Managed Anti-Virus¶
Overview¶
Overview¶
Features¶
Following are the features of this menu:
Available Functions¶
List of Functions¶
Following functions are available with Customers with this menu:
Functions |
Overview |
Descriptions |
|---|---|---|
Anti-malware |
Detection of malware |
Using pattern files and search engines for anti-malware measures offered by Trend Micro, we detect attacks from malicious persons using malware. |
Update pattern file |
Using date and time set by the customer as the start time, the unupdated pattern file for anti-malware measures will be updated. (The update time is the time of issue of the update start task, and the start time differs depending on the action conditions on the Agent (Deep Security Agent) side.) |
|
Schedulescan |
Using date and time set by the customer as the start time, the scan of malware will be started. (The start time is the time of issue of the scan start task, and the start time differs depending on the action conditions of the Agent side.) |
|
Control Panel |
Function that allows the customer to send applications and do setting of each function from the Security Control Panel of the Enterprise Cloud 2.0 Portal. |
Description of Functions¶
Anti-malware¶
Item |
Descriptions |
|---|---|
Functions Settings |
Set the function either with ON (valid) and / or OFF (invalid). |
Type of scan |
The followings are the types of scan by timing:
Real Time Scan
Scan every time the operation on the file is performed.
Manual Scan
It’s possible to Scan at any time.
Scheduled Scan
Automatically the scan is executed in the specified date and time.
|
Scan Setting |
Specify the directory, file for scan. |
Scan Exclusion Setting |
Specify the directory, file, file extension for scan exclusion. |
Actions |
Select the action to be taken when a malware is detected.
Trend Micro recommended
Automatically determines the processing to be executed.
Custom actions
The action to be executed can be specified.
The types of action to be performed are as follow:
Pass
Nothing done to the infected file and it’s recorded in the log.
Clean
Remove only the infected parts from the infected file.
Delete
Remove each infected file.
Deny Access （real time scan only）
If the customer tries to manipulate the infected file, the process will be blocked immediately.
Quarantine
Move the file to a quarantine directory on the host.
|
Smart Scan |
A minimum of pattern files on the local and using the complete pattern file of Trend Micro’s server on the internet, to determine the presence or absence of danger. |
Scan Limitations |
It is possible to specify the maximum size of files to scan. (Files that are larger than this size are not scanned) |
Note
Recommended action by Trend Micro is to handle properly the detection of individual malicious programs and the action will be adjusted on an ongoing basis. Recommended action of Trend Micro will be updated and at the same time the virus patterns will be updated.
In the manual scan or scheduled scan, if the malware scan setting, that has the “Deny Access” option selected, is selected then the “Pass” processing is applied.
If the smart scan is on, the size of the local is examined in a small pattern files, files that were regarded as “Possible Malware”, and access to the Trend Micro server on the Internet. Compare with the full pattern file on the server, to determine the presence or absence of danger. In this method, the size of the local pattern file is kept small, also reduces the size and number of the necessary updates in the Agent.
If you set a 0 to the value of the limit of the scan, which means that there is no maximum size, all of the files will be scanned.
2. Control Panel¶
Item |
Descriptions |
|---|---|
Customers can subscribe the Security Menu |
|
Setting/Management of this menu is possible. |
● Order
Following actions are processable from the Order Panel:
Item |
Descriptions |
|---|---|
New |
Start a new order |
Change Function |
It is possible to change the usage menu. |
Change Quantity |
It is possible to change the quantity of the menu. |
Cancel |
Terminate the use of the menu |
● Operation
The operable items from the operation are as follows.
Item |
Descriptions |
|---|---|
Computer |
It is possible to carry out the setting of various security functions. |
Policy |
It is possible to define rules and settings collectively and assign the same settings to multiple computers. |
Alert |
Alert will be issued to the administrator when a event, that requires attention, has occurred. |
Report |
It is possible to output various reports. |
Management |
It is possible to carry out the management of the setting of scheduled tasks (for example, scheduling the security updates and scheduled scans), pattern file and rules. |
Note
Available period of logs is 4 weeks on Security Control Panel. This menu does not ensure completeness of logs. Please export logs regularly by customer self.
When customer wants to manage this menu on one operation screen among multi region or tenant, Please subscribe this menu on 1 region and tenant for usage in use. Price information will be shown on the tenant which is subscribed.
Menu¶
Application Process¶
Subscriptions types |
Contents |
Order Methods |
Offering Date |
|---|---|---|---|
New |
New Subscription |
Subscription by customer on Enterprise Cloud 2.0 Portal through Security Control Panel. |
Immediate |
Change Function |
Modify Menu |
Same as the above. |
Same as the above. |
Change Quantity |
Modify the quantities of subscriptions |
Same as the above. |
Same as the above. |
Cancel |
Termination of Use |
Same as the above. |
Same as the above. |
Note
For one tenant of the Enterprise Cloud 2.0, it is possible to use any one of the menu of the host-based Security.
Managed Anti-Virus
Managed Virtual Patch
Managed Host-based Security Package
Until the process of one order is complete, it will not be able to perform the next order.
Change Function (Modify Menu), is an order where all the host of the menu are changed to other host-based security’s menu.
- Managed Anti-Virus → Managed Virtual Patch
- Managed Anti-Virus → Managed Host-based Security Package
Please stop communications between Agent and management server, and uninstall Agent, before customer places an order for termination.
New Host-based security order is not available after 2 weeks when customer terminate this menu on the tenant.
Restrictions In Subscriptions¶
Unit |
Maximum Number |
|---|---|
| 1 | 256 |
Note
Customers are advised to consult with NTT Com Sales in charge if the required availability exceeds 256 units.
Terms and Conditions¶
Device requirements¶
Agent system requirements¶
Item |
Contents |
|---|---|
Memory |
1 GB or more
|
Internal Disk |
More than 500MB
|
| [1] | Relay function can download pattern file and rule from TrendMicro server, and deliver host which install Agent. |
System requirements of Deep Security Notifier¶
Item |
Contents |
|---|---|
Memory |
3MB |
Internal Disk |
1MB |
Target OS (Microsoft Windows)¶
Note
A Windows product whose edition is not specified will be guaranteed of its operation within the vendor support range regardless of the edition.
Service packs that are not listed in the system requirements, but are newer than those listed in the requirements, are guaranteed to work within the vendor’s support. For more information, please see here
Relay function can work on 64bit above OS.
- The following environments are outside of our support even if they are the targets of vendor support.
- Windows Server 2008/2012 (Server Core)
- Microsoft Virtual Server 2005 R2 SP1
Target OS (Linux)¶
Note
The Linux version of Agent must also support your kernel. For the supported kernel versions, see the Tutorial - Linux OS kernel support and the following product Q&A.
Available functions differ depending on the version of Agent to be installed and the type of OS on which it is installed. Please refer to Supported function list .
For information on installing the OS on cloud environments such as Amazon Web Services and Microsoft Azure, please refer to the following product Q&A .
Deep Security supports only UTF-8 as multi-byte character encoding, and in Linux / UNIX environment, you need to set the OS locale to UTF-8 (e.g. ja_JP.UTF-8). For more details, please refer to the following product Q&A .
Relay function can work on 64bit above OS.
Concerning some OSs, we may not be able to offer them even if they are among the targets of vendor support. For details of the some OSs, please talk with us through the Enterprise Cloud 2.0 ticket system.
DSA operation with RHEL8, CentOS8, and Ubuntu 18.04 enabled for secure boot is not supported. Please disable Secure Boot in advance. For DSA secure boot support, please refer to Product Q&A.
CentOS8 cannot be installed by script. Please enable it after manually installing the Agent.
Communication Requirements¶
Agent communication requirements¶
This Menu’s network connectivity requirements are as follows:
The Agent installed on the host needs to connect with the management server via the Internet. Similarly, when using some functions, it is necessary to connect with Trend Micro server.
If environments such as fire wall exist, set them adequately.
Name resolution is necessary to communicate management server and TrendMicro server. Please configure host installing Agent to perform name resolution.
If hosts cannot directly connect internet, please configure internet communication through Proxy server. When a host use internet communication via Proxy server, please prepare host which enable Relay function in customer environment. The host installing Agent can enable Relay function.
If Agent communicate with Relay, please configure host installing Agent to perform name resolution for connecting the host which enable Relay function.
Installation of the internal distribution server (Deep Security Relay Server) is recommended even in the environment where the number of management devices of the environment exceeds 5, or where you want to restrain the traffic to the Internet. Installation of the internal distribution server (Deep Security Relay Server) is essential in the environment where the number of management devices of the environment exceeds 20.
Transmissions Details |
Destination |
Port |
|---|---|---|
Manager Server |
|
TCP 80, 443 |
Connection to a host which enable Relay function.
* When customer prepare in customer environment.
|
|
TCP 4122 |
Functions |
URL |
|---|---|
Download Center or web server
- Hosts software.
|
files.trendmicro.com |
Smart Protection Network
- Certified Safe Software Service (CSSS)
|
|
Smart Protection Network
- Global Census Service
- Used for behavior monitoring, and predictive machine learning.
|
|
Smart Protection Network
- Good File Reputation Service
- Used for behavior monitoring, predictive machine learning, and process memory scans.
|
|
Smart Protection Network
- Smart Scan Service
|
|
Smart Protection Network
- predictive machine learning
- Used for predictive machine learning.
|
|
Update Server (also called Active Update)
- Hosts security updates.
|
|
Mail communication requirements¶
The communication requirements of the e-mail notification of this menu are as follows.
To use e-mail notification, please indicate customer managed SMTP server on Security Control Panel . If SMTP server restrict a connection, please allow below IP addresses.
210.161.150.240～248
Port number waiting for the SMTP server of the customer is specified as the following:
tcp 25 or 587
Conditions for This Service in Combining with Other Services¶
Price¶
Initial Fee¶
Monthly Fees¶
Quality of Service¶
Support Coverage¶
Management server¶
Agent¶
Note
Settings values and operations methodologies and inquiries requiring consulting will not apply to the coverage of such support.
Problems concerning other parts than Agent such as OS, virtual environment and network, shall be outside of our support. For problems arising from specification and setting of OS, or environment dependency, we may not be able to show solutions or workarounds for malfunctions.
Monitoring and setting change work shall be outside of our support.
Investigation of and action to incidents on the host caused as a result of malware infection or attacks from malicious persons shall be outside of our support.
The virtual environment (Docker, etc.) that uses the container technology shall be outside of our support. If used in the Docker environment, the customer’s system may stop for some reason.
Operations¶
Management server¶
Item |
Descriptions |
|---|---|
Applies security patches |
Apply the security patch depending on the degree of influence |
Product Life-cycle Management |
Implementation of version upgrade |
Monitoring / Maintenance |
Implementation of the operation monitoring and fault response |
Device management (host)¶
Note
- Life cycle of Agent used on the host conforms to the support specification of Trend Micro. Perform update of Agent and/or the host OS after confirming the support period.
Security incident report¶
Restrictions¶
Constraints of this menu are as follows.
Common¶
To install the Agent, you must be logged in as an administrator in the target host.
In the Host on which you want to install the Agent, please do the time synchronization using NTP, etc. If the time is out of synchronization, it may fail to activate the Agent.
Rebooting of the OS may become required at the time of installation/uninstallation, or when you update various modules. As an alert indicating the requirement of rebooting is displayed on the management console in these cases, reboot the OS promptly.
In the case a module has to be replaced or switched over, temporary communication interruption (momentary interruption) may occur.
If you enable the Web Reputation, Firewall, and Intrusion Prevention features, the network driver will be installed on the target host, causing a momentary interruption. Click here for details .
Agent uses 4118 port and the port number cannot be changed. Please confirm other applications on host installing Agent do not use the port.
Operation tests, including competition tests with products other than Trend Micro, have not been performed on the host on which the Agent is installed. Therefore, we cannot answer about coexistence with individual software. Please check the operation in your environment. There are also detailed conditions for coexistence with other Trend Micro products. For details, see Operation when coexisting with Trend Micro products and products of other companies .
Please allow 80 port for CONNECT method, when Agent connects management server through Proxy server.
Termination of use may occur to Customers when following case(s) fit(s) to the circumstances where Customers are involved with:
Usage of the menu with the Customers seems to greatly affect other customers who share the platform with them.
Back logs of the usage of the menu with the particular Customers seem particularly unmatched in terms of difference in between the actual usage and the usage claimed to be reported at subscription request.
Each function and log provided by this menu does not ensure integrity, accuracy and compatibility for customer’s purpose of use.
Following is required to be attained to provide details to developer and seller of this menu’s functions who had configured to produce these functions:
Setting details and data obtained at such time the menu is provisioned.
Information obtained with the menu functions
We cannot ensure the recovery from flaw based on combinations between customer environment and function provided by this menu, and customer operation except for operation NTT communications indicate.
If you use the Agent in an environment with SELinux enabled, the iptables rules may be initialized. We cannot provide any support for SELinux policy creation methods, including the purpose of avoiding this event. We will support the Agent even if SELinux is enabled, but please note that we may not be able to provide a solution for problems caused by SELinux. Click here for details.
Restrictions for Anti-malware¶
Following files are excluded from Anti-malware:
Password-protected file
Files frozen with unsupported formats
Destructed file
Encrypted file
Files frozen for more than max six (6) times
Files that their sizes after been decompressed exceeds the set value
Following usages of server does not appropriately set viral scan objects, which thereby causes the server performance a great deal of loads to downgrade the output. NTT Com recommends, in such cases, Customers duly exclude such scan setting. Primal examples will be as follows:
Server that mounts directories within network
Server where I/O is frequently generated, like database, Active Directory, etc.
Server that is so appropriately called “Big Data”
Mail Server (POP / IMAP)