SVM export status

After exporting an SVM, you can view the export details on the Deployment Status tab under MOVE AntiVirus Deployment wizard on the ePO - On-prem server.

Make sure that you initiate an SVM export using ePO - On-prem.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Automation → MOVE AntiVirus Deployment.

3. On the Deployment Status tab, view the SVM export details.

4. Click any Export SVM OVF template job to view these Task Status Details.

Deployment status

Task status

Create or edit an infrastructure group in ePO - On-prem for SVM autoscaling

After registering your vCenter account, your default group is added to the MOVE AntiVirus Deployment wizard when you access the Infrastructure Details option under Multi-Platform. You can edit the details of the default infrastructure group, as needed.

You registered your VMware vCenter account with ePO - On-prem.

You can deploy the SVM to any infrastructure group by configuring the SVM Manager and autoscale settings in ePO - On-prem. By default, an infrastructure group is added to the MOVE AntiVirus Deployment wizard when you access the Infrastructure Details option under Multi-Platform.

Using the Infrastructure Details option, you can create a hypervisor-based or cluster-based infrastructure group. You can then customize and select the infrastructure group for SVM deployment.

You can customize the SVM Manager Settings policy for creating and assigning IP-based or tag-based assignment rules for SVM deployment. You can select and include individual infrastructure groups for SVM deployment.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Automation → MOVE AntiVirus Deployment.

3. On the Configuration tab, click Infrastructure Details to open the Infrastructure Details page with the default infrastructure group details.

4. Click Actions → Create and configure these properties for the custom infrastructure group details. You don't need to configure the custom group details when the default group is available.

5.  Click Save to store the infrastructure details.

Enable and configure SVM autoscale settings

Create and assign a policy that specifies which SVM an infrastructure group uses.

Make sure that:

• You define the autoscale settings for the Trellix MOVE AntiVirus SVM so that its deployment starts automatically, depending on the number of clients connecting to it for protection.

• You installed the Trellix MOVE AntiVirus extension on the ePO - On-prem server

• You configured your ePO - On-prem details about the General page under Automation → MOVE AntiVirus Deployment → Configuration

• You deployed the SVM Manager

• You exported an SVM OVF template

• (If you exported an SVM OVF using export utility tool) You specified the Trellix MOVE AntiVirus SVM OVF template path in ePO - On-prem

• You configured the SVM Manager IP details under SVM Manager Assignment in Options policy

You can track the status of the SVM deployment on the Deployment Status page on the ePO - On-prem server.

Note

You can deploy only one SVM manager if you enable the autoscaling feature.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Policy → Policy Catalog, select MOVE AntiVirus 4.10.x from the Product drop-down list, then select SVM Manager Settings from the Category drop-down list.

3. Click New Policy or click the name of an existing policy to edit it.

4. Type a name for the new policy (for example, MOVE AV Server Policy), then click OK.

5. Under SVM Manager Configuration, configure these settings as needed, then click Save.        

   • SVM Port — Specify the port for the SVM to communicate to SVM Manager. Default is 8443.

   • Client Port — Specify the port for the client system to communicate to SVM Manager. Default is 8080.

6. From SVM Autoscale Settings, select Enable auto scaling of SVMs.

Important

Enabling the Enable auto scaling of SVMs option deletes all manually deployed SVMs after the new SVMs are deployed. The new SVMs are ready to protect the client systems. Disabling the Enable auto scaling of SVMs option deletes all ready and standby SVMs, but the running SVMs continue to protect the client systems.

7.  Under SVM Autoscale Settings, configure these options:

• Number of backup SVMs — Type the number of ready SVMs required to protect your client systems.

Calculate the number of ready SVMs required for the maximum number of clients that need protection at any time of the day. The standby SVMs are automatically deployed based on the backup SVM value. For example, if you specify the backup SVM as 4, 2 standby SVMs are deployed automatically.

Important

The ready SVMs are not protecting your clients, but running SVMs are. The backup SVMs are the ready SVMs, which enable faster protection for new client systems that might be added during peak hours or during a cloud burst.

Note

When the SVM reaches minimum threshold for the number of connected endpoints, the running SVMs move to the standby SVM pool.

8.  Click Show Advanced and configure the Assignment Rules options as needed, then click Save.

Autoscale SVM details

When you define the autoscale SVM settings, the SVM deployment starts automatically depending on the number of clients connecting to the Trellix MOVE AntiVirus SVM for protection.

You can view the SVM deployment mode, its status, and the purging details on the Autoscale SVM Details page.

1 | Multi-platform

Deploy the Trellix MOVE AntiVirus client

Deploy the client package to virtual machines using ePO - On-prem, so that ePO - On-prem can manage the Trellix MOVE AntiVirus configuration on client systems.

Make sure that:

• The Trellix Agent must already be deployed to target virtual systems.

• You installed the Trellix MOVE AntiVirus extension on the ePO - On-prem server

• Make sure that your VMware vCenter account is synced successfully.

• You deployed the SVM Manager using ePO - On-prem.

• (If you are using autoscale SVM) You exported an SVM OVF template and configured SVM autoscale settings.

• (If you are not using autoscale SVM) You deployed the Trellix MOVE AntiVirus SVM package to target virtual systems.

• Make sure that the SVMs are communicating with the SVM Manager and are ready to protect new clients.

• Make sure that your virtual machines are turned on where you want to deploy Trellix MOVE AntiVirus client.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Systems → System Tree.

3. In the System Tree, select the virtual machines where you want to deploy the client package.

4. From Actions, select MOVE → Deploy Client [Multi-Platform] to open the Client Deployment Configuration page.

5. Under Client Configuration for Client Package, select Trellix MOVE AV [Multi-Platform] Client 4.10.x..

You can view all SVM Assignment Rules, if the selected client systems are part of the assignment rules.

6. Click Proceed to open the Deployment Confirmation dialog box.

   A message shows the number of systems that are compatible and non-compatible for the client deployment.

7. Review the message, then click OK to deploy the client package to the compatible client systems.

   A deployment task is created for all selected systems. Go to Deployment Status tab under the MOVE AntiVirus Deployment wizard to view the Passed or Failed tasks with their details.

   If you click Cancel, the deployment task is created only for the non-compatible client systems, and the failure reasons can be viewed on the Deployment Status tab under the MOVE AntiVirus Deployment wizard.

Note

Reboot the system after installing Trellix MOVE client software.

For compatible client systems, the SVM Manager IP address is updated in the respective Options policy, then the SVM Manager assigns an SVM for the clients to protect them.

Note

When the Trellix MOVE AntiVirus client is present, disable Trellix ENS Threat Protection. Deploying two AntiVirus solutions on the same system results in performance impact.

Check the Trellix MOVE AntiVirus client deployment status

After deploying Trellix MOVE AntiVirus client, you can view the deployment details on the Deployment Status tab under MOVE AntiVirus Deployment wizard on the ePO - On-prem server.

Make sure that:

• You have installed the Trellix MOVE AntiVirus package extension on the ePO - On-prem server.

• You have initiated the Trellix MOVE AntiVirus client deployment using ePO - On-prem.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Automation → MOVE AntiVirus Deployment.

3. On the Deployment Status tab, you can view the Trellix MOVE AntiVirus client deployment details.

4. Click any of the Deploy client and enable protection jobs to view these Task Status Details.

Job status

"Task status details" \ Guest Tab

During Trellix MOVE AntiVirus client deployment

Deploy client in a Virtual Desktop Infrastructure environment

When operating in a Virtual Desktop Infrastructure (VDI) environment, follow these steps to create a primary image of a client system and clone the virtual machines.

1 | Multi-platform

Make sure that:

• The Trellix Agent is installed on the primary image.

• The Trellix MOVE AntiVirus client is in the Main Repository.

1. Deploy the Trellix MOVE AntiVirus client to the primary image.

2. Configure and apply Trellix MOVE AntiVirus policies to the primary image.

3. Run the targeted on-demand scan on the primary image to build up the cache.

   Building up the cache on the primary image improves the performance of the VDI when you clone the virtual machines.

4. In the primary image, delete the registry key AgentGUID from the location determined by your Windows operating system.

   • 32-bit — HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Agent (32-bit)

   • 64-bit — HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Network Associates\ePolicy Orchestrator\Agent (64-bit)

5. In the primary image, under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mvagtdrv\Parameters, delete the data for ServerAddress1, ServerAddress2, and ODSUniqueId.

6. Shut down the primary image and clone the virtual machines from the primary image.

When cloned virtual machines are turned on, new agent GUID values are automatically generated. The virtual machines are now managed by the ePO - On-prem server.

Deploy the Trellix MOVE AntiVirus Multi-Platform client 4.10 with Trellix Endpoint Security (ENS) Threat Prevention

Deploy the client package to virtual machines using ePO - On-prem, so that ePO - On-prem can manage the Trellix MOVE AntiVirus configuration on client systems. The co-existence of Trellix MOVE AntiVirus and Trellix Endpoint Security (ENS) Threat Prevention is a replacement for MOVE + HIPS configuration because of the HIPS EOL announcement.

Make sure that:

• The Trellix Agent must already be deployed to target virtual systems.

• You installed the Trellix MOVE AntiVirus extension on the Trellix ePO - On-prem server.

• Make sure that your VMware vCenter account is synced successfully.

• You deployed the SVM Manager using Trellix ePO - On-prem.

• (If you are using autoscale SVM) You exported an SVM OVF template and configured SVM autoscale settings.

Trellix MOVE AntiVirus 4.10.x Installation Guide     59

1 | Multi-platform

• (If you are not using autoscale SVM) You deployed the Trellix MOVE AntiVirus SVM package to target virtual systems.

• Make sure that the SVMs are communicating with the SVM Manager and are ready to protect new clients.

• Make sure that your virtual machines are turned on where you want to deploy Trellix MOVE AntiVirus client.

• The client machine has ENS 10.7.0 installed with June 2021 Update or later.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Systems → System Tree.

3. In the System Tree, select the virtual machines where you want to deploy the client package.

4. From Actions, select Agent → Run Client Task Now to open the Run Client Task Now page.

5. In the Run Client Task Now:

   1. For Product, select Trellix Agent.

   2. For Task Type, select Product Deployment.

   3. For Task Name, select Create New Task.

   4. Check if Target Platforms is Windows only.

   5. For Products and components, select Trellix Move AV [Multi-Platform] Client 4.10.x or later Trellix MOVE AntiVirus client version and in the Command Line, enter KEEPENS=1 .

   6. In the bottom right corner, click Run Task Now.

   You can see the status of the installation in the Running Client Task Status page.

6. Reboot the system after installing Trellix MOVE client software.

If you see the Status as Completed on the Running Client Task Status page, the MOVE AntiVirus installation on your client machine is finished.

Note

This solution is only for MOVE + Trellix ENS exploit prevention function only. All other Trellix Endpoint Security (ENS) Threat Prevention functions such as: On Access scan, On Demand Scan and Access Protection aren’t supported.

Create policies and settings on ePO - On-prem

Policies and setting need to be created and configured for Trellix MOVE AntiVirus 4.10.x.x. This can be done under the Policy Catalog in ePO - On-prem. The Multi Platform client assigned with the created policies and settings will be protected based on the set configuration.

Create an On Access Scan policy

After you deploy the Trellix MOVE M-Platform to the clients from the ePO - On-prem server, you need to create an On Access Scan policy. This policy is used to Enable/Disable On Access Scan, Enable/Disable Deferred Scan, File types to Scan, Path Exclusion, Process Exclusion, and Publisher Exclusion.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Policy → Policy Catalog.

3. Select MOVE AntiVirus 4.10.x from the Product drop-down list, then click New Policy.

   The Create a new policy dialog box appears on the screen.

4. In the Create a new policy, select On Access Scan from the Category drop-down list.

5. Select My Default from the Create a policy based on this existing policy drop-down list.

6. Enter the name of your policy in Policy Name.

7. Click OK to save the policy.

The new On Access Scan policy page appears on the screen with all the parameters and their values. As per your requirements, edit the values of the parameters and click Save otherwise click Cancel.

Create an On-Demand scan policy

After you deploy the MOVE Multi Platform AntiVirus to the clients from the ePO - On-prem server, you need to create an On-Demand Scan policy. Use this policy to enable or disable On Access Scan, Deferred Scan, File types to Scan, and Path Exclusion.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Policy → PolicyCatalog.

3. Select MOVE AntiVirus 4.10.x from the Product drop-down list, then click New Policy.

   The Create a new policy dialog box appears on the screen.

4. In Create a new policy, select On Demand Scan from the Category drop down list.

5. Select My Default from the Create a policy based on this existing policy drop down list

6. Enter the name of your policy in Policy Name.

7. Click OK to save the policy

The new On Demand Scan policy page appears on the screen with all the parameters and their values. As per your requirements, edit the values of the parameters and click Save otherwise click Cancel.

Create an On-Demand scan task on individual folder

After you deploy the Trellix MOVE AntiVirus Multi Platform to the clients from the ePO - On-prem server, you can run on-demand scan at individual folder level.

1. Log on to the ePO - On-prem server as an administrator.

2. Select Menu → Policy → Client Task Catalog.

3. From Client Task Types, select MOVE AntiVirus 4.10.x → Targeted On-Demand Scan [Multi-Platform].

4. Click the name of an existing client task or click New Task, then confirm the task type.

5. Configure the Task Name and Description on each tab. Also provide Folder Path (Optional), then click Save

6. Configure Task Name and Description on each tab, then click Save.

Note

Specify the path in Folder Path (Optional) to run on-demand scan on individual folders.

7. Click Assign, specify the servers where you want to assign the task, then click OK.

8. Click Schedule to schedule the task.

Create an Options policy

After you deploy the MOVE Multi Platform AntiVirus to the clients from the ePO - On-prem server, you need to create an Options policy. Using this policy, you can assign SVM manager or SVM to Multi-Platform clients.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Policy → PolicyCatalog.

3. Select MOVE AntiVirus 4.10.x from the Product drop-down list, then click New Policy.

4. In Create a new policy, select Options from the Category drop-down list.

5. Select My Default from the Create a policy based on this existing policy drop-down list.

6. Enter the name of your policy in Policy Name.

7. Click OK to save the policy

The new Options policy page appears on the screen with all the parameters and their values.

8. On the policy settings page, click Show Advanced to see all the settings

9. Under SVM Assignment (Multi-Platform only) on the policy settings page:        

   1. Click on Assign SVM using SVM Manager and provide the IP address/host name and the port (If SVM Manager need to be assigned) OR

   2. Click on Assign SVM manually and provide the IP address/host name and the port for SVM-1 and SVM-2 (If SVM need to be assigned instead of SVM Manager)

   3. Click Save to save the new settings to your Options policy

As per your requirements, edit the values of the parameters and click Save otherwise click Cancel.

Create SVM settings policy

After you deploy the MOVE Multi Platform AntiVirus to the clients from the ePO - On-prem server, you need to create a policy for SVM settings policy. Using this policy, you can configure the ODS scheduler, Scanning options and other options.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Policy → PolicyCatalog.

3. Select MOVE AntiVirus 4.10.x from the Product drop-down list, then click New Policy.        

   The Create a new policy dialog box appears on the screen.

4. In Create a new policy, select SVM Settings from the Category drop-down list.

5. Select My Default from the Create a policy based on this existing policy drop-down list

6. Enter the name of your policy in Policy Name.

7. Click OK to save the policy

The new SVM Settings policy page appears on the screen with all the parameters and their values.

As per your requirements, edit the values of the parameters and click Save otherwise click Cancel.

Create a Certificates policy

After you deploy the Trellix MOVE for Multi-Platform AntiVirus to the clients from the ePO - On-prem server, you need to create a Certificate policy. Using this policy, you can add the trusted certificates.

The Certificates policy option allows you to add certificates in the policy. Once you add the certificate, all files that are signed by the listed certificates are excluded from on-access and on-demand scanning.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Policy → PolicyCatalog.

3. Select MOVE AntiVirus 4.10.x from the Product drop-down list, navigate to Certificates (Multi-Platform only) policy.

4. In Create a new policy, select SVM Manager Settings from the Category drop-down list.

5. Select My Default and edit the My Default policy.

   As per your requirements, edit the values of the parameters and click Save otherwise click Cancel.

Create a Shared Cloud Solutions policy

After you deploy the Trellix MOVE for Multi-Platform AntiVirus to the clients from the ePO - On-prem server, you can create a Shared Cloud Solutions policy. Using this policy, you can configure Threat Intelligence Exchange and Intelligent Sandbox settings.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Policy → PolicyCatalog.

3. Select MOVE AntiVirus 4.10.x from the Product drop-down list, then click New Policy.

   The Create a new policy dialog box appears on the screen.

4. In Create a new policy, select Shared Cloud Solutions from the Category drop-down list.

5. Select My Default from the Create a policy based on this existing policy drop-down list

6. Enter the name of your policy in Policy Name.

7. Click OK to save the policy

The new Shared Cloud Solutions policy page appears on the screen with all the parameters and their values.

As per your requirements, edit the values of the parameters and click Save otherwise click Cancel.

Create a SVM Manager settings policy

After you deploy the Trellix MOVE for Multi-Platform AntiVirus to the clients from the ePO - On-prem server, you need to create a policy for SVM Manager settings policy. Using this policy, you can configure the ODS scheduler, Scanning options and other options.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Policy → PolicyCatalog.

3. Select MOVE AntiVirus 4.10.x from the Product drop-down list, then click New Policy.

   The Create a new policy dialog box appears on the screen.

4. In Create a new policy, select SVM Manager Settings from the Category drop-down list.

5. Select My Default from the Create a policy based on this existing policy drop-down list

6. Enter the name of your policy in Policy Name.

7. Click OK to save the policy

   The new SVM Manager Settings policy page appears on the screen with all the parameters and their values.

   As per your requirements, edit the values of the parameters and click Save otherwise click Cancel.

Upgrade from Trellix MOVE AntiVirus 4.9.x

If a supported version of Trellix MOVE AntiVirus is installed in your environment, you can upgrade to the latest version of Trellix MOVE AntiVirus 4.10.x.

The latest version of Trellix MOVE AntiVirus 4.10.x upgrade these components:

• Trellix MOVE AntiVirus extensions.

• Trellix MOVE AntiVirus SVM Manager.

• Trellix MOVE AntiVirus SVM.

• Trellix MOVE AntiVirus Client.

Upgrade the extension

Version 4.10.x of the Trellix MOVE AntiVirus extension upgrades the 4.9.x extension on the ePO - On-prem server.

Make sure the extension file in an accessible location on the network.

All policies created in version 4.9.x exist after you upgrade to version 4.10.x.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Software → Extensions.

3. Click Install Extension.

4. Browse to and select the extension file, then click OK.

5. After a confirmation message, click OK.

Upgrade the SVM Manager

In-place upgrade from previous version of 4.10.x to latest version of 4.10.x is supported, the latest version of 4.10.x of the SVM Manager upgrades over the previous version of 4.10.x SVM Manager on your hypervisor. Once the latest version of 4.10.x SVM Manager is up and running, the previous version of 4.10.x SVM Manager is turned off.

Make sure that:

• The VMware vCenter account is synced successfully.

• You have configured the Infrastructure Group. For details, see Create or edit an infrastructure group in ePO - On-prem for SVM Manager deployment.

• The SVM Manager package (MOVE-AV-MP_SVM_Manager_Pkg.4.10.1.168.zip) is in an accessible location on the network.

• You have not removed the existing SVM Manager IP address in respective options policy.

Note

The MOVE SVM Manager upgrade from older versions to 4.10.x using Debian package is not supported.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Systems → System Tree.

3. In the System Tree, select the virtual machines where you want to deploy the SVM Manager package.

4. Click Actions → Agent → Run Client Task Now to open the Run Client Task Now page.

5. Perform these tasks to run the client task:        

   1. In the Product drop-down list, select Trellix Agent.

   2. In the Task Type, select Product Deployment.

   3. In the Task Name, click Create New Task to create the new task.

   The Run Client Task Now window opens on the screen.

6. Perform these steps to create a task in the Run Client Task Now window:        

   1. From the Target Platforms checkboxes, select Linux only.

   2. In the Products and components dropdown list, select Trellix MOVE AV [Multi-Platform] SVM Manager 4.10.x.xx.

7. Click Run Task Now to deploy the SVM Manager.

You can see the status of the installation in the Running Client Task Status page. If you see the Status as Completed on the Running Client Task Status page, the Trellix MOVE AntiVirus SVM Manager 4.10.x upgraded on your virtual machine.

Create an SVM deployment client task for upgrade

Create an SVM deployment client task, so that you can assign that task to SVMs.

Make sure that:

• The Trellix MOVE AntiVirusextensions upgrade are successful.

• The SVM Manager upgrade is successful.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Policy → Client Task Catalog.

3. Select Product Deployment in the Client Task Types menu, then select Actions → New Task.

4. Select Product Deployment from the list, then click OK to open the Client Task Builder wizard.

5. Type a name for the task you are creating, and add any descriptive information in the Description field.

6. Make sure that Windows is the only target platform selected.

7. For Products and components:        

   1. For SVM, select Trellix MOVE AV [Multi-Platform] SVM 4.10.x from the drop-down list.

   2. Set the action to Install, set the language to Language Neutral, and set the branch to Current.

   3. Leave the Command line setting blank.

8. Review the task settings, then click Save.

The task is added to the list of client tasks for the selected client task type.

Assign an SVM deployment client task for upgrade

After creating the SVM deployment client task, you must assign that task to the SVMs.

Make sure that the Trellix Agent and Trellix ENS is already deployed to target virtual systems.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Policy → Client Task Assignments, then click the Assigned Client Tasks tab.

3. Click Actions → New Client Task Assignment.

4. Configure these settings, then click Next.

   • Product — Trellix Agent

   • Task Type — Product Deployment

   • Task Name — The name of the task you used when you created the client task

5. On the Schedule tab, specify the schedule for running the client task, then click Next.

6. Examine the settings on the Summary tab, then click Save to assign the task.

The Trellix MOVE AntiVirus SVM is deployed to systems in the selected group in the System Tree.

Upgrade the SVM with ePO - On-prem (with autoscale SVM)

You must export an SVM OVF template with 4.10.x SVM installed on it, so that your primary image of the SVM has latest version.

• Make sure that your SVM Manager upgrade is successful.

• You exported your latest SVM OVF template and checked in to the ePO - On-prem server and the SVM OVF details appear on the SVM Configuration page under MOVE AntiVirus Deploymentwizard. For details, see Configuring an SVM OVF template for autoscaling.

• You configured your Infrastructure Group. For details, see Create or edit an infrastructure group in ePO - On-prem for SVM autoscaling.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Policy → Policy Catalog, then select Trellix MOVE AntiVirus 4.10.x from the Product list.

3. From the Category list, select SVM Manager Settings.

4. Click the name of the policy that you are currently using for SVM autoscaling.

5. From SVM Autoscale Settings, deselect Enable auto scaling of SVMs.

Note

Disabling this option disappears all running, ready, and standby SVMs from the Autoscale SVM Details page under MOVE AntiVirus Deployment wizard. Also, delete all ready and standby SVMs, but the running SVMs continue to protect the client systems.

6. Select Menu → Systems → System Tree.

7. Identify the VM or SVM that you used to export SVM OVF template, then delete it.

8. From SVM Autoscale Settings, again select Enable auto scaling of SVMs.

1 | Multi-platform

The new ready and standby SVMs are deployed. Once the new ready and standby SVMs are up, the existing running SVMs are deleted.

Upgrade the Trellix MOVE AntiVirus client

Version 4.10.x of the Trellix MOVE AntiVirus client upgrades the 4.9.x clients.

Make sure that:

• The VMware vCenter account is synced successfully.

• The client systems are turned on where you want to deploy Trellix MOVE AntiVirus client.

• The SVM Manager upgrade is successful.

• The SVM upgrade is successful.

Note

You can also upgrade clients by creating an upgrade client task and assigning that task to virtual machines.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Systems → System Tree.

3. In the System Tree, select the virtual machines where you want to deploy the client package.

4. From Actions, select MOVE → Deploy Client [Multi-Platform] to open the Client Deployment Configuration page.

5. Under Client Configuration for Client Package, select Trellix MOVE AV [Multi-Platform] Client 4.10.x.        

   You can view all SVM Assignment Rules, if the selected client systems are part of the assignment rules.

6. Click Proceed to open the Deployment Confirmation dialog box.        

   A message shows the number of systems that are compatible and non-compatible for the client deployment.

7. Review the message, then click OK to deploy the client package to the compatible client systems.

A deployment task is created for all selected systems. Go to Deployment Status tab under the MOVE AntiVirus Deployment wizard to view the Passed or Failed tasks with their details.

If you click Cancel, the deployment task is created only for the non-compatible client systems, and the failure reasons can be viewed on the Deployment Status tab under the MOVE AntiVirus Deployment wizard.

Note

After upgrading the Trellix MOVE AntiVirus software, reboot the system.

For the compatible client systems, if the SVM Manager IP address is updated in the respective Options policy, then the SVM Manager assigns an SVM for the clients to protect them.

Job status

Task status details

During Trellix MOVE AntiVirus client deployment

Upgrade persistent virtual machines

Upgrading persistent virtual machines provides nearly seamless virus protection, but requires the overhead of duplicate SVMs during the upgrade process.

We recommend this method for environments made up primarily of persistent virtual machines, where the clients require support from the SVM during the client migration process.

1. Log on to ePO - On-prem as an administrator.

2. Check in and install the Trellix MOVE AntiVirus 4.10.x extension in ePO - On-prem.

3. Create a new virtual server and install Trellix ENS 10.7.x or later on that server.

4. Install SVM version 4.10.x on the virtual server.

5. Create a new Trellix MOVE AntiVirus 4.10.x policy that references the SVM you created, and assign it to the virtual machines being upgraded.

6. Create a ePO - On-prem client task to upgrade the Trellix MOVE AntiVirus clients to version 4.10.x.

   As the upgrade task is executed on virtual machines, the VMs begin to use the 4.10.x SVM for file scanning.

7. After all clients are upgraded to version 4.10.x, shut down the older versions of the SVM.

Note

After upgrading the Trellix MOVE AntiVirus software, reboot the system.

Upgrade non-persistent virtual machines

Upgrading non-persistent virtual machines does not require creating additional SVMs, although it might result in a window of time when virtual machines are unprotected.

We recommend that you perform this upgrade during scheduled downtime.

1. Log on to ePO - On-prem as an administrator.

2. Install the Trellix MOVE AntiVirus 4.10.x client package and Trellix MOVE AntiVirus 4.10.x SVM packages and upgrade the extensions in ePO - On-prem.

3. Create a new 4.10.x client policy definition that references existing SVM systems.

4. From the ePO - On-prem console, upgrade all SVMs to version 4.10.x.

Caution

Virtual machines serviced by upgraded SVMs do not have anti-virus protection until after this task is completed.

5. Change the primary image by deploying version 4.10.x of the Trellix MOVE AntiVirus client from ePO - On-prem, or by manually upgrading the client directly on the primary image.

Note

After upgrading the Trellix MOVE AntiVirus software, reboot the system.

Upgrade the Trellix MOVE AntiVirus client with Trellix ENS on ePO - On-prem

Version 4.10.x of the Trellix MOVE AntiVirus client upgrades the 4.9.x clients which have MOVE + Trellix Endpoint Security (ENS) Threat Prevention combination using ePO - On-prem.

Make sure that:

• The client systems are turned on where you want to deploy Trellix MOVE AntiVirus client.

• The client machine has Trellix ENS 10.7.0 and MOVE 4.9.x installed.

Note

You can also upgrade clients by creating an upgrade client task and assigning that task to virtual machines.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Systems → System Tree.

3. In the System Tree, select the virtual machines where you want to deploy the client package.

4. From Actions, select Agent → Run Client Task Now to open the Run Client Task Now page.

5. In the Run Client Task Now:        

   1. For Product, select Trellix Agent.

   2. For Task Type, select Product Deployment.

   3. For Task Name, select Create New Task.

   4. Check if Target Platforms is Windows only.

   5. For Products and components, select Trellix Move AV [Multi-Platform] Client 4.10.x or later Trellix MOVE AntiVirus client version and in the Command Line, enter KEEPENS=1.

   6. In the bottom right corner, click Run Task Now.

You can see the status of the installation in the Running Client Task Status page.

6. Reboot the system after installing Trellix MOVE client software.

If you see the Status as Completed on the Running Client Task Status page, the Trellix MOVE AntiVirus upgrade on your client machine is finished.

Update the standby SVMs (Autoscale SVMs)

When the latest SVM OVF template is configured in ePO - On-prem, you can deploy it from ePO - On-prem to all standby SVMs. This is only true for standby SVMs, not for ready and running SVMs.

Make sure that you have created your latest SVM OVF template.

When you click Update Standby SVMs, the existing standby SVMs are purged and new standby SVMs are deployed.

When you define the autoscale settings, the Trellix MOVE AntiVirus SVM deployment starts automatically depending on the number of clients connecting to the Trellix MOVE AntiVirus SVM for protection. You can view SVM deployment mode, its status, and the purging details about the Autoscale SVM Details page.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Automation → MOVE AntiVirus Deployment.

3. On the Configuration tab, click Autoscale SVM Details to open the Autoscale SVM Details page with the autoscale SVM deployment details.

4. Click Actions → Update Standby SVMs.

This action removes the existing standby SVMs and deploys the new standby SVMs with the latest SVM OVF template.

Generate certificates for Trellix MOVE AntiVirus

If there is a connectivity issue with the SVM Manager, you must generate the certificates for Trellix MOVE AntiVirus, so that the SVM and SVM Manager communicate and authenticate each other properly.

Make sure that:

Trellix MOVE AntiVirus uses secure https protocol for communication between Trellix MOVE AntiVirus SVM and SVM Manager. For secure https protocol, you must generate the Trellix MOVE AntiVirus certificates when the ePO - On-prem certificate is changed, so that the change is reflected in the Trellix MOVE AntiVirus policies.

• You have installed the Trellix MOVE AntiVirus extension on the ePO - On-prem server.

• You have deployed the SVM Manager.

• You have deployed the Trellix MOVE AntiVirus SVM package to the target virtual systems.

• You have deployed the Trellix MOVE AntiVirus client package to client systems.

• You have configured your ePO - On-prem details about the General page under Automation → MOVE AntiVirus Deployment → Configuration.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Automation → Server Tasks to open Server Tasks page.

3. Select MOVE AntiVirus : Generate Certificates query and click Run to generate the Trellix MOVE AntiVirus certificates.

4. Select Menu → Systems → System Tree.

5. In the System Tree, select the group containing the virtual machines where you want to apply the Trellix MOVE AntiVirus 4.10.x policies.

6. To apply the policy immediately, send an agent wake-up call to the client system.

7. Log on to the client system as an administrator.

8. Run an EICAR test.

9. Verify that the SVM sends threat details as threat events to ePO - On-prem.

Trellix MOVE AntiVirus certificates are generated successfully and Trellix MOVE AntiVirus SVM and SVM Manager are communicating properly.

Integrating TIE and Intelligent Sandbox

TIE provides context-aware adaptive security for your virtual environment. It quickly analyzes files and content from the SVM in your environment and makes informed security decisions.

These decisions are based on a file's security reputation and your own criteria set in the Shared Cloud Solutions policy of Trellix MOVE AntiVirus.

The Multi-platform deployment, with TIE and Intelligent Sandbox integration, becomes a multi-layered solution that involves various techniques to scan and detect the malware. It includes:

• Pattern matching

• Global reputation

• Program emulation

• Static analysis

• Dynamic analysis

All these layers are seamlessly integrated and provide a single point of control for easy configuration and management.

TIE and Intelligent Sandbox integration process

The overall TIE and Intelligent Sandbox integration process of the Multi-platform consists of the following tasks.

1. Install the TIE server appliance.

2. Deploy the Data Exchange Layer client to Trellix MOVE AntiVirus SVM.

3. Verify the TIE server installation.

4. Create a new registered server in ePO - On-prem.

5. Enable TIE and Intelligent Sandbox protection for Trellix MOVE AntiVirus.

6. Verify the TIE server integration.

7. Verify the Intelligent Sandbox integration.

Deploy the Trellix DXL client to Trellix MOVE AntiVirus SVM

You must deploy the DXL client to all your Trellix MOVE AntiVirus SVMs for TIE integration.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Software → Product Deployment, then click New Deployment.

3. Complete the new deployment information, then start the deployment.

4. Verify that the DXL Connection Status on ePO - On-prem is Connected.

Important - Restart the Trellix MOVE AntiVirus SVM service if you deploy the DXL Client after deploying the Trellix MOVE AntiVirus SVM.

For details about deploying software from ePO - On-prem, see the product documentation for your version of ePO - On-prem.

Verify the TIE server installation

After installing the Threat Intelligence Exchange and Trellix DXL components, verify the installation.

Make sure that you have installed the TIE server appliance. For installing and setting-up TIE, see the installation guide for your version of TIE.

1. Log on to ePO - On‑prem as an administrator.

2. In the System Tree, click the TIE server name, then click Products. Verify that the following components are listed with the corresponding version for the installation process.        

   • DXL Broker

   • DXL Client

   • Threat Intelligence Exchange Server

3. In the System Tree, verify that the TIESERVER and DXLBROKER tags were applied to the system.

4. Select Menu → Configuration → Server Settings, click DXL ePO Client, then verify that the Connection State is Connected.

5. In the System Tree, select the TIE server, then from the Actions menu, select DXL | Lookup in DXL.

6. Verify that the Connection State is Connected.

7. Log on to the Trellix MOVE AntiVirus SVM system.

8. From the system tray, click and select About to open the Trellix About window.

9. Under McAfee Data Exchange Layer, verify that the DXL Connected Status is Connected.

The DXL broker and DXL client communication is now up and running. From ePO - On‑prem, you can select Menu → Systems Section → TIE Reputations to verify that you can search for files and certificates. It might take some time for reputation information to update the database.

Create a new registered server

To view TIE information in ePO - On‑prem reports and dashboards, create a new registered server in ePO - On‑prem.

1. Log on to ePO - On‑prem as an administrator.

2. Select Menu → Configuration → Registered Servers, then click New Server.

3. In the Server type drop-down list, select Database Server.

4. Enter a Name, for example, TIE Server, then click Next.

5. On the Details page:

   • Select Make this the default database for the selected database type.

     This option is automatically selected when you create the first registered server. If you have more than one TIE database, select this option only for the database that you want as the default.

   • In the Database Vendor field, select TieServerPostgres.

   • In the Host name or IP address field, enter the IP address of the TIE server.

   • Leave the Database server instance and Database server port fields blank (if they appear).

   • For the Database name, enter tie.

   • In the User name and password fields, enter the read-only postgress user name and password that you specified on the PosgresSQL page during the server installation.

6. Click Test Connection.

7. Click Save.

ePO - On-prem communicates with the server and retrieves data for the reports and dashboards.

Enable TIE and Intelligent Sandbox protection for Trellix MOVE AntiVirus

Files and certificates have threat reputations based on their content and properties. The Shared Cloud Solutions policy determines whether files and certificates are blocked or allowed on systems in your environment based on reputation levels.

Make sure that:

• You have installed TIE and Intelligent Sandbox to integrate them with Trellix MOVE AntiVirus.

• You have installed the Trellix MOVE AntiVirus extension on the ePO - On-prem server.

File and certificate reputation is determined when a file tries to run on a managed system. For details about how to install and set up the TIE requirements, see the product documentation for your version of TIE.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Policy → Policy Catalog, select MOVE AntiVirus 4.10.x from the Product drop-down list, then select Shared Cloud Solutions from the Category drop-down list.

3. From Enable TIE, select Enabled to determine file and certificate reputation when a Portable Executable (PE) file is accessed on a managed endpoint.

   PE file includes these formats: .cpl, .exe, .dll, .ocx, .sys, .scr, .drv, .efi, .fon

4. From TIE Non-PE Lookup, select Enabled to determine file and certificate reputation when a non-PE file is accessed on a

   managed endpoint.

Note

To enable TIE Non-PE Lookup, make sure that you selected Enable TIE option.

5. Under Threat Intelligence Exchange (TIE), configure these reputation settings for files and certificates.

Based on the file TIE reputation score, the SVM performs threat detection responses specified in the On Access Scan or On Demand Scan policies for files the TIE reputation score is higher than the threshold defined in OAS/ODS policy. The SVM performs the scan action for selected files based on the threat detection response specified in OAS/ODS policies.

6. From Advanced Threat Defense (ATD), select Submit files to ATD at and below to send files with these reputation scores to Intelligent Sandbox for further analysis.

   • Most likely malicious

   • Unknown

   • Most likely trusted

For example, if the file hash is not found in the TIE server, the TIE server queries Trellix GTI for the file hash reputation. Trellix GTI sends the information that is available, for example "unknown reputation." The TIE server stores that information and sends the same to SVM.

If Submit files to ATD at and below is enabled and the file is determined as an Intelligent Sandbox candidate by TIE server, SVM sends the file to Intelligent Sandbox through the TIE server for analyzing.

Verify the TIE server integration

Verify the TIE integration before configuring and using the scan policies to detect malware.

Make sure that you have installed the TIE server and configured Threat Intelligence Exchange (TIE) option under the Shared Cloud Solutions policy on the ePO - On‑prem server.

1. Log on to the Trellix MOVE AntiVirus client system as an administrator.

2. Run an EICAR test.

3. Log on to ePO - On‑prem as an administrator.

4. Select Menu → Reporting → Threat Event Log.

5. Under Threat Type, verify that Virus detected using TIE appears.

Verify the Intelligent Sandbox integration

Verify the Intelligent Sandbox integration before configuring and using the scan policies to detect malware.

Make sure that you have installed Intelligent Sandbox and configured the Advanced Threat Defense (ATD) option under the Shared Cloud Solutions policy on the ePO - On‑prem server.

1. Log on to the Trellix MOVE AntiVirus SVM.

2. Run this command:

mvadm stats

3. Verify that Total ATD candidates and Total ATD successful submissions values appear.

4. Log on to ePO - On-prem as an administrator.

5. Select Menu → Systems → TIE Reputations.

6. From the File Search tab, under ATD Reputation, verify the Intelligent Sandbox reputation details for the files those were submitted to Intelligent Sandbox.

Uninstall the client and SVM

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Policy → Client Task Catalog.

3. In the left column under Trellix Agent , select Product Deployment.

4. Click Actions → New Task, select Product Deployment, then click OK.

5. Type the name of the task, like Uninstall MOVE AV client on VM client, and an optional description.

6. Make sure that Windows is the only target platform selected.

7. For Products and components, select the following, then click Next.

   1. Select Trellix MOVE AV [Multi-Platform] client 4.10.x or Trellix MOVE AV [Multi-Platform] SVM 4.10.x from the first drop-down list.

   2. Set the action to Remove, set the language to Language Neutral, and set the branch to Current.

   3. Leave the Command Line setting blank.

8. Select the remaining options according to your environment's best practices, then click Save.

The newly created task appears in the Client Task Catalog.

Assign the uninstallation task to virtual systems

The uninstallation task for the client and Trellix MOVE AntiVirus SVM must be assigned to virtual systems to take effect.

Make sure that the Trellix MOVE AntiVirus client and SVM are added to the Main Repository and your virtual systems are added to the System Tree.

1. Log on to ePO - On-prem as an administrator.

2. Select a group in the System Tree.

3. Select Menu → Policy → Client Task Assignments, then click the Assigned Client Tasks tab.

4. Click Actions → New Client Task Assignment.

5. Configure these settings, then click Next.        

   • Product — Trellix Agent

   • Task Type — Product Deployment

   • Task Name — The name of the task you created earlier

6. On the Schedule tab next to Schedule type, select Run Immediately from the drop-down list, set the options as appropriate, then click Next.

7. Examine the settings displayed on the Summary tab, then click Save to assign the task.

The Trellix MOVE AntiVirus client is removed from every system in the selected group in the System Tree.

Remove the client or SVM package from ePO - On-prem

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Software → Main Repository.

3. Select MOVE AV [Multi-Platform] client 4.10.x or MOVE AV [Multi-Platform] SVM 4.10.x, then click Delete.

Remove the SVM Manager

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Automation → MOVE AntiVirus Deployment.

3. On the Configuration tab, click SVM Manager Configuration to open the SVM Manager OVF Details page.

4. Under Deployment Configuration, click Delete SVM Manager.

Note

The Delete SVM Manager button is enabled only when the latest version of 4.10.x of SVM Manager is checked in to the ePO - On-prem server

You can check the deletion status on the Deployment Status tab under MOVE AntiVirus Deployment wizard on the ePO - On-prem server.

Uninstall the extensions

Uninstall the Trellix MOVE AntiVirus extensions from ePO - On-prem.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Software → Extensions.

3. From the Extensions tab under McAfee group, select Data Center Security.

4. Click Remove next to each extension in this order.        

   • MOVE AntiVirus

   • MOVE AntiVirus Common

   • vSphere Connector Extension

   • MDCC

Installation overview

The agentless solution integrates with VMware NSX Data Center. It addresses the challenges of protecting your VMware virtual machines and keeping it free of malware without a Trellix footprint on the client. The agentless deployment provides virus protection for virtual machines on the ESXi hypervisor.

First-time installation workflow (Agentless)

To install and configure the Trellix MOVE Agentless environment, refer the first-time installation high-level workflow diagram shown below:

Supported Trellix management platform and software

The Trellix Agent and Trellix Endpoint Security (ENS) for Linux Threat Prevention are preinstalled in SVM Open Virtualization Format (OVF). If required you can update to current version according to Point Product Compatibility Testing (PPCT). You must have specific versions of Trellix management platform and software installed as shown below:

SVM OVF requirements (Agentless)

• You must use the virtual machine we provide for Agentless SVM. This system is a dedicated virtual appliance with Trellix ENS for Linux Threat Prevention installed, which protects the SVM and Trellix Agent, to communicate with the ePO - On‑prem.

• The OVF is a secure image, so it doesn't require any more hardening.

• The hardware and software specifications of the SVM OVF are:

Supported operating systems

Make sure that the guest virtual machine has a supported version of windows installed. The following windows operating systems are supported for the NSX Guest Introspection:

Make sure that the guest virtual machine has a following supported version of Linux installed:

Supported VMware management platform and software

You must install a supported version of VMware software.

For a complete list of supported Trellix MOVE AntiVirus environment, see Trellix article 74865 and for vSphere Connector Extension see Trellix article 96090.

For information about the Guest VM operating systems that are supported for NSX Data Center Manager, see VMware NSX Data Center Installation Guide.

Note

One ePO - On-prem supports only one NSX Datacenter. We support multiple vCenter through this managed NSX Datacenter.

Permissions required for SVM deployment

The VMware vCenter account credentials specified in the Registered Cloud Account page of ePO - On-prem for discovering the virtual instances must have these permissions.

Preparing the ESX host

This is the first step in deploying the SVM. In this phase, a kernel driver is loaded onto the ESX host, and a separate vSwitch is configured to facilitate internal connectivity for the SVM.

Note

Make the MTU byte to 1600 and add 2 minimum NIC adapters.

Deploying the Virtual Appliance

This is the second step in SVM deployment, during which the virtual appliance itself is deployed from an OVF file.

Activating the Virtual Machine

In this step, the SVM is activated.

Enabling vShield Driver

This step involves enabling vShield driver on endpoints.

Remove Operations

In this step, the SVM is removed.

Adding vCenter in NSX Compute Manager

This step involves adding vCenter as compute manager in NSX

Setting up ESX Agent

This step involves setting up ESX Agent.

2 | Multi-platform

Ports for Agentless deployment

Following are the ports that are open and not reserved for other purposes:

Note

If required, you can customize the default ports.

Register vCenter with NSX Data Center Manager Console

Follow the NSX configuration guide available in the following link for the NSX version you are using:     https://docs.vmware.com/en/VMware-NSX/index.html

NSX Data Center Manager has a virtual appliance console. The vCenter registration and operational processes are carried out on this console from MOVE 4.10.x.

Make sure that:

• You have a vCenter user account with administrative access to synchronize NSX Manager with the vCenter.

• If your vCenter password has non-ASCII characters, change it before synchronizing the NSX Manager with the vCenter.

1. Log on to the NSX manager console using the IP address, for example: https://<NSX-Manager-IP>

2. In the NSX Data Center Manager homepage, click System.

3. On the left pane, click Fabric → Compute Managers.

4. Click +Add Compute Managers and add Name, FQDN or IP address, Username, and Password. Use the default option for other fields.

Note

If you are opting FQDN option, provide same domain name in FQDN or IP address in the New Compute Manager dialog box and in Server Address in the Registered Cloud Accounts page in the ePO - On-prem. The domain names are case-sensitive.

5. After filling in all the details, click Add to complete the Compute Manager setup.

6. Verify that the vCenter Registration Status is Registered, and its Connection is UP.

Configure a Transport Zone with NSX Manager console

A transport zone is a container that defines the potential reach of transport nodes. Transport nodes are hypervisor hosts and NSX Edges. The Transport Zone creation on the NSX Manager Console is given below for MOVE Agentless integration with NSX.

1. Log on to the NSX manager console using the IP address, for example: https://<NSX-Manager-IP>

2. Navigate to System → Fabric → Transport Zones.

3. Click +Add Zone to create a transport zone.

4. In New Transport Zone, enter a name for the transport zone and optionally a description.

5. Select the traffic type as Overlay or VLAN.

6. After you add the transport zone, go to the Transport Zones page, and view the newly added transport zone.

Configure a Host with NSX Manager

1. Log on to the NSX manager console using the IP address, for example: https://<NSX-Manager-IP>

2. In the NSX Data Center Manager homepage, click System.

3. On the left pane, click Fabric → Hosts.

4. Click Transport Node Profiles.

5. Go to Cluster, select Host and click Configure NSX and Configure Host details and Prepare Host.

Check for NSX Configuration status as Success.

6. Select the Cluster → Configure NSX and apply a Transport Node profile to the selected cluster and sub-cluster.

   NSX will be installed with the deployment configuration defined in Transport Node profile.

7. Check for status as Prepared.

Download and install software extensions

You can download these extensions and packages either from:

• The ePO - On-premserver, Software Catalog. For more information see, Check in the software extensions and download packages from Software Catalog in the ePO - On-prem.

• The Trellix download site. Check in the extensions to ePO - On-prem.

Note

Make sure to download the required extensions and packages from the Trellix download site.

1. Log on to ePO - On-prem as an administrator.

2. Check in the extension and packages individually:

   1. Select Menu → Software → Extensions → Install Extension.

      The Install Extension page opens.

   2. Browse and select the extension files in the same order as mentioned below, and then click Open → OK:

      Extension description	Extension name
      Trellix MOVE AntiVirus Agentless extension	MDCC_5.3.x.xx.zip VSPHEREDCEXTN_5.4.x.xx.zip DC__GS__4000_4.10.x.xx.zip DC__AM__4000_4.10.x.xx.zip MOVEAVLIC400_4.10.x.xx.zip
      Agentless SVM OVF package. For more information see, Check in the Trellix MOVE AntiVirus SVM package to ePO - On-prem.	MOVE-AV-AL_SVM_OVF_4.10.X.zip

   3. Review the extension details and click OK.

   4. To check in the packages, select Menu → Software → Software Catalog → Check In Package.

   5. For File path, browse and select the individual packages as mentioned below, and then click OK:

Note

MOVE AL 4.10.x extension supports version 4.10.x or above and is incompatible with version 4.9.x or lower policies. MOVE AL 4.10.2 extension and above supports NSX version 4.x.x.x.

Check in the software extensions and download packages from Software Catalog in the ePO - On-prem

If you have Software Catalog, you can check in the software extensions from there.

Make sure to download the required packages from the software catalog.

Note

In the ePO - On-prem version 5.10.0 and above, the term Software Manager is identified as Software Catalog.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Software, then click Software Catalog.

3. In the Product Categories pane, enter Move in the search bar.

4. Select the version of the Trellix MOVE AntiVirus 4.x and click Check In.

Register a VMware vCenter account with ePO - On-prem (Agentless)

To use Trellix MOVE AntiVirus to manage the security of the virtual machines in your data center, you must first add your VMware vCenter to the ePO - On-prem server.

Make sure that:

• You have configured your VMware vCenter server that manages the ESXi servers, which host the guest VMs.

• You have registered the VMware vCenter Server with VMware NSX Manager. In case of multiple VMware vCenter servers, register each vCenter appropriately. Environment each of your vCenter Servers are registered with a single VMware NSX Manager.

• You have installed the Trellix MOVE AntiVirus software extension on the ePO - On-prem server.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Configuration → Registered Cloud Accounts.

3. From the bottom-left click Actions → Add Cloud Account to open the Add Cloud Account dialog box.

4. From the Choose Cloud Provider drop-down list, select VMware vSphere and click OK.

5. On the vCenter Account Details page, configure these options.

Note

You must have a vCenter Server user account with administrator rights to use the autoscale feature.

6. Click Test Connection to validate VMware vCenter account details and verify the connection to the VMware vCenter, then click Next → Finish.

7. When prompted to confirm, click OK to register the vCenter account and wait for vCenter sync to complete.

   This action registers the VMware vCenter and imports all discovered virtual machines, which are unmanaged, into the System Tree. The instances are imported with the same organization as the VMware vCenter.

Note

The virtual machines that are already added and managed by ePO - On-prem are retained with the existing policy settings, but the virtualization properties for these systems are added.

Set up a general configuration for deployment (Agentless)

Before deploying Trellix MOVE AntiVirus SVM, configure settings on the ePO - On-prem server, so that they are retrieved and used for every Trellix MOVE AntiVirus SVM deployment.

Make sure that you have registered a VMware vCenter account with the ePO - On-prem.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Automation → MOVE AntiVirus Deployment.

3. In the Configuration tab, click General under General list.

   The General Configuration page opens.

4. Enter and confirm the password for ePO - On-prem Credentials section.

ePO - On-prem credentials

5. Enter and confirm password for SVM (Agentless) and SVM Manager (Multi-Platform) Configuration section.

Note

The SVM (Agentless) and SVM Manager (Multi-Platform) Configuration section shows a default password.

Caution

The password you enter is set to the SVM and you can't update it once the SVM is deployed. This password is not applicable to the SVM, which is already deployed.

If required, change the password.

SVM (Agentless) and SVM Manager (Multi-platform) Configuration

6. Click Save to store these configurations, so that you can use them for every Trellix MOVE AntiVirus SVM deployment.

Validate your NSX Data Center Manager using ePO - On-prem

The vSphere Connector extension automatically detects once vCenter sync is successful in RCA page and then it shows the details of your NSX Manager accounts in the ePO - On-prem. You must now register these NSX Manager servers with ePO - On-prem.

Make sure that you have set up a common configuration for ePO - On-prem and SVA.

Using this configuration available on the ePO - On-prem, you can edit the details and validate the credentials of your NSX Manager.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Automation → MOVE AntiVirus Deployment.

3. In the Configuration tab, click NSX Manager under Agentless.

The NSX Manager: Registration page displays these options:

4. Click Edit under Action to open the Edit NSX Manager Details dialog box and edit these NSX Manager account options.

Note

Make sure that your NSX Manager account and its details are ready.

5. Click Validate Credentials to verify the credentials of the NSX Manager and verify that the connection to the NSX Manager works.

6. Click Save to store the NSX Manager account details.

Note

MOVE AntiVirus can only register with a single VMware NSX manager. In a multiple VMware vCenter environment, each VMware vCenter must be configured to share the same NSX manager.

Check in the Trellix MOVE AntiVirus SVM package to ePO - On-prem

Check in the Trellix MOVE AntiVirus SVM package to ePO - On-prem, so that it is available with VMware NSX Manager to deploy it to the cluster. You can view and delete the Trellix MOVE AntiVirus SVM package using ePO - On-prem.

vCenter account synchronization is successful after upgrading the Trellix MOVE AntiVirus extension.

Make sure that you have installed the Trellix MOVE AntiVirus extension on the ePO - On-prem server.

Important

For a successful check-in, do not change the file name of the Trellix MOVE AntiVirus SVM package.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Automation → MOVE AntiVirus Deployment.

3. On the Configuration tab under Agentless, click SVM Repository to open the SVM OVF Details page with these Trellix MOVE AntiVirus SVM OVF options:

4. Click Actions → Add SVM to open the Check-in SVM OVF (zip) file page.

5. Click Choose File to select the Trellix MOVE AntiVirus SVM package, then click Open → OK.

Note

You can check in up to three versions of Trellix MOVE AntiVirus SVM starting from 4.x.x.

The package to ePO - On-prem is checked in.

6. (Optional) On the Configuration tab under Agentless, click Server Settings to enable NSX Unprotected Tag.

Upgrade the Trellix MOVE AntiVirus service using ePO - On-prem

Upgrade NSX Manager to the required Version. For more information, see docs.vmware.com.

Upgrade the Trellix MOVE AntiVirus service by going to ePO - On-prem after a Successful upgrade of NSX version.

The details of the registered vCenter, SVM OVF Version, and NSX Manager are automatically retrieved and displayed on the ePO - On-prem server. But you must register the Trellix MOVE AntiVirus service with the vCenter account. This registration permits the deployment of the service to the ESXi servers.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Automation → MOVE AntiVirus Deployment.

3. On the Service tab, click NSX Manager to open the MOVE Service Registration page with these options.

4. Click Register under Actions to open the MOVE Service Registration dialog box.

5. Select the latest Trellix MOVE AntiVirus SVM and click OK.        

   The Trellix MOVE AntiVirus service is now registered with the vCenter account that is registered with your NSX Manager.

6. On the NSX Data Center console, verify that the Trellix MOVE AntiVirus service is now available under System → Service Deployments → Catalog.

Deploy the Trellix MOVE AntiVirus SVM

To provide Trellix MOVE AntiVirus (Agentless) protection to the virtual machines on your ESXi servers, you must install the Trellix MOVE AntiVirus service (Trellix MOVE AntiVirus SVM) on your ESXi servers.

Make sure that:

• The host, where you are deploying the SVM using NSX Manager, is part of a cluster.

• The virtual machines have the latest VMware Tools installed and have the Guest Introspection Thin Agent enabled for both Windows and Linux VMs.

• You have appropriate permission to perform the SVM deployment using ePO - On-prem. You can enable this permission by

  navigating through Menu → Users → Permission Sets → MOVE AV [Agentless] SVM Deployment → Edit.

Deploy the Trellix MOVE AntiVirus services on a set of clusters. Manage service deployments here by adding new services or deleting existing ones.

This deployment automatically provides virus protection for virtual machines on a new hypervisor from the moment the hypervisor is added to the clusters. When a new cluster is added, deploy the Trellix MOVE AntiVirus SVM again.

1. Log on to the NSX Data Center manager as an administrator.

2. In the NSX Data Center manager console, navigate to System and then in the left pane, click Service Deployment.

3. Select Partner service from the drop-down list and then click Deploy Service.

4. To configure the service deployment:

   1. Enter the name under Service Deployment Name.

   2. Select your desired Compute Manager, Cluster, and Data Store.

   3. Click Edit Details.

      A Networks dialog box appears on your screen.

   4. Choose your Management NIC and their Network, Network Type as per your environment and click Save.

5. In the NSX Data Center manager, select System → Service Deployment, click Save. The service deployment starts and after successful Service deployment SVA is installed vCenter.

The Trellix MOVE AntiVirus service is now deployed to the cluster when the Installation Status is Successful and the Service Status is UP.

On-access scan policy export to NSX

After you register the Trellix MOVE AntiVirus service on the ePO - On-prem server, the On Access Scan policies for Trellix MOVE AntiVirus are exported from ePO - On-prem to NSX in real time.

The exported policies are available in NSX console under Security → Endpoint Protection Rules → Service Profiles with a Service Profile Name, Service Profile Description, Vendor Template, Vendor Template Key, Tags and Status.

Important

Only the On Access Scan policies are exported from ePO - On-prem to NSX Manager. If you need to assign the On Demand Scan policies, assign them manually on ePO - On-prem.

When you create a new or duplicate On Access Scan policy in ePO - On-prem, it is immediately exported to Service Profiles in NSX Manager. This real-time policy export helps the VMware NSX administrator understand the different sets of policies created and changed by the administrator.

Note

Once an On Access Scan policy is exported to NSX Manager, changes to an On Access Scan policy names in ePO - On-prem will not update in NSX Manager. You must manually update the name changes in the NSX Manager.

If you want to delete an On Access Scan policy from ePO - On-prem, the best practice is to delete the same policy from the NSX Manager.

Tip

Best practice: Verify the security policy in NSX before deleting any On Access Scan policy from ePO - On-prem.

You can't delete the exported On Access Scan policy in NSX Manager when it is included in any NSX security policy. You must remove all configurations referring to this policy before deleting it.

Configure the security group and security policy in NSX Manager

You must create the security policy and apply it to the security group of VMs that you want to protect.

The security policies for Trellix MOVE AntiVirus are automatically exported from ePO - On-prem after you register the Trellix MOVE AntiVirus service on ePO - On-prem. This configuration is a one-time initial activity for a vCenter. But you must repeat this configuration when a new datacenter is added.

Create an NSX service profile

Create an NSX service profile with Trellix MOVE AntiVirus (Agentless).

Make sure that:

• The Trellix MOVE AntiVirus service is registered with ePO - On-prem.

• You deploy the Trellix MOVE AntiVirus SVM.

1. Log on to the NSX manager console as an administrator.

2. Select Security → Endpoint Protection → Endpoint Protection Rules, then click the Security Profiles tab.

3. In the Service Profiles page, click Add Service Profile.

4. Complete the details of the service profile:        

   1. In the Service Profile Name, enter the name of the service profile.

   2. In the Service Profile Description, enter a description for the profile (optional).

   3. In the Vendor Template, select the policy configured in the ePO - On-prem.

5. Click Save. The status of the Service Profile changes to Success on successful configuration.

Note

Select My Default policy or any duplicate policy you have created.

You have created your NSX service profile for the Trellix MOVE AntiVirus (Agentless).

Create an NSX security policy and rule

Create an NSX security policy with Trellix MOVE AntiVirus (Agentless).

Make sure that:

• The Trellix MOVE AntiVirus service is registered with ePO - On-prem.

• You deploy the Trellix MOVE AntiVirus SVM.

1. Log on to the NSX manager console as an administrator.

2. Select Security → Endpoint Protection → Endpoint Protection Rules, then click the Rules tab.

3. In the Rules page, click +Add Policy.

The policy gets listed in the list of available policies.

4. In the list of policies, click the desired policy and click +Add Rule.

5. In the new rule, rename the rule name and click the Edit icon under the Groups column.

   The Set Groups dialog box appears on the screen.

6. Select a group in the list and click Apply.

   The selected group appears in the list.

7. Click the Edit icon under the Service Profiles column.

   The Set Service Profile dialog box appears on the screen.

8. Select a service profile in the list and click Save.

   The selected service profile appears in the list.

9. Click Publish to change the status from Uninitialized to Success.

You have created your NSX security policy for deploying Trellix MOVE AntiVirus (Agentless).

Create an NSX Security Group

Select the required Clusters or Virtual Machines from the available vCenter and configure them as a security group. This configuration allows you to assign the security policy to the group and protect its VMs.

Make sure that:

• VMware vSphere is installed and added to the cluster.

• The Trellix MOVE AntiVirus service is registered with NSX Data Center Manager using ePO - On-prem.

• You deploy the Trellix MOVE AntiVirus SVM

1. Log on to the NSX manager console as an administrator.

2. Select Security → Endpoint Protection → Endpoint Protection Rules, then click the Rules tab.

3. In the list of policies, click the desired policy and click +Add Rule.

4. In the new rule, rename the rule name and click the Edit icon under the Groups column.

   The Set Groups dialog box appears on the screen.

5. In the Set Groups dialog box, click +Add Group.

6. Enter the name in the Group Name field.

7. Click Set Members under the Compute Members column.

   The Select Members dialog box appears on the screen.

8. Under Membership Criteria, click +Add Criteria to add multiple criteria. Maximum number of allowed criteria are five.

9. In the Criteria row, select the desired values from the dropdown lists and enter the field values, then click Apply.

10. Click Save and click View Members to check the effective list of virtual machines in the group.

Your security group is added and contains the virtual machines to be protected from the selected cluster.

Verify the SVM deployment on ePO - On-prem

To verify the Managed State of the deployed SVM.

Make sure that:

• The Trellix MOVE AntiVirus service is registered with ePO - On-prem.

• You deploy the Trellix MOVE AntiVirus SVM.

• The Installation Status appear as Succeeded and Service Status as Up in NSX console.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → System Tree → Systems.

3. Under Managed State column, verify the SVM state as Managed.

Note

The SVM name is in the format of <NSX Manager Name>-<Hostname prefix>-host-xx.

Create Policies and Settings on ePO - On-prem

If you want to support multi vCenter environment with Trellix MOVE AntiVirus (Agentless), then you need to create individual policy and settings to each multi vCenter environment. The policy catalog on the ePO - On-prem of the Trellix MOVE AntiVirus contains the policies and settings required for each vCenter.

Create a On Access Scan policy

After you register the Trellix MOVE AntiVirus on the ePO - On-prem server, you need to create a On Access Scan policy each for every vCenter that you want to protect with Trellix MOVE AntiVirus.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Policy → Policy Catalog.

3. Select MOVE AntiVirus 4.x.x from the Product drop-down list, then click New Policy.

   The Create a new policy dialog box appears on the screen.

4. In the Create a new policy, select On Access Scan from the Category drop-down list.

5. Select My Default from the Create a policy based on this existing policy drop-down list.

6. Enter the name of your policy in Policy Name.

7. Click OK to save the policy.

The new On Access Scan policy page appears on the screen with all parameters and their values.

According to your requirements, edit the values of the parameters and click Save otherwise click Cancel.

Create an On Demand Scan policy

After you register the Trellix MOVE AntiVirus on the ePO - On-prem server, you need to create a On Demand Scan policy each for every vCenter that you want to protect with Trellix MOVE AntiVirus.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Policy → Policy Catalog.

3. Select MOVE AntiVirus 4.x.x from the Product drop-down list, then click New Policy.

   The Create a new policy dialog box appears on the screen.

4. In the Create a new policy, select On Demand Scan from the Category dropdown list.

5. Select My Default from the Create a policy based on this existing policy dropdown list.

6. Enter the name of your policy in Policy Name.

7. Click OK to save the policy.

The new On Demand Scan policy page appears on the screen with all the parameters and their values.

As per your requirements, edit the values of the parameters and click Save otherwise click Cancel.

Create a SVM Settings policy

After you register the Trellix MOVE AntiVirus on the ePO - On-prem server, you need to create a SVM Settings policy each for every vCenter that you want to protect with Trellix MOVE AntiVirus.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Policy → Policy Catalog.

3. Select MOVE AntiVirus 4.x.x from the Product drop-down list, then click New Policy.

   The Create a new policy dialog box appears on the screen.

4. In the Create a new policy, select SVM Settings from the Category drop-down list.

5. Select My Default from the Create a policy based on this existing policy drop-down list.

6. Enter the name of your policy in Policy Name.

7. Click OK to save the policy.

   The new On Access Scan policy page appears on the screen with all the parameters and their values.

8. Under SVM Configuration → Agentless on the policy settings page, configure these settings as needed, then click Save.

   • Hypervisor/vCenter Server — Enter the valid IP address of either the hypervisor that the SVM resides on or the vCenter server (vCenter details are recommended to provide here).

   • Protocol — Select https or http, depending on the protocol the server uses to receive client requests.

   • vCenter/ESXi Port — Specify the port number of the SVM. The default port is 443.

   • Username — Enter the user name credentials to connect with the server.

Note

The user account requires at least read access to the vCenter server or the ESXi host. Domain-based credentials are supported only when the vCenter server or the ESXi host has been configured to support domain-based authentication.

• Password — Enter the password associated with the user.

Note

After you save and reopen the SVM Settings policy, the vCenter Password field appears blank. Though it appears blank, the password is encrypted and saved in the policy settings. Confirm the password to test connection settings.

• Confirm password — confirm the password.

• SVM Time Zone — Select your local time zone from the drop-down list.

• NTP Servers(s) — Select Use Default servers or Use following Servers. If Use following Servers is selected, enter the NTP server details.

1. Click Test connection settings to test the connection to the hypervisor/vCenter Server and then click Save to save the new settings to your SVM Settings policy.

Create a Options policy

After you register the Trellix MOVE AntiVirus on the ePO - On-prem server, you need to create a Options policy each for every vCenter that you want to protect with Trellix MOVE AntiVirus.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Policy → Policy Catalog.

3. Select MOVE AntiVirus 4.x.x from the Product drop-down list, then click New Policy.        

   The Create a new policy dialog box appears on the screen.

4. In the Create a new policy, select Options from the Category dropdown list.

5. Select My Default from the Create a policy based on this existing policy dropdown list.

6. Enter the name of your policy in Policy Name.

7. Click OK to save the policy.

8. The new Options policy page appears on the screen with all the parameters and their values.

9. On the policy settings page, click Show Advanced to see all the settings.

10. Under Quarantine Manager → Agentless only on the policy settings page:        

    1. Enter the network share under Quarantine network share.

    2. Enter the network domain and username under Network domain and username.

    3. Enter the network domain password under Network Password and Confirm Password.

11. Click Save to save the new settings to your Options policy.

Create a SVM Manager settings policy

After you deploy the Trellix MOVE for Multi-Platform AntiVirus to the clients from the ePO - On-prem server, you need to create a policy for SVM Manager settings policy. Using this policy, you can configure the ODS scheduler, Scanning options and other options.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Policy → PolicyCatalog.

3. Select MOVE AntiVirus 4.10.x from the Product drop-down list, then click New Policy.

   The Create a new policy dialog box appears on the screen.

4. In Create a new policy, select SVM Manager Settings from the Category drop-down list.

5. Select My Default from the Create a policy based on this existing policy drop-down list

6. Enter the name of your policy in Policy Name.

7. Click OK to save the policy

   The new SVM Manager Settings policy page appears on the screen with all the parameters and their values.

   As per your requirements, edit the values of the parameters and click Save otherwise click Cancel.

Create a Shared Cloud Solutions policy

After you deploy the Trellix MOVE for Multi-Platform AntiVirus to the clients from the ePO - On-prem server, you can create a Shared Cloud Solutions policy. Using this policy, you can configure Threat Intelligence Exchange and Intelligent Sandbox settings.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Policy → PolicyCatalog.

3. Select MOVE AntiVirus 4.10.x from the Product drop-down list, then click New Policy.

   The Create a new policy dialog box appears on the screen.

4. In Create a new policy, select Shared Cloud Solutions from the Category drop-down list.

5. Select My Default from the Create a policy based on this existing policy drop-down list

6. Enter the name of your policy in Policy Name.

7. Click OK to save the policy

   The new Shared Cloud Solutions policy page appears on the screen with all the parameters and their values.

   As per your requirements, edit the values of the parameters and click Save otherwise click Cancel.

Group SVM and client systems under vSphere

The Trellix MOVE AntiVirus service deployment to the client systems and their status are visible in their respective vCenter. In multiple vCenters scenarios, after deploying the virtual machines with Trellix MOVE AntiVirus Agentless, each client system and SVM is shown under their respective vCenter.

The vCenter dashboard shows the Trellix MOVE AntiVirus Agentless deployment and functional status. When you register all your VMware vSphere accounts under Registered Cloud Accounts, the same systems and SVMs must appear under their respective groups in the ePO under System Tree > My Organization > vSphere.

Lost and Found

For example, if you manage two vCenter accounts, those two accounts reflect as groups under vSphere. There are some scenarios where the systems and SVMs might not appear under their respective groups and their SVM might appear in the Lost and Found section.

Verify the SVA and Client System are grouped properly

The SVA and client system must present in the same group in the ePO - On-prem which are named after the vCenters. The sync process must be verified between VMware vSphere vCenters and ePO - On-prem.

Make sure that multiple VMware vCenter servers that manage the ESXi servers, which host the guest VMs are configured properly.

Make sure that all vCenter Servers are configured on the NSX Manager Console.

Make sure that the VMware vCenter account with the ePO - On-prem under Registered Cloud Account.

'Make sure the SVM deployment is completed successfully from the NSX console

1. Log on to ePO - On-prem as an administrator.

2. Navigate to System Tree and expand My Organization → vSphere.        

   The account groups appear with their respective client systems and SVAs.

3. Select each account and check whether SVA and client system IP addresses match with your respective vSphere vCenter client system and SVA IP addresses.

If the account groups systems and SVAs are not grouped properly as expected, then delete all the client systems and SVAs from the vSphere and Lost and Found groups. After that make sure to delete the Group.

Delete the groups and systems

In some scenarios, the groups under My Organization → vSphere don't have the SVAs and Client systems are not organized as per vSphere vCenters. You must delete all the groups and systems that are grouped under different accounts and Lost and Found.

Make sure that multiple VMware vCenter servers that manage the ESXi servers, which host the guest VMs are configured properly.

For details about product features, usage, and best practices, click ? or Help.

1. Log on to ePO - On-prem as an administrator.

2. Navigate to System Tree and expand My Organization > vSphere.

   The account groups appear with their respective client systems and SVAs.

3. Select each account, under Systems tab, select the checkbox to select all the systems.

4. Select Delete under Actions → Directory Management on the Wake Up Agents toolbar.

   The Delete dialog box appears on the screen.

5. Click Ok on the Delete dialog box.

   All the systems are deleted under the group with a message Deleted Systems at the bottom right corner.

6. Repeat the above two steps to delete all the systems under each group and Lost and Found.

7. Under System Tree, select each group account and click System Tree Actions → Delete Group.

   The Delete Group dialog box appears on the screen.

8. Click Ok on the Delete Group dialog box.

   The group is deleted with a message Group deleted successfully at the bottom right corner.

Make sure that all the systems and groups are deleted, even delete the systems under Lost and Found. Now sync your vSphere accounts on the Registered Cloud Accounts page.

Sync all vSphere accounts in ePO - On-prem

After cleaning up the group accounts and systems associated to each configured vSphere account, check the vSphere accounts registered under Registered Cloud Accounts.

Make sure that the VMware vCenter account with the ePO - On-prem under Registered Cloud Account.

For details about product features, usage, and best practices, click ? or Help.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Configuration → Registered Cloud Account

3. In the list of VMware vSphere accounts, under Actions, click Sync for every account.

This syncs the VMware vSphere accounts and groups these as accounts with their SVAs and Client Systems.

Assign On-access scan, On-demand scan, options, and svm settings to the Groups in System Tree

The vCenters are created as a group account with their corresponding SVAs and client systems. The assigned policies are the default policies assigned to the group and their systems for the deployed Trellix MOVE AntiVirus software.

Make sure to provide the NSX manager details for only one vCenter account in the ePO - On-prem and registered it to the NSX Manager. This validates your NSX Data Center Manager for all vCenters.

Make sure to deploy the Trellix MOVE AntiVirus SVM on all vCenters from NSX manager console.

The newly created policies specifically for the vSphere groups are applied as follows:

1. Log on to ePO - On-prem as an administrator.

2. Navigate to System Tree → My Organization → vSphere, select a vSphere account and, click the Assigned Policies tab.

3. Select the latest version of MOVE AntiVirus from the Product drop-down list.

   All default policies assigned to the vCenter appear in this list.

4. For each policy, click Edit Assignment under Actions.

   The policy assignment page appears for the selected policy.

5. Under Assignment page, edit the options as:

   1. Choose Inherit from as Break inheritance and assign the policy and settings below.

   2. Select your policy from the Assigned Policy drop-down list.

   3. Choose Lock policy inheritance as Unlocked.

6. Click Save and click OK in the dialog box to save your changes.

Now the client systems under each vSphere account are assigned with created policies.

Repeat the same for assigning the created policies for On Access Scan, On Demand Scan, SVM settings and Options.

Configure the vCenter details in SVM Settings policy in ePO - On-prem

You must specify these details under SVM Configuration in the Trellix MOVE AntiVirus SVM Settings policy in ePO - On-prem.

Note

If you failed to provide the vCenter details:

• The IP address for the threat events generated for client will not appear.

• The Security tags will not work.

• The Agentless Anti-Malware Protection Status for the clients will not appear.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Policy → Policy Catalog.

3. Select MOVE AntiVirus 4.x.x from the Product drop-down list, then select SVM Settings from the Category drop-down list.

4. Click Edit SVM Setting policy .

5. Under SVM Configuration, configure these settings as needed, then click Save.        

   • Hypervisor/vCenter Server — Enter the valid IP address of either the hypervisor that the SVM resides on or the vCenter server (vCenter details are recommended to provide here).

   • Protocol — Select https or http, depending on the protocol the server uses to receive client requests.

   • vCenter/ESXi Port — Specify the port number of the SVM. The default port is 443.

   • Username — Enter the user name credentials to connect with the server.

Note

The user account requires at least read access to the vCenter server or the ESXi host. Domain-based credentials are supported only when the vCenter server or the ESXi host has been configured to support domain-based authentication.

• Password — Enter the password associated with the user.

Note

After you save and reopen the SVM Settings policy, the vCenter Password field appears blank. Though it appears blank, the password is encrypted and saved in the policy settings. Confirm the password to test connection settings.

• Confirm password — confirm the password.

• SVM Time Zone — Select your local time zone from the drop-down list.

• NTP Servers(s) — Select Use Default servers or Use following Servers. If Use following Servers is selected, enter the NTP server details.

6. Click Test connection settings to test the connection to the hypervisor/vCenter Server and then click Save.

Perform wake-up agent and Antimalware test (EICAR)

Once the SVM appears as Managed in Trellix System Tree, perform wake up agent on the SVM and antimalware test (EICAR) on clients.

Make sure that:

• You deploy the Trellix MOVE AntiVirus SVM.

• You apply the NSX security policy to the NSX security group.

• The policy reflection of On Access policy from NSX to ePO - On-prem.

• SVM appears as Managed in ePO - On-prem System Tree.

Note

As the Trellix software is not installed in the Agentless, the client appears as unmanaged in the ePO - On-prem System Tree.

1. Policy enforcement based on time configured at ePO - On-prem.

   1. In the ePO - On-prem, click Menu → Automation → MOVE AntiVirus Deployment → Configuration → Agentless → Server Settings.

      The Server Settings page opens.

   2. The default Policy Enforcement Interval (Minutes) is 60 minutes. This reflects that all policy changes in every 60 minutes automatically to SVM.

   3. Click Run for Run Policy Collection to reflect any policy changes immediately to SVM.

      The Server Settings page opens.

2. Once the policy collection is completed successfully, perform a Wake-up Agent on SVM.

   1. In the ePO - On-prem, click System Tree and select the managed SVMs.

   2. From the Actions drop-down list, click Agent → Wake up Agents → Wake Up Trellix Agent.

      The Wake Up Trellix Agent page opens.

   3. Select Options and Force policy update, then click OK.

      You can view the status on the Server Task Log.

3. Once the Wake-up Agent is completed successfully, test the antimalware (EICAR) on client.

4. Log on to any client which is part of cluster where SVM is deployed.

5. Download the test eicar file from eicar.org.

   Once the malware is detected in client, it denies the access as the quarantine details are not configured by default in ePO - On-prem.

6. To delete the malware when it detects, configure the quarantine details.

   1. Click Menu → Policy → Policy Catalog → Options → My Default → Edit → Quarantine Manager → (Agentless only).

   

7. (Optional) If you don't want to configure the quarantine details for Agentless, you can choose to delete the malware when it detects.

   1. Log on to ePO - On-prem as an administrator.

   2. Click Menu → Policy → Policy Catalog → On Access Scan → My Default → Edit → Actions.

   3. To disable the quarantine for Agentless, and to delete the malware when it detects, select Delete files automatically from the Threat detection primary response drop-down list.

Enable NSX tagging through ePO - On-prem

Using ePO - On-prem, you can create On Access Scan and On Demand Scan policies with the configurations needed for high security.

Make sure that:

• You have registered the Trellix MOVE AntiVirus service with ePO - On-prem.

• You have specified your vCenter details under SVM Configuration in the Trellix MOVE AntiVirus SVM Settings policy in ePO - On-prem.

On-prem.

Registering the Trellix MOVE AntiVirus service exports all On Access Scan policies of Trellix MOVE AntiVirus from ePO - On-prem to NSX. When a new On Access Scan policy is created or duplicated, all updates are immediately exported to NSX. These policies are included in the NSX Service Profiles.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Automation → MOVE AntiVirus Deployment.

3. On the Configuration tab under Agentless, click Server Settings → Edit.        

   The Edit Server Settings page opens.

4. Select these tagging options under NSX Tagging and click Save.        

   • NSX Virus Found Tag — In the ePO - On-prem for the On Access Scan policy, if the primary action is configured to deny access to files and when malware is detected and deleted on a client system, the client system is tagged with ANTI_VIRUS.VirusFound.threat=high.                

     When the file is deleted on a next successful on-demand scan, the tag is removed.

     On the NSX manager console, under Inventory → Tags, the VM systems with this tag gets added under the scope name ANTI_VIRUS.VirusFound.threat=high.

   • NSX Unprotected Tag — In the NSX Manager console, the system is tagged with this tag when the system is unprotected or the OAS scan is disabled.                

     On the NSX manager console, under Inventory → Tags, the VM systems with this tag gets added under the scope name MCAFEE.MOVE.unprotected=yes.

Upgrade Trellix MOVE AntiVirus (Agentless)

Make sure that you have installed or upgraded the supported products from Trellix and VMware. For more information, see RN 4.10.2

Upgrade extension and SVA OVF

1. Log on to ePO - On-prem as an administrator.

2. Check in the extension and packages individually:        

   • Select Menu → Software → Extensions → Install Extension.

3. Select Menu → Automation → MOVE AntiVirus Deployment → SVM Repository.

4. On the Configuration tab under Agentless, click SVM Repository to open the SVM OVF Details page with these Trellix MOVE AntiVirus SVM OVF.

5. Click Actions → Add SVM to open the Check-in SVM OVF (zip) file page.

6. Click Choose File to select the Trellix MOVE AntiVirus SVM package, then click Open → OK.

7. Select Menu → Automation → MOVE AntiVirus Deployment → Service and click Upgrade in the actions column.

Upgrade the Trellix Move Antivirus SVM

1. Log on to the NSX Data Center manager as an administrator.

2. In the NSX Data Center manager console, navigate to System and then in the left pane, click Service Deployment.

3. Under Deploy Service, select menu and choose from the options to deploy a different appliance.

4. A new SVA is installed in the vCenter after the successful upgrade.

Note

Earlier SVA versions are removed from the vCenter after the new version is installed.

Configure security group and security policy in NSX Manager

1. Log on to the NSX Manager console as an administrator.

2. Select Security → Endpoint Protection → Endpoint Protection Rules → Configure service profile and policy

Note

When a duplicate policy is observed in the Vendor Template after an upgrade, select the bottom policy in Endpoint Protection Rules → Service profiles.

Upgrade NSX Manager

Upgrade NSX Manager to 4.x.x.x. For more information, see docs.VMware.com

Uninstall Trellix MOVE AntiVirus (Agentless)

The process of removing Trellix MOVE AntiVirus (Agentless) consists of removing the Trellix MOVE AntiVirus service from the clusters and removing the configurations and extensions from ePO - On-prem.

Uninstall the Trellix MOVE AntiVirus 4.x.x in an NSX environment

A full uninstallation involves removing these components: Trellix MOVE AntiVirus SVM, Trellix MOVE AntiVirus service, NSX Manager details, and the Trellix MOVE AntiVirus extension.

Remove the policies and service profile from NSX console

You can remove the policies and service profile from NSX console using the VMware NSX console.

1. Log on to VMware NSX console.

2. Select Security → Endpoint Protection Rules.

3. Select Rules → Policies and delete the selected policy.

4. Select Service Profiles, select the Service Profile and delete the service profile.

Remove Trellix MOVE AntiVirus SVM from the cluster

Using the NSX console, you can remove the Trellix MOVE AntiVirus service, which is deployed to one or more clusters.

1. Log on to NSX console as an administrator.

2. Click System → Service Deployments → Deployment.

3. Click the Available Actions icon and click Delete or Force Delete.        

   The Delete Service Deployment window opens.

4. Click Delete to delete the service deployment.

Unregister the Trellix MOVE AntiVirus service with NSX Manager from ePO - On-prem

Select the registered VMware NSX Manager and unregister it from the ePO - On-prem server.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Automation → MOVE AntiVirus Deployment → Service → NSX Manager. This action lists all NSX Managers registered in ePO - On-prem.

3. From the Actions column on the MOVE Service Registration page, click Unregister for the registered NSX Manager. A

   confirmation dialog box appears.

4. Click OK to confirm.

Uninstall the extension

Uninstall the Trellix MOVE AntiVirus extensions from ePO - On-prem.

1. Log on to ePO - On-prem as an administrator.

2. Select Menu → Software → Extensions.

3. From the Extensions tab under McAfee group, select Data Center Security.

4. Click Remove next to each extension in this order.

   • MOVE AntiVirus License

   • MOVE AntiVirus

   • MOVE AntiVirus Common

   • vSphere Connector Extension

   • MDCC