Configuring endpoint detection mode

Procedure

1. Configure your Standard Endpoint Protection Manager.
   1. In the Trend Vision One console, go to Endpoint Security → Standard Endpoint Protection.
      If you have more than one Standard Endpoint Protection instance provisioned, navigate to the instance you want to configure.
   2. Go to Policies → Policy Management and edit the policy assigned to the endpoints you wish to use to enable aggressive mode.

      Tip You can also create a new policy for this task. Ensure you assign the target endpoints to the task before enabling aggressive mode.

   3. In the policy details screen, go to Anti-Malware Scans → Real-time Scan.
   4. On the Target tab, select Quarantine malware variants detected in memory.
   5. On the Action tab, under Virus/Malware, select Use ActiveAction.

      Important Do not select Customize action for probably virus/malware.

   6. Go to Advanced Threat Protection → Suspicious Connection.
   7. Configure the actions based on which action you plan to configure for aggressive mode.
      • Detect network connections made to addresses in the Global C&C IP list
      • Detect connections using malware network fingerprinting

      Configure one of the following actions:

      • If you want to set aggressive mode to use the prevention action, select Block for both.
      • If you want to set aggressive mode to use the log only action, select Log only for both.

      Important For aggressive mode, Trend Micro highly recommends you leave the following setting enabled: Clean suspicious connections when a C&C callback is detected

   8. Click Deploy to save the settings.
2. Configure your Server & Workload Protection Manager.
   1. In the Trend Vision One console, go to Endpoint Security → Server & Workload Protection.
      If you have more than one Server & Workload Protection instance provisioned, navigate to the instance you want to configure.
   2. Go to Policies, select the policy you want to edit and click Details...

      Tip You can also create a new policy for this task. Ensure you assign the target endpoints to the task before enabling aggressive mode.

   3. In the policy details screen, go to Anti-Malware.
   4. Under Real-Time Scan, locate Malware Scan Configuration and click Edit.
   5. In the screen that appears, go to General.
   6. Under Behavior Monitoring, select Enable Behavior Monitoring.
   7. For Action to take, select ActiveAction (recommended).
   8. Under Windows Antimalware Scan Interface (AMSI), select Enable AMSI protection.
   9. For Action to take, select Terminate (recommended).
   10. Under Process Memory Scan, select Scan process memory for malware
   11. For Action to take, select ActiveAction (recommended).
   12. Go to Advanced.
   13. Under Remediation Actions, select Use recommended defaults.
   14. Click OK.
   15. In the policy details screen, click Save.
3. In the Trend Vision One console, go to Endpoint Security → Endpoint Inventory.
4. Locate and select the endpoints you want to configure.
5. Click Detection Mode.
6. Select Aggressive mode.
7. Select the action to take.
   • Prevention: The agent takes the default ActiveAction for the detected malware type.
     For more information on ActiveActions, see ActiveActions default actions.
   • Log only: The agent only logs the detection and takes no action.
8. Click Next.
9. Review the Selected Endpoints.
   Click the remove icon () to remove a selected endpoint from the list.
10. Click Apply.
    The selected endpoints apply the monitoring level the next time they connect to Trend Vision One.