Malware protection indicators are used by the Endpoint Security (HX) xAgent malware protection engine during malware detection scans. Malware definitions, which include malware protection indicators, are transferred through the channel you select.
The Malware Definition Source drop-down allows you to select which channel you want to use to download the latest malware definitions, which include malware protection indicators, to the agents on your host endpoints.
Note
Trellix Endpoint Security (HX) xAgent version 26 supports the Malware Definition Source setting on Windows endpoints only. Windows endpoints running earlier versions of Trellix Endpoint Security (HX) xAgent software will silently ignore this setting.
The table below lists the available channels. The Internet is the default channel.
Indicator Source | Description |
|---|---|
Internet (default) | Malware protection indicator updates are downloaded directly from the Internet. Trellix recommends using this setting in cloud environments to prevent performance issues on the Endpoint Security (HX) Server. |
HX Preferred | Malware protection indicator updates are downloaded from the Endpoint Security (HX) server. If the Endpoint Security (HX) server is unavailable, malware protection indicator updates are downloaded from the Internet. |
HX Only | Malware protection indicator updates are downloaded from the Endpoint Security (HX) server only. |
Custom Source | Malware protection indicator updates are downloaded from a configured content server (a custom source). If the custom source is unavailable, malware protection indicator updates are downloaded from the Endpoint Security (HX) server instead. If the Endpoint Security (HX) server is unavailable, then the malware protection indicator updates are downloaded via the Internet. For instructions on configuring a custom source, see Custom Source Location. |
ImportantCustom Source is available only to xAgent versions 33 and higher. NoteWhen you first enable malware protection, the latest malware definitions are downloaded to your agents. By default, this initial download can take up to four hours to complete. Malware protection will not start until these definitions have been downloaded. To verify that the data has downloaded successfully, review the Host Details tab in the Endpoint Security (HX) Web UI for a Windows host. Verify the values in the Content Version and Last Updated fields under Malware Protection on the tab. For more information, see the Endpoint Security (HX) Server User Guide. | |
This section describes how to configure the download channel for malware protection indicators for all of your host endpoints and for selected host sets in your environment using the Web UI. See the Endpoint Security (HX) REST API Guide for information on using the API to define the download channel for malware protection indicators.
Configuring the download channel for all endpoints
To configure the download channel for malware protection indicators for all host endpoints:
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link to access the Edit Policy page.
Select the Malware Protection tab.
In the Malware Definition Updates section, click the Malware Definition Source drop-down and select which connection channel the xAgent should use to receive the latest malware protection indicators. Valid options include Internet (default), HX only, HX Preferred, and Custom Source.
.png)
Important
Before using the Custom Source option, you must configure a valid custom content server. See Custom Source Location for specific instructions on how to do this.
Click Save.
Configuring the download channel for selected host sets
To configure the download channel for selected host sets:
Note
See for more information about using the Web UI to create a custom policy.
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Select the Malware Protection tab.
In the Malware Definition Updates section, click the Malware Definition Source drop-down and select which connection channel the xAgent should use to receive the latest malware protection indicators. Valid options include Internet (default), HX only, HX Preferred, and Custom Source.
Click Save.
Note
After you save, click Reset to defaults to revert the Malware Definition Source and the Update Malware Definition Rules settings to the default settings.
Now you can assign host sets to the custom policy and set the policy priority level. See Assigning host sets to xAgent policies and Configuring policy priority using the web UI for more information.
Custom source location
By default, malware definitions are downloaded from the Internet. In xAgent 35.31.0 and higher, you can configure a custom download channel for deploying malware definition updates to your host endpoints (a custom source). The custom source can also be communicated with via proxy server. For general instructions on how to configure a proxy server, see HTTPS Proxy Server Overview and Configuration.
The instructions on this page demonstrate how to set up a custom content server using Ubuntu 19.04, and how to enable it in the Endpoint Security (HX) server WebUI.
Important
Custom content server setup instructions may vary, depending on your particular environment. You are responsible for setting up your own custom content server. Trellix cannot provide instructions or customer support for setting up a custom content server.
Note
The following example steps were executed on an Ubuntu 19.04 server OS.
Step 1 - Set Up the Content Web Server
Important
The following steps require root level privileges.
Note
Remove any default HTML pages. The web server must contain only content.
Note
A proxy environment for the content web server requires a forward proxy server. A reverse proxy server will not work (at all), or may cause problems over proxy.
To set up the content web server:
Install Apache 2 on an Ubuntu machine:
sudo apt-get update
sudo apt-get install apache2
Create a web server configuration file (such as
mycustomsite.com.conf) in/etc/apache2/sites-available.Create a top level web server folder (such as
/var/www/mycustomsite.com/). Set server permissions to 705.Add a server-specific directory configuration under
/etc/apache2/apache2.conf, and grant required permissions.Make sure the Indexes and MultiViews are forbidden for all the directories in the configuration file to prevent access via browser.
Add the web server domain entry to your DNS records, so it can be accessed by all host endpoints.
Enable the
mycustomsite.com.confconfiguration file and make sure no error occurs.
Note
Trellix recommends using a static IP address for the custom server.
Note
To check if the content update is ocurring via proxy or directly over the web server, use UpdateSampleC.exe in the Updater SDK. Follow the subsequent help instructions to verify that the content is downloading.
Step 2 - Set Up the Bitdefender Mirroring Application
Important
The following steps should be completed while using root level privileges.
Important
Bitdefender must already be installed on your endpoints before this setup procedure.
To set up the Bitdefender mirroring application:
Install PHP.
Create the
/usr/local/bitdefender/directory, and copy themirror.cnfconfiguration file from the providedtemplate.zipfile to that directory.Update the
mirror.cnffile in/usr/local/bitdefender/mirroring/phpwith required configurations.Set
WWW_VERSIONDIRto the top level within the web server folder.Specify the number of versions to store in
VERSIONHISTORY.MIRRORPATCHESshould be set to 1 to allow mirroring of update patches.
Run the
update.phpscript withmirror.cnfas an argument:php update.php mirror.cnfWWW_DIRis the folder path to download 32-bit Bitdefender content, and it must point to the top level within the web server folder. The directory name must be "av32bit" for this feature.WWW_DIR64is the folder path to download 64-bit Bitdefender content, and it must point to the top level within the web server folder. The directory name must be "av64bit" for this feature.
Add a
cronjob to execute theupdate.phpscript every 20 minutes, so that the web server content is up-to-date. Since the update script requires theproviders.conffile to be present in the same directory, Trellix recommends running thecronjob using a script. A template of thecronjob is in the providedtemplate.zipfile.Note
Bitdefender downloads only the delta content in every update.
Important
If content download from the Bitdefender main server occurs over a proxy, then proxy authentication is required.
Important
Enable any other options required by your environment.
Step 3 - Test the Bitdefender Mirror Server
Test the custom server configuration to verify that the content is successfully downloaded from the web server that you set up in Step 1 - Set up Content Web Server. This test also ensures that correct folder permissions are set on the web server directory, so that the Agent software can fetch the web server content.
To test the Bitdefender mirror server:
Switch to a non-owner user of the mirroring folder.
Run the command:
php /path/to/update.php -u <update url/IP of custom server> -d <test directory>
Important
This test directory must be a valid directory for the command to execute successfully.
Sample test output:
.png)
Note
After this test, if the data from testing the mirror server is no longer needed, Trellix recommends deleting the test folder, to preserve server storage.
Configuring the Custom Download Channel
To configure the custom download channel for malware protection indicators for all host endpoints:
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link to access the Edit Policy page.
Select the Malware Protection tab.
In the Malware Definition Updates section, click the Malware Definition Source drop-down and select Custom Source.
.png)
Important
Before using the Custom Source option, you must configure a valid custom content server. See Custom Source Location for specific instructions on how to do this.
Enter the DNS name (such as"
mycustomsite.com") or the IP address (in IPv4 or IPv6 format) of the server in the Custom Content Source text box. DNS is recommended.Click Save.
Important
Malware definition content updates from a numbered source folder with a lower value than the numbered folder of the currently loaded malware definition content may not be successful. To ensure successful content updates, your target folder for content updates must be named with a lower numerical value than that of the source folder.
To configure the custom download channel for selected host sets:
Note
See Creating a Custom Policy for more information about using the Web UI to create a custom policy.
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Select the Malware Protection tab.
In the Malware Definition Updates section, click the Malware Definition Source drop-down and select Custom Source.
Important
Before using the Custom Source option, you must configure a valid custom content server. See Custom Source Location for specific instructions on how to do this.
Enter the DNS name (such as"
mycustomsite.com") or the IP address (in IPv4 or IPv6 format) of the server in the Custom Content Source text box. DNS is recommended.Click Save.
To revert to the default malware definition source and settings, click Reset to defaults.
Important
Malware definition content updates from a numbered source folder with a lower value than the numbered folder of the currently loaded malware definition content may not be successful. To ensure successful content updates, your target folder for content updates must be named with a lower numerical value than that of the source folder.