Last Updated: August 29, 2024

Overview

Trellix Management for Optimized Virtual Environments AntiVirus (Trellix MOVE AntiVirus) is an anti-virus solution for virtual environments. It provides protection and optimal performance for your organization without having to install an anti-virus application on every virtual machine.

Trellix MOVE AntiVirus detects threats and then protects your environment based on settings that you configure.

You can configure the software as a standalone product, or use Trellix ePolicy Orchestrator - On-premises to configure, manage, and enforce your policies. After the configuration, you can use queries and dashboards to track activity and detections.

The software includes two deployment options, Multi-platform and Agentless. Both options provide consistent protection and can be managed and reported through Trellix ePO - On-prem.

Key features

Trellix MOVE AntiVirus features enable you to secure and protect your enterprise systems without compromising on performance. The key features are listed below.

Note:

Each feature that is listed below is available either in both Multi-platform and Agentless deployment or only one. You can know about the availability of the feature by checking the column Multi-platform and Agentless in the table below.

Working

Trellix MOVE AntiVirus detects, resolves, and logs information about detected threats. The software is installed on Trellix MOVE AntiVirus Security Virtual Machine (SVM) to perform these tasks.

The software includes two deployment options, Multi-platform and Agentless. Both options provide consistent protection and are managed and reported on by Trellix ePO - On-prem.

Multi-platform

Multi-platform is an agent-based deployment option that offloads all scanning to a dedicated Security Virtual Machine (SVM) that runs the Trellix® Endpoint Security software. Guest VMs are no longer required to run anti-virus software locally, which improves the performance for anti-virus scanning, and increases VM density per hypervisor.

Note

In the workflow mentioned below, the assumption is that Trellix Threat Intelligence Exchange and Trellix Intelligent Sandbox are enabled.

1. The file enters the network, where Trellix MOVE AntiVirus is installed.

2. Trellix MOVE AntiVirus client looks for the file reputation in the local cache of the VM.

3. When the search provides no results, then the file is provided to the Security Virtual Machine (SVM) to check the file reputation in the global cache.

4. If the search in local and global cache provides no results, then the file is provided to the Threat Intelligence Exchange for inspection, which internally requests the Global Threat Intelligence for the file reputation.

5. If the file's reputation is not available in Global Threat Intelligence, then the file is sent to Intelligent Sandbox for scan.

6. As the scan by Intelligent Sandbox is a time-consuming process, the file is also sent to the AMCore engine for scanning.

7. Intelligent Sandbox sends the results to the SVM after completion of the scan.

Note

If Threat Intelligence Exchange and Intelligent Sandbox are not enabled, then the file is sent for scanning after step 3 and therefore, steps 4, 5, 6, and 7 are not relevant.

8. If the file is malicious, then you can check the Threat Event Log in Trellix ePO - On‑prem to see the results.

Agentless

This deployment method integrates with VMware NSX-T Manager. It protects your virtual environment from malware without a Trellix Agent for easy deployment and setup. This deployment provides virus protection for VMs on the hypervisor.

1. The virus enters the network and tries to infect a VM, where Trellix MOVE AntiVirus is installed.

2. The Security Virtual Machine (SVM) is notified about the new file in the network through the third-party agents. After receiving the file information, the SVM initiates the search for the same file in the global cache.

3. When the search in global cache provides no results, then the SVM requests Trellix GTI for the file's reputation.

4. If the file's reputation is not available in Trellix GTI, then the SVM initiates a file scan.

5. If the file is malicious, then you can check the Threat Event Log in Trellix ePO - On-prem to see the results.

Configuring Trellix MOVE AntiVirus

Configure Trellix MOVE AntiVirus settings to prevent malware access, keep your protection up to date, and scan for malware on client systems.

Trellix MOVE AntiVirus provides two types of file scanning, on-access and on-demand. You can customize the scan settings based on your demands and requirements.

Multi-platform components

Each component performs specific functions to keep your environment protected.

ePolicy Orchestrator - On-premises — A management platform that communicates with the Trellix Agent, manages the Multi-platform configuration, and provides reports on malware discovered in your virtual environment.

Hypervisor — A virtual operating platform that allows multiple operating systems to run concurrently on a hosted system and manages the execution of the guest operating system.

Trellix Agent — A client-side component that communicates with Trellix ePO - On-prem, applies policies to each VM, and deploys the Trellix MOVE AntiVirus client.

Trellix MOVE AntiVirus client — The client software that allows VMs to work with the Security Virtual Machine (SVM) for file scanning and malware detection. Enforces actions on the client when a threat is detected.

Trellix MOVE AntiVirus SVM — The Security Virtual Machine VM that provides offloaded scanning support for VMs, minimizing the performance impact on virtual desktops.

SVM Manager — A load balancing component that automatically assigns SVM to Multi-platform clients based on configurable parameters like scan server load, Trellix ePO - On-prem tags, and IP address ranges.

Trellix MOVE AntiVirus Meta Package extension — The product extension that provides policies and controls for configuring and managing the self-protection for the product's command line interface. You can enable events and logging details of the Trellix MOVE AntiVirus client through Trellix ePO - On-prem. It provides policies and controls for configuring and managing components such as SVM Manager, SVM Settings, on-access and on-demand scanning, and shared cloud solutions. It provides the configurations required for managing the Trellix MOVE AntiVirus SVM through Trellix ePO - On-prem.

Trellix ENS — Anti-virus software that enables anti-virus scanning for the SVM virtual machine and communicates with the Trellix GTI servers.

vSphere Connector — A Data Center Connector that helps you discover and import your virtual infrastructure using Trellix ePO - On-prem. You can also view the virtualization properties and protection status of your virtual machines, and manage them.

Agentless components

Each component performs specific functions to keep your environment protected.

ePolicy Orchestrator - On-premises — A management platform that allows you to configure policies to manage Agentless configuration and provides reports on malware discovered in your virtual environment.

Security Virtual Machine (SVM) — The Trellix MOVE AntiVirus service package that provides anti-virus protection for VMs and communicates with the loadable kernel module on the hypervisor, Trellix ePO - On-prem, and the Trellix GTI servers. The SVM is the only system directly managed by Trellix ePO - On-prem. Endpoint Security for Linux Threat Prevention, Trellix Agent, and Trellix MOVE AntiVirus (Agentless) are pre-installed.

File Quarantine — Remote quarantine system, where quarantined files are stored on an administrator-specified network share.

Trellix GTI (Global Threat Intelligence) — A comprehensive, real-time, cloud-based threat intelligence service that classifies suspicious files that are found on the file system. When the real-time malware defense detects a suspicious program, it sends a DNS request for analysis to a central database server hosted by Trellix Advanced Research Center.

VMware vCenter — Console that manages the ESXi servers, which host the guest VMs that require protection.

Hypervisor (ESXi) — A virtual operating platform that allows multiple operating systems to run concurrently on a hosted system and manages the execution of the guest operating systems. ESXi is an embedded hypervisor for servers that runs directly on server hardware without requiring an extra underlying operating system.

VMware NSX-T Manager — Console that allows you to configure, provision, and automate the protection on the endpoints in a datacenter.

Virtual Machines (VMs) — Completely isolated guest operating system installations in a normal host operating system that support both virtual desktops and virtual servers.

Importance of creating a security strategy

Protecting your virtual systems from malware requires a well-planned strategy: define threat prevention and detection, response to threats, and ongoing analysis and tuning.

Prevent — Avoiding threats

Define your security requirements to make sure that your data sources are protected. Then, develop an effective scan strategy to stop intrusions before they gain access to your environment.

Configure these features to prevent intrusions:

• Self-Protection — (Multi-platform only) One of the first things that malware tries to do during an attack is to disable your system security software. Configure Self-Protection for Trellix MOVE AntiVirus (Multi-platform) to prevent Trellix MOVE AntiVirus service, files, and registries from being stopped or changed.

• Common scan options — Enable Trellix MOVE AntiVirus and configure options that apply to all scans, including:        

  • (Multi-platform) Quarantine location and the number of days to keep quarantined items before automatically deleting them

  • (Agentless) Quarantine network share where the quarantined files are stored

• Scan Diagnostics client task — Run the scan diagnostic tool or use Trellix ePO - On-prem to calculate and display frequently scanned files, extensions, processes, and VMs. You can use the results to exclude the items from being scanned.

Detect — Finding threats

Develop an effective strategy to detect intrusions when they occur. Configure these features to detect threats:

• On-Access Scan — Scan for threats as files are read from or written to disk.

• On-Demand Scan — Run immediate and scheduled scans, including scanning for malware-related registry entries that weren't previously cleaned.

• Targeted On-Demand Scan — Select a system or a group of systems from the System Tree where to initiate the on-demand scan.

Respond — Handling threats

Use product log files, automatic actions, and other notification features to determine the best way to handle detections.

• Actions — Configure what happens in response to a detection.

• Alerts — Specify how Trellix MOVE AntiVirus notifies you when detections occur, including alerting options and logging.

Tune — Monitoring, analyzing, and fine-tuning your protection

Monitor and analyze your configuration to improve system and network performance, and enhance virus protection, if needed. Use these tools and features:

• Queries, dashboards, and server tasks (Trellix ePO - On-prem) — Monitor scanning activity and detections.

• Log files — View a history of detected items. Analyzing this information might reveal that you must enhance your protection or change the configuration to improve system performance.

• Scan policies — Analyze log files or queries and change policies to increase performance or virus protection, if needed. For

  example, you can improve performance by configuring exclusions, high- and low-risk process scanning, and disabling scan on write.

• Scan Diagnostics reports — Run and view these scan diagnostic queries:

  • Top 10 Scanned File Extensions for each SVM

  • Top 10 Scanned Files for each SVM

  • Top 10 Scanned Virtual Machines for each SVM

  • (Multi-platform only) Top 10 Scanned Processes for each SVM

Trellix ePO - On-prem features leveraged by Trellix MOVE AntiVirus

Trellix MOVE AntiVirus leverages these features in the Trellix ePO - On-prem environment.

About the Trellix ePO - On-prem system tree

The System Tree is a graphical representation of how your managed network is organized.

Trellix ePO - On-prem enables you to automate and customize system organization. The structure that you put in place affects how security policies are inherited and enforced throughout your environment.

You can perform these Trellix MOVE AntiVirus functions from the System Tree.

Using client tasks with Trellix MOVE AntiVirus

Use client tasks to automate system management in your Trellix ePO - On‑prem environment. For example, you can configure a client task to deploy product updates, run a diagnostic scan, or run an on‑demand scan.

Depending on your permissions, you can use predefined client tasks as is, edit them, or create custom client tasks.

Trellix MOVE AntiVirus adds these predefined client tasks to the Client Task Catalog.

For information about creating and using client tasks and the Client Task Catalog, see the Trellix ePO - On-prem documentation.

Using policies in Trellix ePO - On-prem

Policies enable you to configure managed products and apply the configuration to systems in your network, all from the Trellix ePO - On-prem console.

Policies are collections of settings that you create, configure, and apply, then enforce. Most policy settings correspond to settings that you configure for the Trellix MOVE AntiVirus client systems. Other policy settings are the primary interface for configuring and deploying the Trellix MOVE AntiVirus SVM and its components.

Trellix MOVE AntiVirus adds these categories to the Policy Catalog.

Trellix MOVE AntiVirus categories

Trellix MOVE AntiVirus Common categories

In each category, these predefined policies are available:

Trellix MOVE AntiVirus predefined policies

You can use predefined policies as is, edit the My Default policies, or create custom policies.

For information about creating and using policies and the Policy Catalog, see the Trellix ePO - On‑prem documentation.

Create a policy

Policies allow you to describe threat scanning behavior for specific virtual machines.

Before you begin:

• You installed the Trellix MOVE AntiVirus extension on the Trellix ePO - On-prem server.

• By default, policies created in Trellix ePO - On-prem are not assigned to any groups or systems. When you create a policy, you add a custom policy to the Policy Catalog. You can create policies before or after a product is deployed.

Task

1. Log on to Trellix ePO - On-prem as an administrator.

2. Select Menu → Policy → Policy Catalog, then select MOVE AntiVirus 4.10.x or MOVE AntiVirus Common 4.10.x from the Product drop-down list.

3. Click New Policy.

4. On the Create a new policy dialog box, configure the options, as required, then click OK.

5. Click the new policy that is created, then configure the policy options, as required.

6. Click Save.

7. In the Assigned Policy list, select the policy you created.

8. Click Save.

9. To apply the policy immediately, send wake-up agent call.

10. You installed the Trellix MOVE AntiVirus extension on the Trellix ePO - On-prem server.

The policies are not modified on client systems until the next agent-server communication that includes a Collect and Send Properties operation. This can be initiated from the agent on the client, or by sending wake-up agent call from Trellix ePO - On-prem.

Policy assignment (Agentless)

VM-based scan configuration is enabled by default. The Trellix ePO - On-prem administrator can enforce unique scan policies with exclusion to different groups, resource pool, or specific virtual machines protected by Trellix MOVE AntiVirus SVM on a hypervisor, even when Trellix Agent is not deployed to the client systems.

The on-access and on-demand scan policies can be applied to SVMs or to a specific virtual machine, or group. With VM-based scan configuration enabled by default, all VMs are protected by the on-access and on-demand scan policies, which are assigned to VM or group.

The on-access and on-demand scan policies can be assigned to the system using system-based assignment or rule-based assignment in Trellix ePO - On-prem.

Enable or disable policy collector

You can enable the Policy Collector to update the target SVMs with the latest on-access and on-demand scan policies.

Follow the steps below to enable or disable Policy Collector:

1. Login to Trellix ePO - On-prem.

2. Go to MOVE AntiVirus Deployment page.

3. In the Configuration tab, expand Agentless and then select Server Settings.

4. Select Edit.

5. Enable or disable Policy Collector.

Note

The Policy Collector dialog box appears.

6. Select Yes.

7. Select Save.

You have enabled or disabled Policy Collector successfully.

Update SVMs with scan policies

You can run the policy collector to update the target SVMs with the latest on-access and on-demand scan policies. The policies and updates are enforced to SVM in the default policy collection interval, which is 60 minutes.

Tip

Best practice: Specify the policy collection interval for your environment, as needed.

1. Select Menu → Automation → MOVE AntiVirus Deployment → Configuration → Server Settings.

2. Click Run next to Run policy collector.

   The Policy collection completed successfully message appears when policies are successfully collected.

3. Send wake-up agent call to the target SVMs.

Important

You can change the policy enforcement interval by navigating to Menu → Automation → MOVE AntiVirus Deployment → Configuration → Server Settings → Edit. You can also view the task log for policy collection (MOVE AntiVirus:Policy collection task) by navigating to Menu → Automation → Server Task Log. The policy collection task log is updated in the default policy collection interval, which is 60 minutes.

Assign an on-access scan policy to a group in Trellix ePO - On-prem

You can assign an on-access scan policy to a group in Trellix ePO - On-prem. This is applicable only for NSX-T environment.

1. Log on to Trellix ePO - On-prem as an administrator.

2. In the System Tree, select the group containing the virtual machines where you want to apply the policy.

3. Assign the policy to the group. For more information, see Assign a policy topic.

4. Log on to the NSX-T console as an administrator.

5. Click Security → Endpoint Protection Rules → Rules → Add policy.

6. Apply the same security policy to the NSX security group and wait for the policy reflection.

Note

Make sure that the same set of client VMs are part of Trellix ePO - On‑prem group and NSX security group.

7. Run the policy collector in Trellix ePO - On‑prem.

8. Send wake‑up agent call to the SVMs, which these client VMs are protected with.

Configuring policies

You can configure the Trellix MOVE AntiVirus client and SVM behavior with policy settings.

Configuring permissions sets

A permission set is a group of access rights granted to a user account for specific features of a product. Permission sets only grant permissions — they never remove a permission.

All permissions to all products and features are assigned automatically to global administrators. Other users must have permission assigned manually. Global administrators can assign existing permission sets when creating or editing user accounts and when creating or editing permission sets.

For more information about permission sets, see the product documentation for your version of Trellix ePO - On‑prem.

Trellix MOVE AntiVirus permission set

The Trellix MOVE AntiVirus software adds sections to the permission sets including the MOVE AntiVirus SVM Manager role.

Global administrators must grant permissions to users for the MOVE AntiVirus Common, MOVE AntiVirus Deployment, MOVE AntiVirus General, and MOVE AntiVirus Policy Permission sections, because no permissions are granted by default.

Other required permissions

The global administrator must give Trellix ePO - On-prem permissions to handle other areas that work with Trellix MOVE AntiVirus including queries, dashboards, and the Threat Event Log.

Using permission sets

A permission set specifies all permissions that apply to one object and controls users' level of access to features.

Trellix MOVE AntiVirus adds a permission group MOVE AntiVirus SVM Manager to each permission set.

Permission groups define the access rights to the features. Trellix ePO - On-prem grants all permissions for all products and features to global administrators. Administrators then assign user roles to existing permission sets or create permission sets.

Configure permission sets

Update the read/write permissions assigned to the user roles defined for your Trellix ePO - On-prem environment.

1. Log on to Trellix ePO - On-prem as an administrator.

2. Select Menu → User Management → Permission Sets.

3. Select a user role from the Permission Sets list.

4. Next to any Trellix MOVE AntiVirus permission, click Edit.

5. Select the permission level, as needed.

6. Click Save.

Configuring Trellix MOVE AntiVirus settings

Configure settings that apply to all components and features of Trellix MOVE AntiVirus in the MOVE AntiVirus Common 4.10.x and MOVE AntiVirus 4.10.x extensions.

Protect Trellix MOVE AntiVirus resources (Multi-platform)

One of the first things that a malware tries to do during an attack is to disable your system security software. Configure Self-Protection in the Options policy under MOVE AntiVirus Common 4.10.x to prevent Trellix MOVE AntiVirus services, files, and registries from being stopped or modified.

1. Log on to Trellix ePO - On-prem as an administrator.

2. Select Menu → Policy → Policy Catalog, then select MOVE AntiVirus Common 4.10.x from the Product list.

3. From the Category list, select Options.

4. Click the name of an editable policy.

5. Under Self-Protection, enable these options.        

   Options	Description
   Enable Self-Protection	To prevent Trellix MOVE AntiVirus services and files, registries from being stopped or modified.
   Enable Self-Protection for MOVE CLI	To protect the command-line utility from being accessed by unauthorized users.

6. Click Save.

Configure logging settings (Multi-platform)

Configure Trellix MOVE AntiVirus logging in the Options policy under MOVE AntiVirus Common 4.10.x to retrieve the software deployment and configuration details.

1. Log on to Trellix ePO - On-prem as an administrator.

2. Select Menu → Policy → Policy Catalog, then select MOVE AntiVirus Common 4.10.x from the Product list.

3. From the Category list, select Options.

4. Click the name of an editable policy.

5. Configure these settings on the page.

6. Click Save.

Configuring exclusions

Trellix MOVE AntiVirus enables you to fine-tune your protection by specifying items to exclude from scanning.

For example, you might need to exclude some file types to prevent a scanner from locking a file used by a database or server. A locked file can cause the database or server to fail or generate errors.

Every item in exclusion lists is mutually exclusive. Each exclusion is evaluated separately from the others in the list.

Note

To exclude a folder on Windows systems, append a backslash (\) character to the path. To exclude a folder on Linux systems, append a forward slash (/) character to the path.

Path exclusions

The Trellix MOVE AntiVirus product allows you to fine-tune the list of file types scanned including individual files, folders, and disks. You might need these exclusions because the scanners might scan and lock a file when that file is being used by a database or server. This might cause the database or server to fail or generate errors.

Note

When specifying the path exclusions, wildcards are supported.

(Windows system) All folder exclusion must append a backslash (\). For example, C:\temp\test\

If you do not append a backslash (\) for the specified path, the file test is excluded.

(Linux system) All folder exclusion must append a forward slash (/). For example, /temp/test/

If you do not append a forward slash (/) for the specified path, the file test is excluded.

Process exclusions (Multi-platform)

The Trellix MOVE AntiVirus product allows you to fine-tune the list of process types scanned including processes. You might need these exclusions because the scanners might scan and lock a process when that process is being used by a database or server. This might cause the database or server to fail or generate errors.

Note

When specifying the process exclusions, wildcards are not supported.

Wildcards in exclusions

You can use wildcards to represent characters in exclusions for files, folders, and detection names.

Valid wildcards

(Windows) Wildcards can appear in front of a backslash (\) in a path. For example, C:\ABC\*\XYZ matches C:\ABC\DEF\XYZ.

(Linux) Wildcards can appear in front of a forward slash (/) in a path. For example, ?DEF matches /CDEF.

Root-level exclusions (Multi-platform)

Trellix MOVE AntiVirus requires an absolute path for root-level exclusions. This means that you can't use leading \ or ?:\ wildcard characters to match drive names at the root level.

Instead, you can use leading **\ wildcard characters in root-level exclusions to match drives and subfolders.

For example, **\test\ matches the following:

• C:\test\

• D:\test\

• C:\temp\test\

• D:\foo\test\

Root-level exclusions (Agentless)

For Windows systems

Trellix MOVE AntiVirus requires an absolute path for root-level exclusions. You can use leading ?:\ wildcard characters in root-level exclusions to match drives and subfolders.

For example, ?:\test\ matches the following:

C:\test\

D:\test\

System variables (Multi-platform)

These are the Windows system variables that are supported for Multi-platform.

Import path exclusions from Trellix ENS Threat Prevention scan policies

If you are using Endpoint Security Threat Prevention in your environment, you can import the list of path exclusions that are defined in the on-access scan and on-demand scan policies of Endpoint Security Threat Prevention to Trellix MOVE AntiVirus scan policies.

• You installed the Trellix MOVE AntiVirus extension on the Trellix ePO - On-prem server.

• You installed the Endpoint Security Threat Prevention extension on the Trellix ePO - On-prem server.

• You have path exclusions list ready in the on-access scan and on-demand scan policies of Endpoint Security Threat Prevention.

1. Log on to Trellix ePO - On-prem as an administrator.

2. Select Menu → Policy → Policy Catalog, then select Endpoint Security Threat Prevention from the Product list.

3. From the Category list, select On Access Scan or On Demand Scan.

Note:

From the on-demand scan policy, you can import only the exclusions that are defined on the Full Scan tab.

4. Next to the name of the policy where you want to import path exclusions, click Export.        

   1. Next to the Download file, right-click the policy name and select Save link as...

   2. From the Save As window, browse to the location and click Save to save the xml file.

5. Select Menu → Policy → Policy Catalog, then select MOVE AntiVirus 4.10.x from the Product list.

6. From the Category list, select On Access Scan or On Demand Scan.

7. Click the name of an editable policy.

8. From Path Exclusions under the Exclusions option, click Import... to open the Import Exclusion Path dialog box.

9. Under Select the file to add exclusion path, click Choose File, then browse to the location, and select the xml file that is download from Endpoint Security Threat Prevention.

Note

If you want to clear the existing exclusions, select Clear existing exclusions.

10. Click OK to import the exclusions list.

    You can now see that the path exclusions are imported.

11. Click Save to save the changes in the policy.

Configure client load per SVM (Multi-platform)

Depending on your environment, you can configure the load type for each SVM, which specifies the workload and activities on clients. Configure the client load for each SVM in the SVM Settings policy.

The available options are:

• Low (Higher number of clients) — Less file activity on clients per SVM. When clients have less file activity, SVM can handle more clients. Default number of clients is 300.

• Medium (Moderate number of clients) — Medium file activity on clients per SVM. Default number of clients is 250.

• High (Fewer number of clients) — More file activity on clients per SVM. When clients have more file activity, SVM can handle fewer clients. Default number of clients is 150.

• Custom — Customize workload and activities for your clients.

Tip

We recommend 250. Increasing this value might cause performance issues or scan delays, or both.

Alerts for number of client connections and scan time

You can configure alerts for the number of client connections and scan time per SVM. Configure the Alert me option for each SVM in the SVM Settings policy.

The available options are:

• When number of client connections to the SVM reaches____% — Specify the SVM capacity level (in percentage) for number of client connections. A warning appears when the number of connected clients is greater than this level. Default value is 90.

• When average scan time on the SVM exceeds____seconds — Specify the SVM's average scan time (in seconds). A warning appears when the average scan time on the SVM exceeds this level. Default value is 10 seconds.

Types of scans

Scanning files for threats when the user accesses them protects against intrusions when they occur. Periodically scanning areas of your system that are most susceptible to infection ensures complete protection.

Trellix MOVE AntiVirus provides two types of scans: on-access scans and on-demand scans.

• On-access scan — Configure on-access scans to run on managed endpoints. When you access files, folders, and programs, the on-access scanner checks the operation and scans the item, based on criteria defined by the administrator. On-access scanning provides continuous and real-time detection of threats.

To configure and schedule on-access scans, use the on-access scan policy settings.

• On-demand scan — Configure and schedule on-demand scans to run on managed endpoints. This scan type examines all files or files in a specific folder on virtual machines for potential threats during the time specified. On-demand scans supplement the continuous protection of on-access scanning. You can also schedule regular scans at times that do not interfere with your work.

To configure and schedule on-demand scans, use these client task settings:

• Targeted On Demand Scan — Allows you to select a system or a group of systems from the System Tree to initiate the on-demand scan.

• Policy-based On-Demand Scan — Schedules the predefined on-demand scans. Configure the behavior of these scans in the policy settings for on-demand scan.

The Options policy includes settings that apply to all scan types.

Trellix GTI working

If you enable Trellix GTI for the on-access or on-demand scanner, the scanner uses heuristics to check for suspicious files.

The scanner submits fingerprints of samples, or hashes, to a central database server hosted by Trellix Advanced Research Center to determine if they are malware. By submitting hashes, detection might be made available sooner than when Trellix Advanced Research Center publishes the next DAT release.

You can configure the sensitivity level that Trellix GTI uses when it determines if a detected sample is malware. The higher the sensitivity level, the higher the number of malware detections. However, allowing more detections can result in more false positives. The Trellix GTI sensitivity level is set to Medium by default. Configure the sensitivity level for each scanner in the SVM Settings policy.

Enable or disable Trellix GTI

Follow the steps to enable or disable Trellix GTI and to specify the GTI timeout value.

1. Log on to Trellix ePO - On-prem.

2. Go to Policy Catalog.

3. Select MOVE AntiVirus 4.10.0 as the Product and SVM Settings as the Category.

4. Select a policy.

5. Select Show Advanced.

6. Select Enable GTI and specify the GTI timeout value in seconds.

   The GTI timeout value ranges from 1 to 10 seconds.

7. Select Save.

Note

You can specify the GTI timeout value only for MOVE AntiVirus Agentless.

You have now enabled or disabled Trellix GTI and specified the GTI timeout value.

Configure common scan settings

To specify settings that apply to both on-access and on-demand scans, configure the MOVE AntiVirus 4.10.x → Options policy settings.

The common scan settings in the policy apply to all scans:

• Quarantine Manager (Multi-platform) — Specifies the quarantine location and the number of days to keep quarantined items before automatically deleting them.

• Quarantine network share (Agentless) — Specifies the specified network share where the quarantined files are stored. Make sure that you have write permission to the shared folder.

Trellix MOVE AntiVirus supports only Windows share path for quarantine network share.

• SVM Server Communication (Multi-platform) — Specifies the scan server port for communicating with the client system.

• SVM Assignment (Multi-platform)        

  • Assign SVM using SVM Manager — Specifies the IP address of the SVM manager for assigning the SVM using SVM Manager.

  • Assign SVM manually — Specifies the IP address of the SVM to assign the SVM manually.

1. Log on to Trellix ePO - On-prem as an administrator.

2. Select Menu → Policy → Policy Catalog, then select MOVE AntiVirus 4.10.x from the Product list.

3. From the Category list, select Options.

4. Click the name of an editable policy.

5. Configure settings on the page, as required, then click Save.

On-access scanning

The on-access scanner examines files on the computer as the user accesses them, and provides continuous, real-time detection of threats.

On-access scanning (Multi-platform)

The on-access scanner integrates with the system at the lowest levels (file system filter driver) and scans files where they first enter the system.

The on-access scanner delivers notifications to the System Service interface when detections occur.

When an attempt is made to access or modify a file, the scanner intercepts the operation and takes these actions.

1. Examines the file at the client system.

2. Checks if any exclusion is defined in the policy. If any exclusion is defined for the file, the access is allowed.

3. If an exclusion is not defined, the scanner checks whether the file is present in local cache in the client system. If it is present, access is allowed.

4. If the file is not present in local cache, the scanner checks for publisher trust in the client system. If it matches, the access is allowed.

5. If the publisher trust does not match, the scanner checks for the file in global cache in the SVM. If the file is present, the access is allowed.

6. If the file is not present in global cache, the scanner compares the information in the file to the known malware signatures in the currently loaded DAT files.

   • If the file is clean, the result is cached and the read, write, or rename operation is granted. Trellix MOVE AntiVirus caches the result in the SVM and client system.

   • If the file contains a threat, the scanner sends the file nature as malware to the client systems, where the configured action is taken.

On-access scanning with TIE and Intelligent Sandbox enabled

1. On-access scanner goes through the steps 1 through 4 of How on-access scanning works.

2. If the publisher trust does not match:

   • The client looks for the reputation in global cache in the SVM. If the reputation is available, the access is allowed based on the Shared Cloud Solutions policy assigned to the system.

   • If the reputation is not available in global cache in the SVM, the client sends the file hashes to the SVM for TIE lookup.

   • The SVM checks the reputation cache for the file hash. If the file hash is found, the SVM gets the reputation data from the SVM cache and sends the reputation to the client and the action is taken.

   • (SVM is connected to TIE) If the file hash is not found in the SVM cache and TIE server does not have the reputation:

     • (Intelligent Sandbox is present) If the policy on the endpoint determines that the file must be sent to Intelligent Sandbox, the server sends the file for further analysis. To send the file to Intelligent Sandbox, these requirements must be met:

       • Advanced Threat Defense (ATD) option is configured in the Shared Cloud Solutions policy on the Trellix ePO - On-prem server.

• Size of the file is less than 10 MB

• The TIE server returns the file hash's reputation to the SVM once the data is received from Intelligent Sandbox after analyzing the file.

3. Trellix MOVE AntiVirus takes action based on the Shared Cloud Solutions policy assigned to the system that is running the file.

4. The SVM sends threat details as threat events to Trellix ePO - On-prem.

Changing when files are scanned

You can change the client policy to determine which files are scanned for threats and when.

By default, files are scanned when they are read from or written to disk, or when opened for backup. The Trellix Agent program files and the User Profile Manager process are excluded from scans.

When files are written to disk, the on-access scanner examines these files:

• Incoming files written to the local drive.

• Files (new, changed, or files copied or moved from one drive to another) created on the local drive or a mapped network drive (if enabled with Multi-platform).

When files are read from disk, the scanner examines these files:

• Outgoing files read from the local drive or mapped network drives (if enabled with Multi-platform).

• Files trying to execute a process on the local drive.

• Files opened on the local drive.

Caution

Depending on your environment, selecting On network drives can degrade network performance.

On-access scanning (Agentless)

The on-access scanner integrates with the system at the lowest levels (file system filter driver) and scans files where they first enter the system.

The on-access scanner delivers notifications to the System Service interface when detections occur.

When an attempt is made to access or modify a file, the scanner intercepts the operation and takes these actions.

1. Examines the file at the client system.

2. Checks if any exclusion is defined in the policy. If any exclusion is defined for the file, the access is allowed.

3. If an exclusion is not defined, the scanner checks whether the file is present in local cache in the client system. If it is present, access is allowed.

4. The scanner checks for the file in global cache in the SVM. If the file is present, the access is allowed.

5. If the file is not present in global cache, the scanner compares the information in the file to the known malware signatures in the currently loaded DAT files.

   • If the file is clean, the result is cached and the read, write, or rename operation is granted. Trellix MOVE AntiVirus caches the result in the SVM as part of global cache and client system as part of local cache.

   • If the file contains a threat, the scanner sends the file nature as malware to the client systems, where the configured action is taken.

Changing when files are scanned

You can change the client policy to determine which files are scanned for threats and when.

By default, files are scanned when they are read from or written to disk, or when opened for backup. The Trellix Agent program files and the User Profile Manager process are excluded from scans.

When files are written to disk, the on-access scanner examines these files:

• Incoming files written to the local drive.

• Files (new, changed, or files copied or moved from one drive to another) created on the local drive.

When files are read from disk, the scanner examines these files:

• Outgoing files read from the local drive.

• Files trying to execute a process on the local drive.

• Files opened on the local drive.

Configure on-access scan policy settings

These settings enable and configure on-access scanning, which includes specifying messages to send when a threat is detected and different settings based on process type.

1. Log on to Trellix ePO - On-prem as an administrator.

2. Select Menu → Policy → Policy Catalog, then select MOVE AntiVirus 4.10.x from the Products list.

3. Select On-Access Scan.

4. Click Edit for the name of an editable policy.

   Policy Catalog page opens.

5. Click Show Advanced.

6. Select Enable On-Access Scan to enable the on-access scanner and modify options.

7. Configure these settings:

8. For the Actions options, configure Threat detection primary response. Make sure that you select a primary action and a secondary action.

   Available primary actions:

   • Delete files automatically and quarantine — Once the threat is detected, it deletes and quarantines the threat to the specified location.

   Note

   (Agentless only) If no quarantine policy is configured, the Delete files automatically and quarantine action does not occur even if it is configured as the primary action.

   • Delete files automatically — Once the threat is detected, it deletes the threat.

   • Deny access to files — Prevents the user from accessing the file.

   Available secondary action:

   • Deny access to files — Prevents the user from accessing the file.

9. Click Save to store the policy.

On-demand scanning

The on-demand scanner examines the client systems for potential threats at regular intervals or at convenient times.

Use on-demand scans to supplement the continuous protection of the on-access scanner, such as to scan latent and inactive processes. You can also schedule regular scans at times that do not interfere with your work.

On-demand scans (Multi-platform)

The on-demand scanner searches files, folders, and registry for any malware that might have infected the computer.

You decide when and how often the on-demand scans occur. You can scan at a scheduled time or at startup.

The on-demand scanner intercepts the operation and takes these actions:

1. Examines the file at the client system.

2. Checks if any exclusion is defined in the policy. If any exclusion is defined for the file, the access is allowed.

3. If an exclusion is not defined, the scanner checks whether the file is present in local cache in the client system. If it is present, access is allowed.

4. If the file is not present in local cache, the scanner checks for publisher trust in the client system. If it matches, the access

   is allowed.

5. If the publisher trust does not match, the scanner checks for the file in global cache in the SVM. If the file is present, the access is allowed.

6. If the file is not present in global cache, the scanner compares the information in the file to the known malware signatures in the currently loaded DAT files.

   • If the file is clean, the result is cached and the read, write, or rename operation is granted. Trellix MOVE AntiVirus caches the result in the SVM and the client system.

   • If the file contains a threat, the scanner sends the file nature as malware to the client systems, where the configured action is taken.

   For example, if the action is configured to Delete files automatically and quarantine (the default setting), the scanner:

   • Deletes items that are detected as threats and saves copies in a non-executable format to the Quarantine folder.

   • Records the results in the activity log.

   • Notifies the user that it detected a threat in the file, and includes the item name and the action taken.

7. If the file doesn't meet the scanning requirements, the scanner doesn't check it. The scanner continues until all data is scanned.

The on-demand scan detection list is cleared when the next on-demand scan starts.

1. On-demand scanner goes through the steps 1 through 4 of How on-demand scanning works.

2. If the publisher trust does not match:

   • The client looks for the reputation in global cache in the SVM. If the reputation is available, the access is allowed based on the Shared Cloud Solutions policy assigned to the system.

   • If the reputation is not available in global cache in the SVM, the client sends the file hashes to the SVM for TIE lookup.

   • The SVM checks the reputation cache for the file hash. If the file hash is found, the SVM gets the reputation data from the SVM cache and sends the reputation to the client and the action is taken.

   • (SVM is connected to TIE) If the file hash is not found in the SVM cache and TIE server does not have the reputation:

     • (Intelligent Sandbox is present) If the policy on the endpoint determines that the file must be sent to Intelligent Sandbox, the server sends the file for further analysis. To send the file to Intelligent Sandbox, these requirements must be met:

       • Advanced Threat Defense (ATD) option is configured in the Shared Cloud Solutions policy on the Trellix ePO - On-prem server.    

       • Size of the file is less than 10 MB

     • The TIE server returns the file hash's reputation to the SVM once the data is received from Intelligent Sandbox after analyzing the file.

3. Trellix MOVE AntiVirus takes action based on the Shared Cloud Solutions policy assigned to the system that is running the file.

4. The SVM sends threat details as threat events to Trellix ePO - On-prem.

Optimizing the scanning performance on systems

To minimize the impact that on-demand scans have on a system, specify performance options when configuring these scans.

On-demand scans summary

ODS Summary feature is helpful in tracking ODS happening on the Trellix MOVE AntiVirus Multi-platform environment.

You can track ODS details from Client, SVM, and Trellix ePO - On-prem (Queries and Reports). For more information see, Trellix ePO - On-prem features leveraged by Trellix MOVE AntiVirus .

The ODS summaries on the clients are:

MP Clients: Information

View ODS stats on Client/SVM side

Client side

Shows the scan status (Running/Not Running) in percentage.

Run mvadm status command to view ODS current state (Running/Not Running). If ODS is running, this command shows the completion status in percentage.

SVM side

Shows the list of connected clients, total number of connected clients, clients running TODS and ODS.

Run mvadm stats ods command to get list of connected clients, clients running ODS, and clients running TODS.

Note

If scheduled ODS is running on clients, it displays the output in same format as TODS else NULL.

On-demand scans logging

A new log level ODSLOG is defined on client side to get the detailed logging when ODS is running. It creates separate empty log file ods.log on starting the service.

The detail logging information is available only if you enable loglevel == ODSLOG in command prompt, else only ODS summary is displayed on the Trellix ePO - On-prem. The ODS related logging summary is part of ods.log file.

Define separate log level on client side (ODSLOG):

• When ODS/TODS starts on MOVE client side, log ODS related logging in separate file (ods.log).

• Print ODS summary in case ODS starts, end, stop in ods.log file.

• Keep log rotation and configurable file size same as existing mvagent.log file.

On-demand scans (Agentless)

The on-demand scanner searches files, folders, and registry for any malware that might have infected the computer.

You decide when and how often the on-demand scans occur. You can scan at a scheduled time or at startup.

The on-demand scanner intercepts the operation and takes these actions:

1. Examines the file at the client system.

2. Checks if any exclusion is defined in the policy. If any exclusion is defined for the file, the access is allowed.

3. If an exclusion is not defined, the scanner checks whether the file is present in local cache in the client system. If it is present, access is allowed.

4. The scanner checks for the file in global cache in the SVM. If the file is present, the access is allowed.

5. If the file is not present in global cache, the scanner compares the information in the file to the known malware signatures in the currently loaded DAT files.        

   • If the file is clean, the result is cached and the read, write, or rename operation is granted. Trellix MOVE AntiVirus caches the result in the SVM as part of global cache and the client system as part of local cache.

   • If the file contains a threat, the scanner sends the file nature as malware to the client systems, where the configured action is taken.

For example, if the action is configured to Delete files automatically and quarantine (the default setting), the scanner:

• Deletes items that are detected as threats and saves copies in a non-executable format to the Quarantine folder.

• Records the results in the activity log.

6. If the file doesn't meet the scanning requirements, the scanner doesn't check it. The scanner continues until all data is scanned.

The on-demand scan detection list is cleared when the next on-demand scan starts.

Optimizing the scanning performance on systems

To minimize the impact that on-demand scans have on a system, specify performance options when configuring these scans.

Enable and configure on-demand scans

You can modify the on-demand scan policy to enable system on-demand scans, and to determine the schedule and frequency of scans.

You installed the Trellix MOVE AntiVirus extension on the Trellix ePO - On-prem server.

By default, on-demand scans are not enabled. Other scan settings (for example, exclusions) are inherited from the client scan policy.

1. Log on to Trellix ePO - On-prem as an administrator.

2. Select Menu → Policy → Policy Catalog, then select MOVE AntiVirus 4.10.x from the Products list.

3. Select On Demand Scan.

4. Click Edit for the name of an editable policy.

Policy Catalog page opens.

5. Click Show Advanced.

6. Configure these settings:

7. Click Save to store the policy.

On-demand scan events and log details

Trellix MOVE AntiVirus generates alerts for on-demand scans. You can view the ODS statuses and event logs on Trellix ePO - On-prem and client systems.

The log files for on-demand and on-access scans are available in the installation directory.

Under loglevel, an ODS module is introduced that allows the Trellix MOVE AntiVirus to record the logs. To enable ODS logging, run the command: mvadm loglevel enable ODS ALL.

In the client log file, you can search for terms like ODS: start scan and ODS: scan complete to find the status on-demand scan.

(Multi-platform only) You can also view the ODS status from the local system's Windows Event Log on the client system. (Event: On-Demand Scan Started on winvistax64mp.moveauto.com using engine version 5600.1067 and dat version 7203.0000)

Trellix MOVE AntiVirus generates alerts for on-demand scans. These alerts can be displayed in any of these locations:

• The local system's Windows Event Log

• The Trellix ePO - On-prem Threat Event Log

• The local system as a Trellix notification area pop-up menu

Server on-demand scan events (Multi-platform)

Server on-demand scan events (Agentless)

Targeted on-demand scans

The targeted on-demand scan feature allows the administrator to select a system or a group of systems where to initiate the on-demand scan.

When the admin initiates the targeted on-demand scan on the client system, Trellix Agent schedules the client task on the client system. The SVM picks the client task, then runs the scan on the client system, depending on the slot availability for the scan. Trellix Agent monitor shows the status such as TODSTask becomes active, TODSTask is successful, and TODSTask is finished, but this is not the actual on-demand scan status. You can view the on-demand scan status and event logs on Trellix ePO - On-prem and client systems.

The SVM runs the specified maximum concurrent targeted on-demand scans per SVM defined by the administrator. When the SVM has reached the maximum number of targeted on-demand scans, the recently initiated on-demand scan runs later when the targeted on-demand scan slot is available.

Example 1

Consider a scenario where:

• Restrict number of on-demand scans to____per SVM is set as 2

• Restrict number of targeted on-demand scans to____per SVM is set as 2

• No on-demand scan is running currently

• Two targeted on-demand scans are running currently

With these assumptions, if you configure one more targeted on-demand scan, the newly scheduled targeted on-demand scan starts when one of the existing targeted on-demand scans finishes.

Example 2

Consider a scenario where:

• Restrict number of on-demand scans to____per SVM is set as 2

• Restrict number of targeted on-demand scans to____per SVM is set as 2

• One or two on-demand scans are running currently

• Two targeted on-demand scans are running currently

With these assumptions, if you configure one more targeted on-demand scan, the newly scheduled targeted on-demand scan starts when one of the existing targeted on-demand scans finishes.

Configure targeted on-demand scans

Change the SVM Settings policy to enable on-demand scanning, and to set the concurrent scan value as needed.

You installed the Trellix MOVE AntiVirus extension on the Trellix ePO - On-prem server.

By default, on-demand scans are disabled. Other scan settings (for example, exclusions) are inherited from the client on-demand scan policy.

1. Log on to Trellix ePO - On-prem as an administrator.

2. Select Menu → Policy → Policy Catalog, then from the Product list select MOVE AntiVirus 4.10.0.

3. From the Category list, select SVM Settings.

4. Click the name of an editable policy.

5. Under Concurrent on-demand scans, configure these settings, then click Save.

Create and run targeted on-demand scan

Select a system or a group of systems from the System Tree and initiate the targeted on-demand scan.

• You installed the Trellix MOVE AntiVirus extension on the Trellix ePO - On-prem server.

• You enabled the Enable on-demand scan option in the On Demand Scan policy.

• You configured Restrict number of targeted on-demand scans to____per SVM in the SVM Settings policy.

• A new ODS does not start if an ODS is currently running on the targeted system.

1. Log on to the Trellix ePO - On-prem server as an administrator.

2. Select Menu → Systems → System Tree.

3. Select the VMs you want to run the targeted on-demand scan.

4. Click Actions → MOVE → Targeted ODS.

Note

(For Agentless) If any target VM is turned off, Trellix ePO - On-prem sends the task once the VM is turned on, then SVM initiates the scan.

5. On the Schedule page, schedule the task, then click Next.

6. On the Summary page, review the task details and click Save to run the on-demand scan.

Create and run targeted on-demand scan client task (Multi-platform)

Select a system or a group of systems from the System Tree and assign a client task to initiate the targeted on-demand scan.

• You installed the Trellix MOVE AntiVirus extension on the Trellix ePO - On-prem server.

• You enabled the Enable on-demand scan option in the On Demand Scan policy.

• You configured Restrict number of targeted on-demand scans to____per SVM in the SVM Settings policy.

• A new on-demand scan does not start if the on-demand scan is already running on the targeted system.

1. Log on to the Trellix ePO - On-prem server as an administrator.

2. Select Menu → Policy → Client Task Catalog.

3. From Client Task Types, select MOVE AntiVirus 4.10.x → Targeted On-Demand Scan [Multi-Platform].

4. Click the name of an existing client task or click New Task, then confirm the task type.

5. Configure the Task Name and Description on each tab. Also provide Folder Path (Optional), then click Save.

6. Click Assign, specify the servers where you want to assign the task, then click OK.

7. Click Schedule to schedule the task.

Configure deferred scan settings (Multi-platform)

The deferred scan feature optimizes file scanning for files where the previous scan timed out because of large file size, file structure, or file composition.

You installed the Trellix MOVE AntiVirus extension on the Trellix ePO - On-prem server.

When the previous on-access scan timed out, scanning for a file starts again with an increased or new timeout, depending on the file size. You can configure this timeout value and the file size using the Trellix ePO - On-prem server.

For an on-demand scan, the scanning for a file starts according to the timeout based on file size value specified in the deferred scan policy.

1. Log on to Trellix ePO - On-prem as an administrator.

2. Select Menu → Policy → Policy Catalog, select MOVE AntiVirus 4.10.x from the Product drop-down list, then select On-Access Scan or On-Demand Scan from the Category drop-down list.

3. Click New Policy or click the name of an existing policy to edit it.

4. Type a name for the new policy (for example, MOVE AV Scan Policy), then click OK.

5. Under Deferred Scan (Multi-Platform only), select Enable on-access deferred scan or Enable on-demand deferred scan and configure these file size ranges and scan timeout values, then click Save.

Client notifications for deferred scans

If the deferred scanning is incomplete after reaching the maximum timeout, access to the file is allowed.

These client notifications appear to the user on the client system for successful on-access scanning or scan timeouts:

• Deferred scan completed for file <C:\Test\file name>. File is safe to access.

• Deferred scan is in progress for file <C:\Test\file name>. (A thread in svchost.exe process took 45 seconds for scanning. Hence, access denied.)

• Deferred scan is timed out for file <C:\Test\file name>. Hence, access allowed.

• Deferred scan failed for file <C:\Test\file name> due to some internal error. Hence, access denied.

• Deferred scan failed for file <C:\Test\file name>. Hence, access denied.

• Access Denied: Deferred scan is in progress for file <C:\Test\file name>.

• Deferred scan completed for file <C:\Test\file name>. File is not accessible.

• Deferred scan completed for file <C:\Test\file name>. File is deleted.

Note

The client notifications do not appear for on-demand scan.

Identify frequently scanned items from Trellix ePO - On-prem (Agentless)

Select an SVM or a group of SVMs from the System Tree and assign a client task to calculate and display frequently scanned files, extensions, and VMs. You can include these results in the path exclusion policies to exclude them from being scanned.

You installed the Trellix MOVE AntiVirus extension on the Trellix ePO - On-prem server.

1. Log on to Trellix ePO - On‑prem as an administrator.

2. Select Menu → Policy → Client Task Catalog.

3. From Client Task Types, select MOVE AntiVirus 4.10.x → Scan Diagnostics [Agentless].

4. Click the name of an existing client task or click New Task and confirm the task type.

5. Configure these settings on each tab, then click Save.

   • Task Name — Specifies a unique name for the task.

   • Description — Specifies a description about the task.

   • Diagnosis Time — Specifies a description about the task.

6. Click Assign, specify the SVM where you want to assign the task, then click OK.

7. Click Schedule to schedule the task.

   At the end of specified minutes, the Trellix ePO - On‑prem completes the analysis and displays the results. The default allowed time limit is 10 minutes.

8. Select Menu → Reporting → Queries & Reports, then select MOVE AntiVirus 4.10.x [Agentless] under Trellix Groups to view and run these scan diagnostic queries:

   • MOVE AntiVirus: Top 10 Scanned File Extensions for each SVM — Lists the top 10 file extensions scanned by the SVM.

   • MOVE AntiVirus: Top 10 Scanned Files for each SVM — Lists the top 10 files scanned by the SVM.

   • MOVE AntiVirus: Top 10 Scanned Virtual Machines for each SVM — Lists the top 10 virtual machines that are sending maximum scan and checksum requests.

Identify frequently scanned items from command line (Agentless)

Use the scan diagnostic command-line tool to calculate and display frequently scanned files, extensions, and VMs, on a system running the Agentless software. You can include these results in the path exclusion policies to exclude them from being scanned.

• Make sure that the user is a root user, or has sudo permissions.

• The name of the VM is resolved only when the vCenter is successfully registered in the SVM Settings policy using Trellix ePO - On‑prem. Otherwise, only the VM ID appears.

Access the command line interface (CLI) of the SVM to create and display this report.

This diagnostic tool captures these details:

• Top 10 file scan requests.

• Top 10 file extensions.

• Top 10 virtual machines that are sending scan and checksum requests.

1. To identify the frequently scanned files, run the command:

   >cd /opt/McAfee/move/bin>sudo ./scan_diagnostic or sudo /opt/McAfee/move/bin/scan_diagnostic.

These parameters are available:

At the end of specified minutes, the tool completes the analysis and displays the results. The default allowed time limit is 1 minute.

2. (Optional) Change the time limit by editing the svaconfig.xml file located at /opt/McAfee/move/etc/.

Identify frequently scanned items from Trellix ePO - On-prem (Multi-platform)

Select one or a group of SVMs from the System Tree and assign a client task to calculate and display frequently scanned files, extensions, processes, and VMs. You can include these results in the path exclusion policies to exclude them from being scanned.

You installed the Trellix MOVE AntiVirus extension on the Trellix ePO - On-prem server.

1. Log on to Trellix ePO - On-prem as an administrator.

2. Select Menu → Policy → Client Task Catalog.

3. From MOVE AntiVirus 4.10.x under Client Task Types, select Scan Diagnostics [Multi-Platform].

4. Click the name of an existing client task or click New Task, then confirm the task type.

5. Configure these settings on each tab, then click Save.

• Task Name — Specifies a unique user-friendly name for the task.

• Description — Specifies some user-friendly description about the task.

• Diagnosis Time — Specifies the time period, in minutes, set for calculating the frequently scanned files. for example 1-10 minutes.

6. Click Assign, select one SVM or a group of SVMs where you want to assign the task, then click OK.

7. Click Schedule to schedule the task.

   At the end of specified minutes, the Trellix ePO - On-prem server completes the analysis and displays the results. The default allowed time limit is 10 minutes.

8. Select Menu → Reporting → Queries & Reports and select MOVE AntiVirus 4.10.x [Multi-Platform] under Trellix Groups to view and run these scan diagnostic queries:

   • MOVE AntiVirus: Top 10 Scanned File Extensions for each SVM — Lists the top 10 file extensions scanned by the SVM.

   • MOVE AntiVirus: Top 10 Scanned Files for each SVM — Lists the top 10 files scanned by the SVM.

   • MOVE AntiVirus: Top 10 Scanned Processes for each SVM — Lists the top 10 processes scanned by the SVM.

   • MOVE AntiVirus: Top 10 Scanned Virtual Machines for each SVM — Lists the top 10 virtual machines that are sending maximum scan and checksum requests.

Note

This data is rolled over every 7 days.

Identify frequently scanned items from command line (Multi-platform)

The scan diagnostic tool calculates and displays frequently scanned processes, files, extensions, and VMs. You can include these files in the path and process exclusion policies. These specified files are excluded from scans when they are written by a trusted process.

You must have administrator permissions to perform this task.

Access the SVM command line interface (CLI) on the SVM virtual machine to create and display this report.

This diagnostic tool captures these details:

• Top 10 file scan requests

• Top 10 file extensions

• Top 10 processes

• Top 10 virtual machines that are sending maximum scan and checksum requests.

1. Open the SVM CLI: click Start → Programs → McAfee → MOVE AV Server command prompt.

Note

This command prompt has administrator rights.

At this command prompt, you can type commands that activate the mvadm utility to perform administration tasks on the SVM.

2. To calculate the frequently scanned files, run this command:

move_diagnose /T: <Time Window> /O: < Output File>

At the end of specified minutes, the tool completes the analysis and displays the results. The default allowed time limit is 10 minutes.

3. (Optional) Change the time limit by configuring the registry settings in HKLM\System\CurrentControlSet\services\mvserver\Parameters\diagnostic\FrequentlyScanMaxTimeOutWindow.

Managing Trellix MOVE AntiVirus

Manage Trellix MOVE AntiVirus by responding to threat detections, managing quarantined items, and periodically analyzing your protection.

Keeping your protection up to date

Trellix MOVE AntiVirus depends on the engine and information in the content files to identify and act on threats. Every day, Trellix Advanced Research Center releases new content files to address new threats.

To update systems managed by Trellix ePO - On-prem, use the Main Repository. The Main Repository on the Trellix ePO - On-prem server maintains the latest versions of the engine and content files.

For Agentless SVM, AutoUpdate for DAT files is disabled. Use Trellix ePO - On-prem to create a client task and update to the latest versions of the engine and DAT files.

Responding to detections

When a threat occurs, the Trellix MOVE AntiVirus configuration determines the threat detection method and response.

If Trellix MOVE AntiVirus is configured to Delete files automatically and quarantine (the default setting), the scanner deletes items that are detected as threats and saves copies in a non-executable format to the Quarantine folder. If the file can't be deleted, the scanner denies access to the file.

Unwanted program detection

The on-access and on-demand scanners detect unwanted programs using policy settings that you configured and DAT files.

When a detection occurs, the scanner that detected the unwanted program applies the action that you configured for that scanner.

Review the information in the log file, then decide whether to take any of these additional actions:

• Fine-tune the settings for the scanner to make your scans more efficient.

• Exclude unwanted program and files from detection.        

  • If a legitimate program was detected (false positive), configure it as an exclusion.

On-access scan detections

When a threat is detected, the on-access scanner responds according to the settings in the On-Access Scan policy.

Review the information in the activity log to decide whether to take more actions:

• Fine-tune the settings for scan to make your scans more efficient.

  For example, exclude legitimate files and delete known threats from the quarantine.

• Configure the scanner to:

  • Delete files automatically and quarantine — Deletes and quarantines the item that contains the threat.

  • Delete files automatically — Deletes the item that contains the threat.

  • Deny access to files — Prevents the user from accessing files with detected threats.

• Configure the scanner to display a message to users when a threat is detected.

On-demand scan detections

When an on-demand detection occurs, the scanner response depends on the type of on-demand scan.

For targeted on-demand scans, the scanner uses Targeted On-Demand Scan client task settings. For policy-based on-demand scans, the scanner uses On-Demand Scan policy settings.

Review the information in the log file to decide whether to take more actions:

• Fine-tune the settings for the scan to make your scans more efficient.

  For example, exclude legitimate files and delete known threats from the quarantine.

• Configure the scanner to prompt for action.

• Configure the scanner to:

  • Delete files automatically and quarantine — Deletes and quarantines the item that contains the threat.

  • Delete files automatically — Deletes the item that contains the threat.

  • Notify only — Notifies when accessed an item that contains the threat.

Quarantined items

Trellix MOVE AntiVirus deletes items that are detected as threats and saves copies in a non-executable format to the Quarantine folder.

You can restore a quarantined item.

Configure the settings for quarantine

Configure Quarantine Manager settings in the Options policy, including the location of quarantined items and how long to keep them.

1. Log on to Trellix ePO - On-prem as an administrator.

2. Select Menu → Policy → Policy Catalog, then select MOVE AntiVirus 4.10.x from the Product list.

3. From the Category list, select Options.

4. Click the name of an editable policy.

5. Configure the Quarantine Manager settings, then click Save.

Restore quarantined items (Multi-platform)

Trellix MOVE AntiVirus deletes any items that are detected as threats, converts a copy of the item to a non-executable format, and saves it in the Quarantine folder.

You installed the Trellix MOVE AntiVirus extension on the Trellix ePO - On-prem server.

You can restore a quarantined item.

1. Log on to the Trellix ePO - On-prem server as an administrator.

2. Select Menu → Policy → Client Task Catalog.

3. From Client Task Types, select MOVE AntiVirus 4.10.x → Restore from Quarantine (Multi-Platform).

4. Click the name of an existing client task or click New Task, then confirm the task type.

5. Configure these settings on each tab, then click Save.

6.  Click Assign, specify the servers where you want to assign the task, then click OK.

7.  Click Schedule to schedule the task.

Note

You can also use the mvadm command on the client system to restore the quarantined items: mvadm q restore <Detection_Name>

Quarantined items (Agentless)

Trellix MOVE AntiVirus (Agentless) implements a remote quarantine system, where quarantined files are stored on an administrator-specified network share.

The quarantine network share is mounted on the SVM during policy enforcement at /mnt/quarantine using the Common Internet File System (CIFS) protocol. If mounting fails, the Quarantine Mount Failed event is generated and mounting is tried at the next policy enforcement.

A file is quarantined when:

• The Quarantine network share configuration, which is present in the Options policy, is mounted.

• A detection occurs.

• Delete files automatically and quarantine is the primary action. Quarantined files are automatically deleted after 28 days.

Note

If no quarantine policy is configured, the Delete files automatically and quarantine action does not occur even if it is configured as the primary action in the scan policies.

Set permissions for quarantined folder

Setting permission for the quarantine folder allows you to specify who has access to the share.

Create the following:

• Quarantine folder

• Domain User Account — The account used by the SVM to quarantine files.

• Domain Local Security Group — This group has access to the Restore Tool.

1. Right-click the quarantine folder, then select Properties.

2. Select the Sharing tab, then click Advanced Sharing

3. In the Advanced Sharing dialog box, select Share this folder.

4. Click Permissions, select the default user name Everyone, click Remove, then click Apply.

5. Click Add to select an object type.

Note

You can give permission only to administrators who need access to the quarantine folder.

6. In Select Users or Groups, enter your Domain User account in the object names dialog box, then click OK.

   1. Select the user name you created earlier, select Full Control, then click OK.

7. Click Add to select an object type.

   1. In Select Users or Groups, enter your Domain Local Security Group in the object names dialog box, then click OK.

   2. With this group selected, select Full Control, then click OK.

Tagging in an NSX-T environment (Agentless)

When malware is detected on a VM where you configured NSX tagging, the affected VM is tagged with the NSX tag (ANTI_VIRUS.VirusFound.threat=high).

• In the On Access Scan policy, if the primary action is configured to Delete files automatically or Delete files automatically

  and quarantine, and when malware is detected and deleted on a client system, the NSX tagging and untagging happens at the same time. The malware detection details can be viewed in Trellix ePO - On-prem Orion logs.

• In the On Access Scan policy, if the primary action is configured to Deny access to files and when malware is detected and deleted on a client system, the client system is tagged with ANTI_VIRUS.VirusFound.threat=high. The tag is removed on the next successful completion of an on-demand scan.

• In the On Access Scan policy, if the primary action is configured to Delete files automatically and quarantine and the quarantine details are not configured, and when malware is detected and deleted on the client system, the client system is tagged with the NSX tag ANTI_VIRUS.VirusFound.threat=high. The tag is removed on the next successful completion of an on-demand scan.

• When you run on-demand scan and malware is detected on a VM, the NSX tag is removed for the VM only if the primary action is configured to Delete files automatically or Delete files automatically and quarantine.

Self-protection (Multi-platform)

The self-protection feature defends files, services, and registry keys on virtual machines. Use the Trellix ENS access protection rules for protecting the components of the SVM.

Trellix MOVE AntiVirus Client

The self-protection feature prevents malicious attacks on Trellix MOVE AntiVirus (Multi-platform) client components. This keeps your virus protection active and stable.

The IntegrityEnabled configuration parameter controls the self-protection feature. By default, the parameter is set to 0x7, and all components of the feature are enabled.

The configuration parameter accepts values from 0–7, which is a decimal representation of a 3-bit binary value.

For example, to enable file and registry protection, set the parameter to 3 (0b011) with this command:

mvadm config set IntegrityEnabled=3

To enable file and service stop protection, but not registry protection, set the parameter to 5 (0b101) with this command:

mvadm config set IntegrityEnabled=5

To disable the self-protection feature, set the parameter to 0 with this command:

mvadm config set IntegrityEnabled=0

mvadm config set IntegrityEnabled=0

When Service stop protection is enabled (by setting the highest bit to 1), the mvagtsvc service does not accept stop commands. File protection and registry protection require the agent driver be loaded, but service stop protection does not.

Trellix MOVE AntiVirus SVM

If you want to protect the components of the SVM, then you can use the Access Protection rules in Trellix ENS. Check the list of components below:

• mvserver.exe

• C:\Program Files (x86)\McAfee\MOVE AV Server\**

• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mvserver

• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mvserver\Parameters

• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mvserver\Parameters\ODS

Events, responses, and Trellix MOVE AntiVirus

Configure Automatic Responses to respond to threat events.

The Threat Event Log is a log file of all threat events that Trellix ePO - On-prem receives from managed systems.

In Trellix ePO - On-prem, you can define which events are forwarded to the Trellix ePO - On-prem server. To display the complete list of events in Trellix ePO - On-prem, select Menu → Configuration → Server Setting, select Event Filtering, then click Edit.

Set up a Purge Threat Event Log server task to purge the Threat Event Log periodically.

For information about Automatic Responses and working with the Threat Event Log, see the Trellix ePO - On-prem documentation.

Analyzing your protection

The ongoing process of analyzing your system protection enables you to improve the protection and performance of your system.

Analyzing your protection helps you determine:

• Which threats you are facing

• What malware was used in the attack

• Where the threats are coming from

• Where and when the attacks occurred

• How often threats are found

• Which systems are being targeted

• How the attack affected the system

Protection analysis is also helps you:

• Create reports for IT and managers.

• Capture information used to create scripts and queries.

Dashboards and queries

Use Trellix ePO - On-prem queries to view events, run default queries, and create reports.

• View events in the Threat Event Log.

• Run default queries that show important client information.

• Create reports using data sent by the Trellix Agent to the Trellix ePO - On-prem database.

For information about how to run a query or report, see the product documentation for your version of Trellix ePO - On-prem.

Queries are questions that you ask Trellix ePO - On-prem, which returns answers as charts and tables. You can export or download queries, combine them into reports, and use most queries as dashboard monitors.

Reports enable you to package one or more queries into a single PDF document, for access outside of Trellix ePO - On-prem.

To create reports, your assigned permission set must include the ability to create and edit reports. You can restrict access to reports using groups and permission sets exactly as you restrict access to queries. Reports and queries can use the same groups, and because reports primarily consist of queries, this allows for consistent access control.

VMs running Agentless do not have the Trellix Agent installed. Only the SVM appears in the Trellix ePO - On-prem console, which means you don't see each VM. vShield Manager provides a report that validates the protection status of each VM.

Integrating TIE and Intelligent Sandbox

TIE provides context-aware adaptive security for your virtual environment. It quickly analyzes files and content from the SVM in your environment and makes informed security decisions.

These decisions are based on a file's security reputation and your own criteria set in the Shared Cloud Solutions policy of Trellix MOVE AntiVirus.

The Multi-platform deployment, with TIE and Intelligent Sandbox integration, becomes a multi-layered solution that involves various techniques to scan and detect the malware. It includes:

• Pattern matching

• Global reputation

• Program emulation

• Static analysis

• Dynamic analysis

All these layers are seamlessly integrated and provide a single point of control for easy configuration and management.

Threat Intelligence Exchange

Threat Intelligence Exchange uses the Trellix Data Exchange Layer framework to share file and threat information instantly across the entire network.

In the past, you sent an unknown file or certificate to Trellix for analysis, then updated the file information throughout your network later. Threat Intelligence Exchange enables file reputation to be controlled at a local level, your virtual environment. You decide which files can run and which are blocked, and the Trellix DXL shares the information immediately throughout your environment.

Threat Intelligence Exchange components

Threat Intelligence Exchange includes these components.

• A server that stores information about file and certificate reputations, then passes that information to other systems.

• Trellix DXL brokers that allow bidirectional communication between managed systems on a network.

• These components are installed as Trellix ePO - On-prem extensions and add several new features and reports:

• TIE server extension

• Trellix DXL broker management

• Trellix DXL client for Trellix ePO - On-prem

• Trellix DXL client management

Intelligent Sandbox

If Intelligent Sandbox is present, the following process occurs.

1. When a file is sent for TIE reputation and TIE determines that it is an Intelligent Sandbox candidate. Then the file is submitted to Intelligent Sandbox for further analysis through TIE from SVM based on the settings in Shared Cloud Solutions policy under Trellix MOVE AntiVirus.

2. Intelligent Sandbox analyses file and sends file reputation results to the TIE server using the Trellix DXL. The TIE server also updates the database and sends the updated reputation information to the SVM.

The Intelligent Sandbox solution primarily consists of the Intelligent Sandbox Appliance and the pre-installed software. The Intelligent Sandbox Appliance is available in two models. The standard model is the ATD-3000. The high-end model is the ATD-6000.

For installing and setting up Intelligent Sandbox, see the installation guide for your version of Intelligent Sandbox.

Intelligent Sandbox components

Intelligent Sandbox integrates its native capabilities with Trellix MOVE AntiVirus to provide a multilayered defense mechanism against malware.

These features and components of Intelligent Sandbox integrate with Trellix MOVE AntiVirus for better malware detection:

• A local block list to quickly detect known malware.

• Trellix GTI for cloud lookups to detect malware that has already been identified by organizations throughout the globe.

• Embedded McAfee Gateway Anti-Malware Engine in for emulation capability.

• Embedded McAfee Anti-Malware Engine embedded in for signature-based detection.

• A virtual sandbox environment for dynamic file analysis.

Scenarios for using Threat Intelligence Exchange

• Immediately block a file — Threat Intelligence Exchange alerts the network administrator of an unknown file in the environment. Instead of sending the file information to Trellix for analysis, Trellix MOVE AntiVirus blocks the file immediately. The administrator can then use Threat Intelligence Exchange to learn whether the file is a threat and how many systems ran the file.

• Allow a custom file to run — A company routinely uses a file whose default reputation is suspicious or malicious, for example a custom file created for the company. This file can override the reputation of a file on TIE server so that it is allowed to run in the environment.

• Import known reputations — A company has several files that are trusted and used regularly, and other files that are not allowed. Because the reputations are already known and set, the administrator can import a list of files and their reputations directly into the Threat Intelligence Exchange database. Those reputations are used immediately with no further action needed.

• See additional information about a file — Threat Intelligence Exchange notifies the network administrator of an unknown file. The administrator can see several details about the file, such as the file's parent process, company, hash information, and the systems that ran the file. The administrator can also see more detailed information about the file with VirusTotal, a free online service for scanning viruses, malware, and URLs.

Determine a file or certificate's reputation

File and certificate reputation is determined when a file tries to run on a managed system.

These steps occur in determining a file or certificate's reputation.

1. A user or system tries to run a file.

2. Trellix MOVE AntiVirus compares and inspects the file with local cache and can't determine its validity and reputation.

3. The client looks for the reputation in global cache in the SVM and can't find the reputation, then sends the file hashes to the SVM for TIE lookup based on the Shared Cloud Solutions policy assigned to the system.

4. The SVM checks the reputation cache for the file hash. If the file hash is found, the SVM gets the reputation data from the SVM cache and sends the reputation to the client and action is taken.

5. If the file hash is not found in the SVM cache and TIE server does not have the reputation:

   • (Intelligent Sandbox is present) If the policy on the endpoint determines that the file has to be sent to Intelligent Sandbox, the TIE server sends the file for further analysis. To send the file to Intelligent Sandbox, these requirements must meet:

     • Advanced Threat Defense (ATD) option is configured in the Shared Cloud Solutions policy on the Trellix ePO - On‑prem server.

     • Size of the file is less than 10 MB.

   • The TIE server returns the file hash's reputation to the SVM once the data is received from Intelligent Sandbox after analyzing the file.

6. Trellix MOVE AntiVirus responds based on the Shared Cloud Solutions policy assigned to the system that is running the file.

7. The SVM sends threat details as threat events to Trellix ePO - On‑prem.

Determine a reputation with TIE 2.0.0

When the SVM sends a signed file for certificate lookup and this certificate has a file that has administrator overridden file reputation, the file hash is sent for file reputation lookup again. Then the overridden file reputation is considered for the file, ignoring certificate reputation value.

For example, let us consider a scenario where:

• The file has a certificate value as Known trusted

• The file reputation of any files associated with the same certificate is overridden by the administrator to Known malicious

With these assumptions, when an SVM sends a file for TIE lookup, TIE notifies that it has a file reputation overridden for the certificate. Then the SVM sends for file reputation again and responds based on the file reputation.

Monitoring activity in your environment

An important step in a protection strategy is using tools to monitor the malware events that occur on your systems.

Monitoring activity with Trellix ePO - On-prem

Use Trellix ePO - On-prem to monitor activity on your managed systems and determine what to do when issues occur.

Dashboards are collections of monitors that track activity in your Trellix ePO - On-prem environment.

Trellix MOVE AntiVirus provides predefined dashboards and monitors. Depending on your permissions, you can use them as is, modify them to add or remove monitors, or create custom dashboards.

Trellix MOVE AntiVirus dashboard

The Trellix MOVE AntiVirus dashboard is added to your Trellix ePO - On-prem server when you install the software.

The dashboard displays a collection of monitors based on the results of the default Trellix MOVE AntiVirus software queries.

The default monitors that appear on the Trellix MOVE AntiVirus dashboard are:

• SVM Load: Number of Connected Endpoints — Displays the number of managed endpoints with load category of the SVM.        

  • Capacity Full — Indicates that the SVM limit is reached when the number of endpoints is equal to what can be assigned.

  • Capacity Above Threshold — Appears when capacity of an SVM is more than its threshold value.

  • Capacity Below Threshold — Appears when capacity of an SVM is less than its threshold value.

• SVM with Higher Average Scan Time in last 7 days — Specifies the top 10 SVMs, which have reached average scan time threshold and they are in this state for the longest time in the past 7 days.

See the chapter on dashboards in the Trellix ePO - On-prem Product Guide for information about managing dashboards.

Check visibility and health details of the SVM

You can view and check the product properties of Trellix MOVE AntiVirus and the product component SVM using Trellix ePO - On-prem.

1. Log on to Trellix ePO - On-prem as an administrator.

2. Select Menu → Systems → System Tree → Systems tab.

3. Click an SVM system to open the System Information page.

4. Click Product tab and select the product as MOVE AntiVirus.

You can now see the product properties, which can be used to determine the health details of the SVM.

Check predefined queries

Run the predefined queries to generate reports based on Trellix MOVE AntiVirus components.

1. Log on to Trellix ePO - On-prem as an administrator.

2. Select Menu → Reporting → Queries & Reports.

3. From the McAfee Groups pane, select MOVE AntiVirus 4.10.x to display the queries for the selected group.

4. From the Queries list, select a query, then click Run.

5. On the query results page, click any item in the results to drill down further.

6. Click Close when finished.

Predefined Multi-platform queries

The Trellix MOVE AntiVirus (Multi-platform) deployment option adds several queries to your Trellix ePO - On-prem environment.

Multi-platform queries

Client queries and events

ODS Client queries and events

SVM queries and events

SVM Manager queries and events

You can add these queries to dashboards to more efficiently track your environment by displaying several queries at once.

The queries are constantly refreshed, or you can run them at a specified frequency. You can add them to reports that are run on specific schedules and export them as PDF files or email messages.

Note

The Trellix ePO - On-prem Threat Event Log contains information about detections, scan failure, and on-demand scan events.

SVM Manager information

A shell script, msmclient.sh, is available with SVM Manager and is used to retrieve the SVM details. The script is available at /opt/ McAfee/movesvamanger.

For these commands to work and retrieve the results, the SVM Manager application must be running.

Run these commands with root rights from the /opt/McAfee/movesvamanager directory:

• sudo ./msmclient.sh osscount — Displays the number of SVMs attached to the SVM Manager.

• sudo ./msmclient.sh ossinfo — Displays some basic information about the SVMs attached to the SVM Manager.

• sudo ./msmclient.sh ossdetails — Displays some advanced information about the SVM: current SVM load, SVM GUID, and last heartbeat time.

Predefined Agentless queries

You can use predefined queries as is, or create queries from events and properties stored in the Trellix ePO - On-prem database.

To create custom queries, your assigned permission set must include the ability to create and edit private queries.

The Agentless deployment option provides these predefined queries:

MOVE AntiVirus - generate certificates (Multi-platform)

If there is a connectivity issue with the SVM Manager, you must generate the certificates for Trellix MOVE AntiVirus, so that the Trellix MOVE AntiVirusSVM and SVM Manager communicate and authenticate each other properly. For details, see the Trellix MOVE AntiVirus 4.10.x Installation Guide

MOVE AntiVirus - compute licensing information (Agentless)

From Menu → Automation → Server Tasks, you can run MOVE AntiVirus: Compute licensing information server task to list the number of VMs being managed by the licensed SVM. You can find the output of this server task from MOVE AntiVirus: Licensing information Queries & Reports.

Troubleshooting

Use this information to resolve problems while running Trellix MOVE AntiVirus and using its deployment modes.

Best practices for using Trellix MOVE AntiVirus

Here are some best practices for deploying and managing the Trellix MOVE AntiVirus product.

Best practices for Multi-platform

Here are some best practices for deploying and managing the Trellix MOVE AntiVirus product (Multi-platform).

Best practices for creating multiple client systems using primary image

To create multiple client systems in your environment, create a primary image of a VM where client is installed on it and reconfigured the settings, as needed. So that you do not need to repeat these actions on every client system that you create.

1. Deploy the Trellix MOVE AntiVirus client to the managed VM, which you want to make a primary image.

2. In Trellix ePO - On-prem, add required exclusions for both on-access scan and on-demand scan policies and apply them to the primary image.

   • Path exclusions

   • Process exclusions

   • Publisher exclusions

3. Run the on-demand scan or Targeted on-demand scan on the primary image to build up the cache.

   Building up the cache on the primary image improves the performance of the VM when you clone the virtual machines.

4. In the primary image, under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mvagtdrv\Parameters, delete the registry key for ODSUniqueId and ServerAddress1.

5. In the primary image, under HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\Agent\FirewallRules\Identifier, delete the agent registry key GUID.

6. Shut down the primary image and clone the virtual machines from the primary image.

   When cloned virtual machines are turned on, new agent GUID values are automatically generated. The virtual machines are now managed by the Trellix ePO - On-prem server.

Note

• It is recommended to update AMCore Content Package (V3 DAT) on daily basis during non peak hours.

• It is recommended to keep SVM on the same host where most of the clients are located, it improves the performance of the SVM.

Best practices for Agentless

Here are some best practices for deploying and managing the Trellix MOVE AntiVirus product (Agentless).

Best practices for VDI environment

While provisioning many VMs, the VDI might stop responding due to lack of client cache. The flushing of client cache while loading and unloading the filter driver is a VMware limitation.

When there is a significant workload running on the client systems, you might notice issues like the VM getting hung during its boot, latency during file scanning, and many. To prevent such issues, it is recommended to upgrade the SVM configuration with this configuration:

Error codes

Here are steps to troubleshoot some of the errors that you might see while deploying and managing the Trellix MOVE AntiVirus product. You might see these errors on the Trellix ePO - On-prem pages or in the log files.

Product area - Trellix MOVE AntiVirus extension

You might see these errors on the Trellix ePO - On-prem pages or in the log files while deploying and managing the Trellix MOVE AntiVirus product using Trellix MOVE AntiVirus extension.

MOVE_ERROR_30001

MOVE_ERROR_30002

Workaround: This error can be ignored because it does not impact while         deploying and managing the Trellix MOVE AntiVirus product.

MOVE_ERROR_30003

MOVE_ERROR_30004

MOVE_ERROR_30005

MOVE_ERROR_30007

MOVE_ERROR_30008

MOVE_ERROR_30009

MOVE_ERROR_30010

MOVE_ERROR_30011

MOVE_ERROR_30012

MOVE_ERROR_30013

Product area - Trellix MOVE AntiVirus client (Multi-platform)

You might see these errors on the Queries & Reports (MOVE AntiVirus: Error Code Details or MOVE AntiVirus: Multi-Platform Connectivity Status) in Trellix ePO - On-prem or in the log files.

Error code: 12002

Error code: 12002

Error code: 12029

Error code: 12029

Error code: 4001

Product area - Trellix MOVE AntiVirus SVM (Multi-platform)

You might see these errors on the Queries & Reports (MOVE AntiVirus: Error Code Details or MOVE AntiVirus: Multi-Platform Connectivity Status) in Trellix ePO - On-prem or in the log files.

Error code: 15

Error code: 16

Error code: 201

Error code: 202

Error code: 11

Error code: 1

Error code: 2

Error code: 3

Error code: 4

Error code: 12002

Error code: 12002

Error code: 12002

Error code: 12029

Error code: 12029

Product area - Trellix MOVE AntiVirus SVM (Agentless)

You might see these errors on the Trellix MOVE AntiVirus SVM log files while deploying and managing the Trellix MOVE AntiVirus SVM (Agentless).

MOVE_ERROR_20001

MOVE_ERROR_20002

MOVE_ERROR_20004

MOVE_ERROR_20005

MOVE_ERROR_20006

Frequently asked questions

Here are answers to some of the most frequently asked questions relating to the security implications of running Trellix MOVE AntiVirus and using its deployment modes.

How can I convert the SVM Manager format to Microsoft Hyper-V format?

Convert the .vmdk file format to .vhd file to deploy the SVM Manager to Microsoft Hyper-V. Attach the converted file as a hard disk to create a new virtual machine.

1. Download and install Microsoft Virtual Machine Converter 3.0 (MVMC 3.0).

Note

The SVM Manager can only be converted using the Microsoft Virtual Machine Converter 3.0 command-line Windows PowerShell scripts.

2. Click Start → All Programs → Accessories, right-click Windows PowerShell, then click Run as administrator.

3. In the PowerShell console, run this command: Import-Module "C:\Program Files\Microsoft Virtual Machine Converter\MvmcCmdlet.psd1"

4. For .vhdx format image, run this command:

   ConvertTo-VirtualHardDisk -SourceLiteralPath "C:\VMDKs\SVM_Manager_3.x-disk1.vmdk"

5. For .vhd format image, run this command:

   ConvertTo-VirtualHardDisk -SourceLiteralPath "C:\VMDKs\SVM_Manager_3.x-disk1.vmdk" -DestinationLiteralPath "C:\VHDs" -VhdType FixedHardDisk -VhdFormat Vhd

6. After you convert the file format to .vhd or .vhdx, mount the disk image to the Microsoft Server 2012 R2 Hyper-V system:

   1. On the Server 2012 R2 Hyper-V Manager, click New → Virtual Machine, then click Next.

      Specify these VM details in the wizard, then click Next.

      Option	Definition
      VM Name	Specify the VM name of the instance.
      Memory Size	Set the memory size of the VM.
      Network Interface	Specify the details about the network interface associated to the instance.

   2. Select Use an existing virtual hard disk, specify the path to the .vhdx or .vhd file, then click Next.

   3. Click Finish, then turn on the SVM manager.

How do I enable core dumps for SVM Manager on it's appliance?

Run the command ulimit -c unlimited on the terminal.

The Trellix MOVE AntiVirus detection pop-up message does not appear on the Windows desktop. How do I fix this?

Method 1:

Enable the Trellix Agent policy option, Show the Trellix system tray icon (Windows only), to display Trellix MOVE AntiVirus detection pop-up message on the Windows desktop.

1. Log on to Trellix ePO - On-prem as an administrator.

2. Select Menu → Policy → Policy Catalog.

3. From the Product drop-down list, select McAfee Agent.

4. From the Category drop-down list, select General.

5. Click New Policy.

6. On the New Policy page, configure the policy settings, then click OK.

7. Open the newly created policy.

8. Enable Show the McAfee system tray icon (Windows only) from General Options on the General tab.

9. Click Save, then apply the policy to the clients.

Method 2 (Multi-platform only):

If you need the Multi-platform Threat Event pop-up alerts through the Remote Desktop Protocol (RDP) session, run UPDATERUI.EXE manually.

Perform these steps inside your remote session.

1. Click Start → Run.

2. Run this command: "C:\Program Files\McAfee\Common Framework\CmdAgent.exe" /s

Note

The Trellix Agent icon now appears in the toolbar, and the on-access scan Statistics can be viewed in the remote session.

How can I create an on-demand scan task for a vSphere VM with Agentless?

1. Have the required Trellix MOVE AntiVirus extensions in Trellix ePO - On-prem and create a Registered Cloud Account for vSphere.

2. Click System Tree. You see the vSphere group that was previously added and all client computers under that vSphere group entry.

3. Select an unmanaged computer where you want to trigger the on-demand scan:

   1. Click Actions → Agent → Modify Policies on a Single System.

   2. From the Product drop-down list, select MOVE AntiVirus 4.10.x.

   3. From the Category drop-down list, select On Demand Scan.

   4. Click New Policy.

   5. On the New Policy page, configure the policy settings, then click OK.

   6. Open the newly created policy, select Enable on-demand scan, then click Save.

4. Select the SVM that is managing that client VM and issue wake-up agent call.

   The on-demand scan starts at the next available slot.

The Policy Collector task collects the unmanaged system policies and adds them to the SVM policy for the next policy enforcement.

What can I do if I see the warning message "Failed to get process info of (system)", which is recorded in the Multi-platform client mvagent.log?

This is expected behavior. This informational message can be ignored.

In some environments, you might see these warning messages in the mvagent.log, which is the scan log generated by the Trellix MOVE AntiVirus (Multi-platform) client on protected systems:

• WARNING: utl_rt.c: 109: Process info is NULL for proc handle 0x4

• WARNING: fsh_winnt.c: 216: Failed to get for process info of (System)

Note

The message does not upload as an event to Trellix ePO - On-prem.

How can I manually check the DAT version installed on the Trellix MOVE AntiVirus SVM in an Agentless environment?

Check which DAT version is installed on the Trellix MOVE AntiVirus SVM using the Linux command line interface (CLI).

Method 1:

1. Log on to the Trellix MOVE AntiVirus SVM.

2. At the command prompt, run this command: sudo

3. When prompted, provide valid credentials.

4. Run this command to display the SVM details: /opt/McAfee/ens/tp/bin/mfetpcli --v

For example:

Trellix Endpoint Security (ENS) for LinuxThreat Prevention

Version: 10.7.7.24

License: Full

DAT Version: 4860.0

DAT Date : 24-01-2022

Engine Version: 6300.9389

Exploit Prevention Content Version: 10.7.0.00079

Method 2:

1. Log on to the Trellix MOVE AntiVirus SVM.

2. At the command prompt, run this command: sudo /opt/McAfee/move/bin/sva-config -v

3. When prompted, provide valid credentials.

Note

The required details appear in the command window.

How can I fix any filesystem error that appears after deploying Agentless?

1. Download a new copy of the Agentless OVF template from the product download site.

2. Deploy the Agentless OVF template. For details, see Agentless installation and configuration in the Trellix MOVE AntiVirus 4.10.x Installation Guide.

What do I do if Agentless SVM shows as unmanaged when registering with the Trellix ePO - On-prem server?

Make sure that the copy of the Agentless OVF package is from a known good source, preferably the Trellix download site, then do a fresh deployment.

Perform these steps only if the SVM shows as Unmanaged in the Trellix ePO - On-prem System Tree.

1. Delete the system from Trellix ePO - On-prem.

   When prompted, do not choose to remove the Trellix Agent.

2. For the existing SVM, from the local command line interface, run the registration script with this command: sudo /opt/McAfee/move/bin/sva-config

3. When prompted, click Yes to unregister with the vShield Manager.

4. Complete the procedure to unregister the product.

5. Turn off the SVM and delete it from the disk.

6. Continue with the new deployment.

Agentless configuration fails and displays failed status on the Trellix ePO - On-prem for the vCenter account. How do I fix this?

There are two causes for the status to show Configuration Failed:

• If the vShield Manager is not registered with vCenter under Registered Cloud Accounts, then the vCenter appears as Not Configured on the Trellix ePO - On-prem console under Trellix MOVE AntiVirus (Agentless).

• If the vShield Manager was first successfully registered with vCenter, but later removed from the Registered Cloud Accounts, it might not synchronize the vCenter account successfully, resulting in Not Configured being displayed on the Trellix ePO - On-prem console under Trellix MOVE AntiVirus (Agentless).

Register or re-register the vCenter account under Registered Cloud Accounts.

1. Log on to Trellix ePO - On-prem as an administrator.

2. Select Menu → configuration → Registered Cloud Accounts to open the Registered Cloud Account page.

3. Select the vCenter Account and click Delete.

4. Restart the ePolicy Orchestrator - On-premises Event Parser Service.

5. Select Menu → Registered Cloud Accounts, and confirm that the specific vCenter account is now deleted.

6. On the Registered Cloud Account page, click Actions, then select Add Cloud Account.

7. Type the vCenter Account Details on the Registered Cloud Accounts page, then click Test Connection.

8. If Test Connection is successful, click Next, then accept the certificate.

9. Click Finish, then click OK.

10. Check the configuration status of the vCenter Account, and now it shows as Configured.

The Trellix ePO - On-prem server now creates a task that synchronizes the vCenter according to the above configuration.

How do I keep disabled Windows Defender on Windows 10 system after installing Multi-platform?

1. Open the command prompt as an administrator.

2. Run these commands one after the other:

   • mvadm config set IntegrityEnabled=0

   • sc stop mvgatsvc

   • sc start mvgatsvc

   • mvadm config set IntegrityEnabled=7

3. Close the command prompt window.

How do I avoid loss of network connectivity on virtual machines that use VMXNet3 NICs when deploying Agentless through Trellix ePO - On-prem?

Method 1:

Make sure that the version of VMware Tools installed on the virtual machine is the exact same build as the VMware Tools version supplied by the host. When the script is invoked and the builds match, only the needed Guest Introspection (vShield components) are installed.

Method 2:

Make sure that the virtual machines also have their e1000 NICs installed, to maintain network functionality when the script is invoked remotely.

How do I delete the IP pool when an IP address is already in use?

Run this SQL query to remove the IP Pool details from the Trellix ePO - On-prem database:

DELETE FROM [DC_AL_CONFIG_IPPOOL] WHERE IPPOOL_NAME='<POOL_NAME>'

What do I do when the error "Critical error. Downloading Trellix ePO - On-prem init files failed" appears when deploying SVM through Trellix ePO - On-prem using an IP Pool?

When you deploy the SVM through Trellix ePO - On-prem using an IP Pool on the VMware ESX host, you might see these errors in the SVM console session:

• ERROR [MOVEAL:pool-1-thread-1] svm.SvmEpoRegistrationTaskImpl - Trellix ePO - On-prem Registration failed for SVM with VM name and for the Hypervisor: HyperVisor_Name

• ERROR [MOVEAL:pool-1-thread-1] svm.SvmEpoRegistrationTaskImpl - Reason being: Critical error. Downloading Trellix ePO - On-prem init files failed.

When you see these errors, make sure that the prefix length is correct for the IP Pool according to the characteristics of the destination network.

What is the error return code description for Trellix MOVE AntiVirus (Agentless) SVM registration with the vShield Manager?

When Trellix MOVE AntiVirus (Agentless) SVM registration fails, vShield Manager provides a Return Code error.

I am using Trellix MOVE AntiVirus (Agentless) in an NSX-T environment. Where do I find the original name of the host name where the infection occurred instead of IP of Trellix MOVE AntiVirus SVM?

The Threat Event Log displays the host name of the system where the infection occurred.

Note

Make sure that you configured SVM Configuration details and tested connection settings in the SVM Settings policy on the Trellix ePO - On-prem server.

1. Log on to Trellix ePO - On-prem as an administrator.

2. Select Menu → Reporting → Threat Event Log.

I am using Trellix MOVE AntiVirus (Agentless) in an NSX-T environment. For some reason, Trellix MOVE AntiVirus SVM is doing nothing. How do I redeploy the Trellix MOVE AntiVirus SVM?

1. Navigate to the NSX-T console.

2. Navigate to System → Service deployment.

3. Select the service deployment and delete it.
   
   After successful deletion, deploy the service again.

What do I do when error "Internal error on the server" appears when trying to delete a Registered Cloud Account?

This error occurs if you select Delete Tags, and one or more systems that do not belong to that cloud account erroneously have the same tag assigned.

Method 1:

1. From the Delete Account dialog box, deselect Delete Tags, and then click OK to delete the registered cloud account.

Method 2:

1. Identify one or more systems that do not belong to the registered cloud account but have the same tag assigned.

2. Remove the tag from the systems you identified.

3. Delete the registered cloud account.

I exported SVM Settings policy from one Trellix ePO - On-prem (source) to another Trellix ePO - On-prem (destination). The imported policy still has old Trellix ePO - On-prem (source) credentials. How do I fix this?

To update Trellix ePO - On-prem password in the imported SVM Settings policy, you must again configure the Trellix ePO - On-prem details about the Trellix ePO - On-prem server.

1. Log on to Trellix ePO - On-prem (destination) as an administrator.

2. Select Menu → Automation → MOVE AntiVirus Deployment.

3. On the Configuration tab, click General and enter and confirm the password of the Trellix ePO - On-prem.