Views:
WARNING
WARNING
Do not enable Auto apply core Endpoint & Workload rules when using classic recommendation scan.
During a classic recommendation scan, agents scan the following:
  • Installed applications
  • Windows registry
  • Open ports
  • Directory listing
  • File system
  • Running processes and services
  • Environment variables
  • Users

Scan limitations

Technical and logical limitations can cause inaccurate or missing recommendations for some types of software.
  • Classic recommendation scans do not include the following:
    • Web application protection rules.
    • On Windows systems, OpenSSL rules which an application uses internally. The scanner can only make recommendations for OpenSSL if you explicitly install it.
  • The scanner may recommend unnecessary rules for the following technologies:
    • Red Hat JBoss
    • Eclipse Jetty
    • Apache Struts
    • Oracle WebLogic
    • WebSphere
    • Oracle Application Testing Suite
    • Oracle Golden Gate
    • Nginx
    • Adobe Flash Player plug-in for Chrome - Recommendations are based on the Chrome version.
    • A content management system (CMS) and any CMS plugins - For a web server with PHP, the scan recommends all intrusion prevention rules related to the CMS.
  • On Linux systems:
    • If web browsers are the only applicable vector for Java-related vulnerabilities, the scanner does not recommend such rules.
  • On Unix or Linux systems:
    • The classic recommendation scan engine might have trouble detecting software that is not installed through the operating system's default package manager. Applications installed using standard package managers do not have this problem.
    • Recommendations do not include rules for desktop application vulnerabilities or local vulnerabilities. For example, browsers and media players.
Related information

Run a classic recommendation scan

Run recommendation scans on a regular basis (the best practice is weekly) because any change to your environment can affect rule recommendations. Ideally, schedule recommendation scans soon after Trend Micro releases new intrusion prevention rules each Tuesday. The use of system resources, including central processing unit (CPU) cycles, memory, and network bandwidth, increases during a classic recommendation scan, so schedule the scans at non-peak times. After running a recommendation scan, alerts appear on all computers that have recommendations.
You need a Workload Security license to run recommendation scans.
You can run recommendation scans using any of the following methods:

Procedure

  • Create a scheduled task that runs recommendation scans according to a schedule that you configure. You can assign the scheduled task to all computers, one individual computer, a defined computer group, or all computers protected by a particular policy.
    Scheduled tasks and ongoing scans can run classic recommendation scans independently with their own settings. Use either the scheduled tasks or ongoing scans, but not both.
  • Configure an ongoing scan policy to scan a group of computers for recommendations on a regular basis. You can also configure ongoing scans for individual computers. This type of scan checks the time that the last scan occurred and waits a configured interval to scan. This results in recommendation scans occurring at different times in your environment. Ongoing scans are helpful in environments where an agent might be online for short or intermittent periods. For example, cloud environments that build and decommission instances frequently.
  • Manually run a single recommendation scan on one or more computers. A manual scan is useful if you recently made significant platform or application changes and want to force a check for new recommendations instead of waiting for a scheduled task.
  • Use the Workload Security command-line interface (CLI) to initiate a classic recommendation scan. See Command-line utilities.
  • Use the Workload Security application programming interface (API) to initiate a classic recommendation scan. See API and SDK - DevOps tools for automation.
The results of the latest recommendation scan appear on the General tab of the Intrusion Prevention, Integrity Monitoring, or Log Inspection protection module.

Manually run a classic recommendation scan

Procedure

  1. On the Workload Security console, go to Computers.
  2. Select the computers you want to scan.
  3. Click Actions → Scan for Recommendations.
The results of the latest recommendation scan appear on the General tab of the Intrusion Prevention, Integrity Monitoring, or Log Inspection protection module.

Cancel a classic recommendation scan

You can cancel a classic recommendation scan before it starts running.

Procedure

  1. On the Workload Security console, go to Computers.
  2. Select the computers where you want to cancel the scans.
  3. Click Actions → Cancel Recommendation Scan.

Troubleshooting classic recommendation scan

The following information can help you troubleshoot classic recommendation scans: