Press CTRL+K to open search

Managing Cloud Lookup for Malware Protection

  • Published on Sep 8, 2026
  • 1 minute(s) read
Prev Next

The xAgent Cloud Lookup feature enables you to check unknown files against a cloud-based database of known malware to identify malicious software. This real-time analysis helps protect against new and emerging threats that may not be covered by traditional signature-based antivirus software.

Enabling Cloud Lookup for selected host sets

If Malware Detection is enabled, you can enable or disable Cloud Lookup for Windows hosts.

To enable Cloud Lookup for selected host sets:

  1. Log in to the Web UI as an administrator.

  2. From the Admin menu, select Policies.

  3. In the Policies table, click the link for the custom policy you want to modify.

  4. In the Malware Detection section, toggle the Signature and Heuristic Detection ON/OFF switch to ON.

  5. For Windows host sets, select the Cloud Lookup.

    Cloud_Lookup.PNG

  6. Click Save.

Now you can assign host sets to the custom policy and set the policy priority level. See Assigning Host Sets to Agent Policies and Configuring Policy Priority Using the Web UI for more information.

Cloud Lookup for Signature and Heuristics

Note

For this feature, the Cloud Lookup contacts nimbus.bitdefender.net over TCP port 443 to perform a hash lookup.

When this option is enabled in the policy, the Signature and Heuristics scan engine (BitDefender) is initialized to perform a Cloud Lookup while performing a scan. When a detection occurs, it will perform a hash lookup to:

  • Reduce false positives when otherwise classified by the scan engine.

  • Improve detection rates based on updates made in the cloud service before the content is available.

Cloud Lookup for Malware Guard

Note

For this feature, the Cloud Lookup contacts fendpoint.rest.gti.trellix.com over TCP port 443 to perform a hash lookup.

If Malware Guard detects a threat after the scan, the anti-virus engine queries Trellix Global Threat Intelligence (GTI). It provides the MD5 hash of the file to reduce false positives.

Trellix Global Threat Intelligence is a cloud-based reputation service utilized by multiple Trellix products: https://www.trellix.com/products/global-threat-intelligence/

:

Related articles
  • Understanding Malware Protection
    Endpoint Security Agent (HX) > Endpoint Security Agent (HX) 35 Administrator Guide > Agent Configuration > Malware protection overview
  • Malware detection
    Endpoint Security Agent (HX) > Endpoint Security Agent (HX) 36 Administrator Guide > xAgent Configuration > Malware protection overview > Understanding Malware Protection
  • Configuring malware protection
    Endpoint Security (HX) > Endpoint Security (HX) Server 10.x User Guide > Configuration