Configuring Global Behavior Monitoring Settings Parent topic

OfficeScan applies global client settings to all clients or only to clients with certain privileges.

Procedure

  1. Navigate to Networked Computers → Global Client Settings.
  2. Go to the Behavior Monitoring Settings section.
  3. Configure the following settings as required:
    Option
    Description
    Automatically allow program if client does not respond within __ seconds
    This setting only works if Event Monitoring is enabled and the action for a monitored system event is "Ask when necessary". This action prompts a user to allow or deny programs associated with the event. If the user does not respond within a certain time period, OfficeScan automatically allows the program to run. For details, see Event Monitoring.
    Enable Certified Safe Software Service
    The Certified Safe Software Service queries Trend Micro datacenters to verify the safety of a program detected by either Malware Behavior Blocking or Event Monitoring. Enable Certified Safe Software Service to reduce the likelihood of false positive detections.
    Note
    Note
    Ensure that OfficeScan clients have the correct proxy settings (for details, see OfficeScan Client Proxy Settings) before enabling Certified Safe Software Service. Incorrect proxy settings, along with an intermittent Internet connection, can result in delays or failure to receive a response from Trend Micro datacenters, causing monitored programs to appear unresponsive.
    In addition, pure IPv6 OfficeScan clients cannot query directly from Trend Micro datacenters. A dual-stack proxy server that can convert IP addresses, such as DeleGate, is required to allow the OfficeScan clients to connect to the Trend Micro datacenters.
    Prompt users before executing newly encountered programs downloaded through HTTP or email applications (Server platforms excluded)
    Behavior Monitoring works in conjunction with Web Reputation Services to verify the prevalence of files downloaded through HTTP channels or email applications. After detecting a "newly encountered" file, administrators can choose to prompt users before executing the file. Trend Micro classifies a program as newly encountered based on the number of file detections or historical age of the file as determined by the Smart Protection Network.
    Note
    Note
    • Administrators must enable Web Reputation Services on the client to allow OfficeScan to scan HTTP traffic before this prompt can display.
    • For Windows 7/Vista/XP systems, this prompt only supports ports 80, 81, and 8080.
    • OfficeScan matches the file names downloaded through email applications during the execution process. If the file name has been changed, the user does not receive a prompt.
  4. Click Save.