This feature is available in Deep Security 9.5 Service Pack 1 and higher versions, but it is hidden by default. To show it on the console, follow this article: Displaying Anti-Malware Email Plug-in on the Deep Security Manager (DSM) console.
If multiple DSMs are installed and connected to the same database (multi-node manager feature), install the plug-in on one of the manager nodes only.
To install the plug-in:
- Download the Anti-Malware Email Notifications Plug-in.
- Save the JAR file in the plug-ins directory under the installation directory. This is C:\Program Files\Trend Micro\Deep Security Manager\plugins by default.
Create a plugins directory if it is not present. - Restart the Trend Micro Deep Security Manager service using the Services MMC, or via the command line using this command: net stop "Trend Micro Deep Security Manager"
net start "Trend Micro Deep Security Manager"
After installing the plug-in, a new Events & Reports page will appear in the DSM console:
If user uses the above procedure to enable Anti-Malware Email Notifications Plug-in on the DSM, and then upgrade the DSM from version 9.0 or 9.5 to 9.5 SP1 or 9.6, below issue may occur causing failure to start the DSM service.
==========
Jun 24, 2015 6:02:37 PM org.apache.catalina.core.ContainerBase startInternal
SEVERE: A child container failed during start
java.util.concurrent.ExecutionException: org.apache.catalina.LifecycleException: Failed to start component [StandardEngine[Tomcat].StandardHost[localhost]]
at java.util.concurrent.FutureTask.report(FutureTask.java:122)
at java.util.concurrent.FutureTask.get(FutureTask.java:192)
at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:917)
at org.apache.catalina.core.StandardEngine.startInternal(StandardEngine.java:262)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
at org.apache.catalina.core.StandardService.startInternal(StandardService.java:439)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
at org.apache.catalina.core.StandardServer.startInternal(StandardServer.java:760)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
at org.apache.catalina.startup.Tomcat.start(Tomcat.java:339)
at com.thirdbrigade.manager.service.Tomcat.startTomcat(Tomcat.java:106)
at com.thirdbrigade.manager.service.DSMService$WorkerThread.run(DSMService.java:226)
Caused by: org.apache.catalina.LifecycleException: Failed to start component [StandardEngine[Tomcat].StandardHost[localhost]]
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:154)
at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1409)
at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1399)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
Caused by: org.apache.catalina.LifecycleException: A child container failed during start
at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:925)
at org.apache.catalina.core.StandardHost.startInternal(StandardHost.java:868)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
... 6 more
===========
As a workaround solution, do any of the following:
- Follow the uninstallation procedure in this KB before upgrading the DSM from version 9.0 or 9.5 to 9.5 SP1 or 9.6.
- Manually remove the plug-in “plugin-com.trendmicro.ds.antimalwareemailalertplugin-1.x.x.jar” form the following DSM folders:
- C:\<DSM Installer Folder>\plugins
- C:\<DSM Installer Folder>\webclient\webapps\ROOT\WEB-INF\lib
To uninstall the plug-in:
- Log in to the DSM console.
- Go to Administration > System Settings.
- Go to the Advanced tab and click the View Pluggable button.
- Select Trend Micro Inc. Anti-Malware Email Notification Plug-in and click Uninstall.
Enter a valid SMTP configuration under the System tab of the Systems Settings page. Once SMTP configuration is finished, you can configure the Anti-Malware Email Notifications Plug-in on the Events & Reports page.
The following settings are available:
- Anti-Malware Email Notifications Enabled controls whether or not email notifications will be sent for anti-malware events. Emails are sent only for events that occur after the feature is enabled.
- Email Recipients is the list of email addresses that will receive the notification emails. At least one recipient is required.
- Email Subject Text is the text that will appear in the email subject line.
- Email Template is the template that will be used to format the body of the email message. The template is a mix of plain text and variables. Details of the malware event are inserted in the template using specially named variables enclosed in brackets. The full list of available variables is shown on the web page.