If Exploit Guard is enabled, you can use the Web UI or the API to enable and disable exploit prevention for all your host endpoints or for specific host sets in your environment. This section covers how to use the Web UI to enable and disable exploit prevention options for the xAgent default policy and a custom policy. See the Endpoint Security (HX) xAgent API Guide for more information on managing xAgent policies using the API.
This section covers the following topics:
Enabling exploit prevention
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the Agent Default Policy link to access the Edit Policy page.
Select the Exploit Guard Protection tab.
Verify that the Exploit Guard switch is ON.
.png)
Select at least one of the following options, depending on your system requirements.
Prevent known suspicious behaviors. See Blocking Exploited Processes.
Terminate the exploited process. See Terminating Exploited Processes.
Exploit prevention occurs if either of these options is selected.
Important
Enabling exploit prevention may result in data loss when an exploit is blocked in an active process and exploit prevention terminates the process that started the infection.
Click Save.
To enable exploit prevention for a custom policy:
Note
See Creating a Custom Policy for more information about using the Web UI to create a custom policy.
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the Agent Default Policy link to access the Edit Policy page.
Select the Exploit Guard Protection tab.
Verify that the Exploit Guard switch is ON.
Select at least one of the following options, depending on your system requirements.
Prevent known suspicious behaviors. See Blocking Exploited Processes.
Terminate the exploited process. See Terminating Exploited Processes.
Exploit prevention occurs if either of these options is selected.
Important
Enabling exploit prevention may result in data loss when an exploit is blocked in an active process and exploit prevention terminates the process that started the infection.
Click Save.
Now you can assign host sets to the custom policy and set the policy priority level. See Assigning Host Sets to Agent Policies and Configuring Policy Priority Using the Web UI for more information.
Disabling exploit Prevention
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link to go to the Edit Policies page.
Select the Exploit Guard Protection tab.
Verify that the Exploit Guard switch is ON to ensure exploit detection is still enabled.
Clear both of the following options.
Prevent known suspicious behaviors
Terminate the exploited process
Exploit prevention does not occur if these options are not selected.
Click Save.
To disable exploit prevention for a custom policy:
Note
When you disable a setting in a custom policy, the setting is disabled for all host sets assigned to the policy. If you want select host sets to keep the original setting, you must create a new custom policy with the setting enabled and assign it to the selected host sets. See Creating a Custom Policy for more information about using the Web UI to create a custom policy.
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Select the Exploit Guard Protection tab.
Verify that the Exploit Guard switch is ON to ensure exploit detection is still enabled.
Clear both of the following options.
Prevent known suspicious behaviors
Terminate the exploited process
Exploit prevention does not occur if these options are not selected.
Click Save.
Blocking exploited processes
You can enable and disable the exploit prevention option that blocks exploits when they are detected in monitored applications. Modifying the xAgent default policy allows you to enable or disable this setting for all of your host endpoints. The applications are not terminated, but the exploit affecting them is blocked.
Enabling exploit blocking
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link to access the Edit Policies page.
Select the Exploit Guard Protection tab.
In the Exploit Guard Options section, select Prevent known suspicious behaviors. When this option is selected, exploits are blocked when they are detected.
.png)
Click Save.
To enable the option to block exploits for selected host sets in a custom policy:
Note
See Creating a Custom Policy for more information about using the Web UI to create a custom policy.
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Select the Exploit Guard Protection tab.
In the Exploit Guard Options section, select Prevent known suspicious behaviors. When this option is selected, exploits are blocked when they are detected.
Click Save.
Now you can assign host sets to the custom policy and set the policy priority level. See Assigning Host Sets to Agent Policies and Configuring Policy Priority Using the Web UI for more information.
Disabling exploit blocking
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page
In the Policies table, click the Agent Default Policy link to access the Edit Policies page.
Select the Exploit Guard Protection tab.
Clear Prevent known suspicious behaviors. When this option is no longer selected, exploits are not blocked when they are detected.
Click Save.
To disable the option to block exploits for selected host sets:
Note
When you disable a setting in a custom policy, the setting is disabled for all host sets assigned to the policy. If you want select host sets to keep the original setting, you must create a new custom policy with the setting enabled and assign it to the selected host sets. See Creating a Custom Policy for more information about using the Web UI to create a custom policy.
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page
In the Policies table, click the link for the custom policy you want to modify.
Select the Exploit Guard Protection tab.
Clear Prevent known suspicious behaviors. When this option is no longer selected, exploits are not blocked when they are detected.
Click Save.
Terminating exploited processes
You can enable and disable the exploit prevention option using the Web UI or the API. This option terminates a monitored application when an exploit for the application has been detected.
This section covers how to enable and disable exploit termination using the Web UI. See Endpoint Security (HX) REST API Guide for more information on using the API to modify xAgent policies.
Enabling exploit termination
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link to access the Edit Policy page.
Select the Exploit Guard tab.
In the Exploit Guard Options section, select Terminate the exploited process. When this option is selected, exploited processes are terminated when they are detected.
.png)
To quarantine any blocked exploit documents and scripts from running on your host endpoint, you can also select Quarantine malicious artifacts.
Click Save.
To enable the option to terminate exploited processes for all selected host endpoints in a custom policy:
Note
See Creating a Custom Policy for more information about using the Web UI to create a custom policy.
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Select the Exploit Guard tab.
In the Exploit Guard Options section, select Terminate the exploited process. When this option is selected, exploited processes are terminated when they are detected.
To quarantine any blocked exploit documents and scripts from running on your host endpoint, you can also select Quarantine malicious artifacts.
Click Save.
Now you can assign host sets to the custom policy and set the policy priority level. See Assigning Host Sets to Agent Policies and Configuring Policy Priority Using the Web UI for more information.
Disabling exploit termination
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link to access the Edit Policy page.
Select the Exploit Guard tab.
Clear Terminate the exploited process. When this option is no longer selected, exploited processes are not terminated when they are detected.
Click Save.
To disable the option to terminate exploited processes for selected host sets:
Note
When you disable a setting in a custom policy, the setting is disabled for all host sets assigned to the policy. If you want select host sets to keep the original setting, you must create a new custom policy with the setting enabled and assign it to the selected host sets. See Creating a Custom Policy for more information about using the Web UI to create a custom policy.
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
Select the Exploit Guard tab.
Clear Terminate the exploited process. When this option is no longer selected, exploited processes are not terminated when they are detected.
Click Save.
Notifying users about exploit prevention actions
You can enable and disable the option to notify users when exploit prevention actions occur using the Web UI or the API. This section covers how to enable and disable exploit prevention actions for all host endpoints or select host endpoints.
When notification is enabled, a notification message appears when an exploit is blocked or a monitored application is terminated because of an exploit.
.png)
Enabling exploit prevention notifications
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link to access the Edit Policy page.
Select the Exploit Guard tab.
Select Notify the user on the host when an exploit has been blocked. When this option is selected, users are notified when an exploit is blocked.
Important
Enabling exploit prevention may result in data loss when an exploit is blocked in an active process and exploit prevention terminates the process that started the infection.
Click Save.
To enable the option to notify users about exploit prevention actions for selected host sets:
Note
See Creating a Custom Policy for more information about using the Web UI to create a custom policy.
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Select the Exploit Guard tab.
Select Notify the user on the host when an exploit has been blocked. When this option is selected, users are notified when an exploit is blocked.
Important
Enabling exploit prevention may result in data loss when an exploit is blocked in an active process and exploit prevention terminates the process that started the infection.
Click Save.
Now you can assign host sets to the custom policy and set the policy priority level. See Assigning Host Sets to Agent Policies and Configuring Policy Priority Using the Web UI for more information.
Disabling exploit prevention notifications
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link to access the Edit Policy page.
Select the Exploit Guard tab.
Clear Notify the user on the host when an exploit has been blocked. When this option is no longer selected, users are no longer notified when an exploit is blocked.
Click Save.
To disable the option to notify users about exploit prevention actions for selected host sets:
Note
When you disable a setting in a custom policy, the setting is disabled for all host sets assigned to the policy. If you want select host sets to keep the original setting, you must create a new custom policy with the setting enabled and assign it to the selected host sets. See Creating a Custom Policy for more information about using the Web UI to create a custom policy.
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Select the Exploit Guard tab.
Clear Notify the user on the host when an exploit has been blocked. When this option is no longer selected, users are no longer notified when an exploit is blocked.
Click Save.