News

EOS of agent for Managed Anti-Virus and Managed Host-based Security Package


Thank you for using Enterprise Cloud (ECL) service.

Pleased be informed of the end of support of agent Managed Anti-Virus and Managed Host-based Security Package at ECL2.0.

The agents of anti-malware smart scan (file reputation) and web reputation (only available for Managed Host-based Security Package) features are needed to update. These functions can be used by connecting to the Smart Protection Network (hereinafter referred to as SPN) managed by Trend Micro, and this upgrade is due to the upgrade of the certificate used by SPN.

Affected Service

ECL2.0 Host-based security

Affected Menus

Managed Anti-Virus

Managed Host-based Security Package

Functions

Anti-malware smart scan (file reputation)

Web reputation

* Customers who do not use this function will not be affected.

Versions that need to be upgraded

OS: Linux series, Unix series

Agent version:Deep Security Agent 11.0.0-2061 and above

* Window version of Agent is not affected.

Countermeasure

You need to upgrade to the latest version currently available in the Security Control Panel.

 

[How to Upgrade]

Please refer to the following URL for details on the Agent upgrade procedure.

https://ecl.ntt.com/en/documents/tutorials/security/rsts/security/operation/host-based_security/agent_upgrade_index.html

Notes

  • It may be necessary to restart the OS.
  • After upgrading, be sure to confirm that the Agent version upgrade has been completed on the Security Control Panel.

 

[How to verify after upgrade]

https://ecl.ntt.com/en/documents/tutorials/security/rsts/security/operation/host-based_security/agent_upgrade_check.html

EOS date

8 July 2022

* The SPN expiration date for the Linux and Unix version of the old Agent (less than 11.0.0-2061)

Impact of not upgrading

After 9 July 2022, agents that have not been upgraded to the target version will fail the SPN connection. This makes it impossible to use various functions that use SPN such as smart scan (file reputation) and web reputation.

In addition, the following events will occur if this effect is met.

Event ID: 926 “Unable to connect to Smart Protection Server for Smart Scan”

Event ID: 932 “Unable to connect to Smart Protection Server for Web Reputation”

 

However, Smart Scan (File Reputation) allows you to perform a scan using a traditional scan pattern file downloaded to your computer by temporarily switching to traditional scan.

* For the conventional scan switching procedure, refer to “Conventional scan switching procedure” below.

Smart scan

Smart Scan uses Trend Micro’s SPN to reduce the size of pattern files downloaded to your computer.

Files that are considered “potentially dangerous” when scanned are checked against the latest threat information in cooperation with SPN to determine the presence or absence of danger.

 

[Advantages of smart scan]
  • You can check against the latest patterns that are updated frequently.
  • Since only the minimum pattern is used, the memory usage of your computer can be suppressed or reduced in the long term.
  • Most of the patterns are updated only on the SPN side, so the patterns on the computer side can be updated with a minimum of updates and inquiries to the SPN.
  • You can reduce or reduce the network load on download and distribution over the long term.

Conventional scan

You can scan using the traditional scan pattern file downloaded to your computer.

 

[Notes on conventional search]
  • The pattern file is usually updated once a day.
  • The pattern file is updated when the security update reservation task is executed.
  • The size of the pattern file downloaded to the Agent is approximately 120MB.
  • If you use conventional scanning for a long period of time, the pattern file downloaded locally on your computer will continue to grow as the malware increases, which will increase memory usage.

 

[Conventional scan switching procedure]
  1. Select the target policy on the policy screen of the management portal and open the details screen.
  2. Turn off the smart scan on the Smart protection screen for anti-malware.

* You can also turn off smart scan from the details screen of the target computer.

 

If you want to use Smart Scan after upgrading to Agent 11.0.0-2061 or higher, go to the Smart protection tab for anti-malware. Turn smart scan from off to on.

Recommendations from service providers

We strongly recommend that you use the latest version of Agent, Since the latest version of Agent includes fixes for known problems and security updates that address vulnerabilities.

Therefore, please upgrade the Agent on a regular basis.

 

Thank you.