...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
| id | 443944098 |
|---|
...
| id | 443944110 |
|---|
...
| background-color | $lightGrayColor |
|---|---|
| id | 443944096 |
Topics Discussed
| Table of Contents | ||||
|---|---|---|---|---|
|
...
Product Overview
...
The Malware Protection services provide protection against malicious software ("malware"). Armor utilizes an enterprise-class malware protection application and deploys the application agent with the Armor Agent. The malware protection agent registers with an Armor management console that receives scan results and activity logs in real-time. Armor malware protection provides an extra level of detection on your hosts to identify suspicious activity and alert you to it. In addition to eradicating malware, each exploit generates community-powered insights—the collective knowledge of these insights is applied across more than 1,200 client environments.
...
...
...
The malware protection agent registers with the Armor management portal (AMP) console, which receives scan results and activity logs in real-time. These logs are entered into the Spartan platform database, where SOC teams monitor alerts 24/7/365. If a critical detection occurs, the security information and event management platform (SIEM) will alert in near real-time. If new malware is discovered during our security operations and analytics, We work directly with the anti-virus (AV) vendor to have signatures created, and our teams create custom mitigation and/or detection techniques as threats emerge. This means an attack on one Armor customer provides protection for all others.
Frequently Asked Questions
...
How often are Malware scans performed?
Real-time scans continuously monitor for malware. Every time a file is received, opened, downloaded, copied, or modified, a real-time scan occurs. (In comparison, manual and scheduled scans only detect malware at specific times, when you run them.) If Deep Security detects no security risk, the file remains in its location and users can proceed to access the file. If Deep Security detects a security risk, it displays a notification message, showing the name of the infected file and the specific security risk.
Does Malware Protection help keep my environment compliant?
Yes. Armor's Malware Protection service addresses key change control processes required by PCI DSS, HIPAA, HITRUST, SAN CSC, NIST, and other frameworks.
| Note | |
|---|---|
To fully use this screen, you must add the following permission to your account:
Anchor | |
Enable Trend Sub-Agent
...
As a prerequisite to installing Malware Protection, you must install the Trend sub-agent. Use the commands below to manage the Trend sub-agent.
| Info |
|---|
For cloned assets with the Trend sub-agent installed, users will still need to enable the modules and run recommendation scans as needed. |
| Info |
|---|
You can also manage the Trend sub-agent in the Armor Toolbox. |
Install Trend Sub-Agent:
| Code Block | |
|---|---|
| theme | Midnight |
| firstline | 1 | linenumbers | true
Windows: C:\.armor\opt\armor.exe trend install
Linux: /opt/armor/armor trend install |
Uninstall Trend Sub-Agent:
| Code Block | |
|---|---|
| theme | Midnight |
| firstline | 1 |
| true |
Trend Sub-Agent Status:
| Code Block | ||||||
|---|---|---|---|---|---|---|
|
The following Trend commands are not relevant to the Malware service.
...
Turn On Recommended Scans:
...
| Expand | ||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Turn On Recommended Scans:
Turn Off Recommended Scans:
Schedule a Recommended Scan (Runs on Next Trend Sub-Agent Heartbeat):
Set Recommendation Scan Interval:
Get Recommendation Scan Interval:
Restart Trend:
|
Trend Sub-Agent Help
| Code Block | |
|---|---|
| theme | Midnight | firstline | 1
| linenumbers | true |
| Anchor | Enable Malware Protection Service | Enable Malware Protection Service
Enable Malware Protection Service
...
Use the following commands to manage the Malware Protection service. Once the Trend sub-agent and the Malware service are enabled, you will be able to manages services in the Armor Toolbox.
Turn On Malware Protection:
| Code Block | |
|---|---|
| theme | Midnight |
| firstline | 1 | linenumbers | true
Windows: C:\.armor\opt\armor.exe av on
Linux: /opt/armor/armor av on |
Turn Off Malware Protection:
| Code Block | |
|---|---|
| theme | Midnight |
| firstline | 1 |
| true |
Malware Protection Status:
| Code Block | |
|---|---|
| theme | Midnight |
| firstline | 1 | linenumbers | true
Windows: C:\.armor\opt\armor.exe av status
Linux: /opt/armor/armor av status |
Malware Protection Help
| Code Block | |
|---|---|
| theme | Midnight |
| 1 | |
| linenumbers | true |
| Anchor |
View
...
Malware Events
...
The TotalMalware Events table displays detected malware events from the past 30 days. You can click the widget to filter the data in the table below the widgets.
The Malware Protection subagent detects the following malware types:
TROJAN (TROJ)
WORM
EICAR (VIRUS)
VIRTUS
RANSOM (RANSOMWARE)
SPYWARE
ADWARE
COINMINER (COIN_MINER)
In the Armor Management Portal (AMP), in the left-side navigation, click Security.
Click Malware Protection.
Review the widgets for malware events.
Widget
Description
Clean This widget indicates that the infected file was cleaned.
Pass This widget indicates that no action was taken on the infected file.
Quarantine This widget indicates that the file was renamed, and then moved to a temporary location.
Delete This widget indicates that an infected file was deleted.
DenyAccess This widget indicates that an infected file has restrictive access. As a result, no action was taken.
Other This widget indicates all other possible actions performed on the infected file, such as renaming the file.
(Optional) Click a widget to filter the table.
Column
Description
Name This column displays the name of the virtual machine or instance. Malware Name This column displays the name of the malware detected in your virtual machine or instance. File Name This column displays the location of the malware detected in your virtual machine or instance. Action Taken This column displays the action that took place in the file where the malware was detected:
- Cleaned
- Passed
- Quarantined
- Deleted
- Denied Access
- Other
Date This column displays the date when the malware was detected.
...
View Service Health Data for Malware Protection
...
In the Armor Management Portal (AMP), in the left-side navigation, click Security.
Click Malware Protection.
Navigate to the Malware Protection Service table.
The status icons above the Malware Protection Service tableindicate the overall Malware Protection status for all of your instances. There are three status types:
OK (in green) indicates that your server's agent has communicated (hearbeated) with Armor.
Warning (in yellow) indicates that your server's agent appears to be reporting behind its expected timelines.
Needs Attention (in red) indicates that your server's agent has not properly communicated (heartbeated) with Armor.
Column | Description |
|---|---|
Name | For Armor |
...
Enterprise Cloud, the name of the virtual machine you created in AMP. For Armor Anywhere, the name of the instance that contains the installed Anywhere agent, which includes the Malware Protection subagent. | |
Provider | For Armor |
...
Enterprise Cloud, the entry will display Armor. For Armor Anywhere, the name of the public cloud provider for the instance will appear. | |
Last Communication Date | The date and time that the Malware Protection subagent last communicated with Armor.
|
Last Scan | The date and time of the last Malware scan.
|
Scan | The Scan button will display if your subagent has heartbeated within the last four hours, AND a scan is not already in progress for the virtual machine or instance. The Scan button will NOT display if an initial Malware scan has not been run, nor if your sub-agent has not heartbeated for that particular virtual machine or instance within the last four hours. The Scan button will be disabled if there are five active scans running on your account. |
The number of active scans will display in the top right corner of the table.
To learn how the overall Malware Protection status is determined, see Understand service health
...
data for Malware Protection (below).
Understand Service Health Data for Malware Protection
...
In the Malware Protection screen, the Malware Protection Service table displays the various malware protection statuses of your virtual machines or instances:
Green indicates a virtual machine in a Secured Malware Protection status.
Yellow indicates a virtual machine in a Warning Malware Protection status.
Red indicates a virtual machine in a Critical Malware Protection status.
The Malware Protection status can change based on the following two conditions:
The date of your last scan (Last Scan)
The date that Armor last received your data (Last Communication Date)
The overall status of your virtual machine is based on the individual status of your virtual machine's subcomponents (subagents), including Malware Protection.
Condition 1. Date of last scan
If the last scan for Malware Protection took place between 7 to 13 days ago, then the Malware Protection status changes from Secured to Warning.
If the last scan for Malware Protection took place 14 days ago or more, then the Malware Protection status changes from Warning to Critical.
Date of last scan | Security status |
|---|---|
7 to 13 days ago | Warning |
14 days or more | Critical |
Condition 2. Date that Armor last received your data
If Armor last received data between 24 to 48 hours ago, then the Malware Protection status changes from Secured to Warning.
If Armor last received data over 48 hours ago, then the Malware Protection status changes from Warning to Critical.
Date of Armor receiving your data | Security status |
|---|---|
24 to 48 hours ago | Warning |
Over 48 hours | Critical |
Armor labels the Malware Protection status based on the worst status of the two conditions. For example, if the date of your last scan was 9 days ago, but Armor last received your data 72 hours ago, then overall, the Malware Protection status is Critical.
...
View Detailed Malware Protection Data
...
The Malware Protection details screen displays the malware that has been detected in your virtual machine or instance. This screen only shows data for the last 90 days.
In the Armor Management Portal (AMP), in the left-side
...
Click Malware Protection.
...
navigation, click Security.
Click Malware Protection.
Locate and select the desired virtual machine or instance.
Column | Description |
|---|---|
Malware Name | The name of the malware detected in your virtual machine or instance. |
File Name | The location of the malware detected in your virtual machine or instance. |
Action Taken | The action taken against the malware:
|
Date | The date when the malware was detected. |
Run a Malware Scan
...
In the Malware Protection screen, you can run a manual scan for your virtual machine or instance.
...
Column
...
Description
...
Malware Name
...
| Note | |
|---|---|
| File Name | The location of the malware detected in your
| Action Taken | The action taken against the malware:
|
| Date | The date when the malware was detected. |
| Anchor | Run a Malware scan | Run a Malware scan | Run a Malware Scan
| Insert excerpt | ESLP:Run a Malware scan (snippet) | ESLP:Run a Malware scan (snippet) | nopanel | true
In the Armor Management Portal (AMP), in the left-side navigation, click Security.
Click Malware Protection.
Within the Malware Protection Service table, locate the desired virtual machine or instance, then click Scan.
The Scan column will display Scanning while the scan is running.
| Note |
|---|
The number of active scans will display in the top right corner of the table. |
Users can also run a manual scan using the Armor Toolbox or using the CLI commands below:
| Code Block | |
|---|---|
| theme | Midnight |
| firstline | 1 | linenumbers | true
Windows: C:\.armor\opt\armor.exe av scan
Linux: /opt/armor/armor av scananchor |
View Malware
...
Scan Activity
...
In the Malware Protection screen, on the Scan Activity tab, you can view details on current and past scans.
In the Armor Management Portal (AMP), in the left-side navigation, click Security.
Click Malware Protection.
Click Scan Activity.
| Note |
|---|
The number of active scans will display in the top right corner of the table. |
COLUMN | DESCRIPTION |
|---|---|
Name | This column displays the name of the virtual machine or instance. |
User | This column displays the name of the user who initiated the scan. |
Time Started | This column displays the date and time that the scan was initiated. |
Last Updated | This column displays the date and time of the last status check for the scan. |
Status | This column displays the status of the scan:
|
...
| Info | |
|---|---|
TroubleshootingArmor troubleshoots servers that contain Malware Protection subcomponents in a Warning or Critical status. To troubleshoot with Armor, you must submit a support ticket.
Anchor | |
Export
...
Malware
...
Protection Data
...
To export the data:
In the Armor Management Portal (AMP), in the left-side navigation, click Security.
Click Malware Protection.
(Optional) Use the filter function to customize the data displayed.
Below the table, click CSV. You have the option to export all the data (All) or only the data that appears on the current screen (Current Set).
Function
Data Displayed
Notes
CSV
Vm Name
Vm Provider
Os
Last Agent Communication Date
Last Scan
A blank entry indicates that the action has never taken place. For example, if there is a blank entry under Last Scan, then a scan has never taken place for that corresponding virtual machine.
...
| Info | |
|---|---|
TroubleshootingIf you do not have any malware events listed, consider that:
Anchor | |
Log Search for Malware
...
Users can search for Anti-virus/Malware events in Log Search. For instructions on how to access and use Log Search, please see our documentation here.
An example of AV/Malware logs can be seen below:
.png?version=1&modificationDate=1601651506000&cacheVersion=1&api=v2) |
|---|
For a full list of Log Search fields and descriptions, please visit our glossary here.
...