malwareDetection Section Settings

The clean32_uri key identifies the location of Trellix 's database of clean files, which includes Windows system files and commonly used application files, for 32-bit environments.

The Security Content package, which contains the database of clean files, is made available to the Endpoint Security (HX) server via Trellix 's Dynamic Threat Intelligence (DTI) cloud. When malware protection is enabled, the clean32_uri channel is added to the agent_configuration.json file, which allows the Windows system files and commonly used application files to be excluded from malware scanning. This improves the performance of the malware protection feature during agent installation and upgrade. It also improves the malware scanning times of common application installations.

The clean64_uri key identifies the location of Trellix's database of clean files, including Windows system files and commonly used application files, for 64-bit environments.

The Security Content package, which contains the database of clean files, is made available to the Endpoint Security (HX) server via Trellix's Dynamic Threat Intelligence (DTI) cloud. When malware protection is enabled, the clean64_uri channel is added to the agent_configuration.json file, which allows the Windows system files and commonly used application files to be excluded from malware scanning. This improves the performance of the malware protection feature during agent installation and upgrade. It also improves the malware scanning times of common application installations.

The enable key indicates whether malware detection, a component of malware protection, has been enabled or not. Valid values are true (enabled) or false (disabled). The default is false.

Change this setting using one of the following methods:

The excludedFiles key lists the files and folders to be excluded from malware protection processing. This list of files and folders is part of the malware protection global policy.

There is no default. If no files or folders are listed, all files and folders are included in malware protection processing.

Files and folders should be listed within quotation marks (") and separated by commas. The full list of files should be enclosed in brackets ([]). For example:

"excludedFiles": [
    "\\system32\\",
    "\\FireEye\\xagt\\events.*"
]

The excludedMD5s key lists the MD5 hashes to be excluded from malware protection processing. This list of MD5 hashes is part of the malware protection agent default policy.

There is no default. If no MD5 hashes are listed, all MD5 hashes are included in malware protection processing.

MD5 hashes should be listed as a sequence of 32 hexadecimal digits, within quotation marks ("), and separated by commas. The full list of files should be enclosed in brackets ([]). For example:

"excludedMD5s": [
    "c8a9dab8f7cdec707eba6deca3448ba8",
    "c2f5bbc927532092da5bfbb5ef839308"
]

Change this setting using one of the following methods:

The excludedProcesses key lists the processes that should be excluded from Malware Protection processing. This list of monitored applications is part of the malware protection global policy.

There is no default. If no processes are listed, all processes are included in Malware Protection processing.

Specify the fully qualified name of a process you want to exclude from Malware Protection processing within quotation marks ("), and separated by commas. For example:

"excludedProcesses": [
    "c:\\windows\\winhlp32.exe",
    "c:\Program Files (x86)\Redline\Redline.exe"
]

The fileExtInclusions key lists the extensions of files types included in malware protection processing.

By default, all files with extensions of *.com, *.exe, *.dll, *.ocx, and *.sys are included in malware protection processing when it is turned on. These extensions are not shown in the fileExtInclusions list, but are always included in malware protection processing.

Use the fileExtInclusions list to add other file extensions to malware protection processing. There is no default. If no extensions are listed, only files with extensions of *.com, *.exe, *.dll, *.ocx, and *.sys are included in malware protection processing.

File extensions should be listed within quotation marks (") and separated by commas. The full list of file extensions should be enclosed in brackets ([]). For example:

"fileExtInclusions": [
    ".log",
    ".py*"
]

Change this setting using one of the following methods:

The malwareDetection network_oas settings provide keys that define how Trellix Endpoint Security (HX) xAgents handle on-access malware scans for files accessed over your network.

The following table lists the network_oas setting keys, defines their default values, and identifies the edit methods that are supported by Trellix for each setting. Settings listed in this table can also be changed manually for an individual host by modifying the agent configuration file.

The malwareDetection quarantine settings provide keys that define how remediation actions, including file quarantine and clean, are handled during malware protection processing.

Select a setting from the table below to view the edit methods FireEye supports. Settings listed in this table can also be changed manually for an individual host by modifying the agent configuration file.

The update_enabled key is used internally by malware protection processing. Do not change its value.

The update_interval key specifies the interval, in seconds, at which malware definition updates should be retrieved from the Trellix servers. Valid values range from 60 seconds to 86400 seconds (one day). The default is 14400 seconds (four hours).

Change this setting using one of the following methods:

The update_source key specifies the malware protection indicator download channel used to download the latest malware protection indicators to the Trellix Endpoint Security (HX) xAgents on your host endpoints. Valid values include internet, hx-preferred, andhx-only.

The table below lists the available channel options. The Internet is the default source.

Change this setting using one of the following methods:

The update_url32 key identifies the location of Trellix's malware definitions in 32-bit environments.

The update_url64 key identifies the location of Trellix 's malware definitions in 64-bit environments.