Network VirusWall Enforcer can automatically inform endpoint users about policy violations through their web browsers or popup messages from the Windows Messenger service or the agent. Administrators can receive notifications through email. You can customize these messages using through the Notifications screen.
Network VirusWall Enforcer can send notifications using the following media.
Media |
Target |
Description |
Web |
Endpoint user |
Web notifications are displayed when a blocked or quarantined endpoint attempts to access a web page or other remote resources using their web browser. |
Popup |
Endpoint user |
Popup notifications are displayed at the endpoint immediately after a policy is violated, regardless of the action that Network VirusWall Enforcer is set to take. Popup notifications can be set to display as a standard Windows message box or a balloon notification from the agent icon on the taskbar. Whether or not popup notifications display can be configured individually for each section of a policy. |
Administrators |
Email notifications are sent to inform administrators about quarantined endpoints. Email notifications are centrally enabled or disabled and apply to all policies. |
When a quarantined or blocked endpoint attempts to access a web page or other remote resources using a web browser, Network VirusWall Enforcer can display one of the following notifications on the web browser.
Notification |
Purpose |
User Login |
Prompts the endpoint user to specify domain credentials. |
Performing Endpoint Assessment |
Popup notifications are displayed at the endpoint immediately after a policy is violated, regardless of the action that Network VirusWall Enforcer is set to take. Popup notifications can be set to display as a standard Windows message box or a balloon notification from the agent icon on the taskbar. Whether or not popup notifications display can be configured individually for each section of a policy. |
Network Worm |
Indicates that the endpoint has been quarantined due to malicious code detected in its outgoing traffic. |
Outbreak Prevention Policy Started |
Indicates that the endpoint is being blocked due to a violation of the Outbreak Prevention Policy that has been deployed by Control Manager. |
No Antivirus Product Detected |
Indicates that the endpoint is being blocked because it does not have supported antivirus software. |
Registry Key Scan |
Indicates that the endpoint is being blocked because it does not have required registry entries or contains unwanted entries. |
Antivirus Product Has Outdated Pattern |
Indicates that the endpoint is being blocked because it has an outdated antivirus pattern. |
Vulnerability Detected |
Indicates that the endpoint is being blocked because it has unpatched software vulnerabilities. |
Threat Detected |
Indicates that the endpoint is being blocked because it has actively running malware. |
User Login Unsuccessful |
Informs the endpoint user that the attempt to log on to the domain has failed. |
Threat Mitigation |
Indicates that the endpoint is being blocked because of suspicious network activity detected by Threat Discovery Appliance. |
Manual Quarantine |
Indicates that the endpoint has been manually placed in quarantine by an administrator. |
Network VirusWall Enforcer can be configured to display the following popup notifications on the endpoint whenever a policy violation is detected.
Notification |
Purpose |
Antivirus Program Scan |
Indicates that the endpoint has violated policy by not having supported antivirus software. |
Antivirus Version Scan |
Indicates that the endpoint has violated policy by having an outdated antivirus pattern. |
System Threat Scan |
Indicates that active malware has been found on the endpoint. |
Vulnerability Scan |
Indicates that unpatched software vulnerabilities have been found on the endpoint. |
Registry Key Scan |
Indicates that the endpoint is missing required registry entries or contains unwanted entries. |
Network Virus Scan |
Indicates that malware code has been found in network traffic from the endpoint. |
Threat Mitigation |
Indicates that suspicious network activity by an application on the endpoint has been detected by Threat Discovery Appliance. |
ARP Spoofing Monitoring |
Indicates that ARP spoofing malware has been found on the endpoint. |
Network VirusWall Enforcer currently supports the following email notification:
Quarantined for TDA—indicates that an endpoint has been quarantined in response to suspicious activity detected by Threat Discovery Appliance.
Enabling or Disabling Notifications
Customizing Web and Popup Notification Content
Configuring Web Notification Settings
Configuring Popup Notification Settings