Enable firewall settings in the OfficeScan agent:

1. Log on to the OfficeScan web console > Administration > Settings > Product License and check the settings.

   

2. Make sure that the OfficeScan agent was able to apply the settings.

   

   

1. Log on to the OfficeScan agent and create an eicar test file using Notepad:

   Eicar String: X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

   In the screenshot below, the test file was dropped two (2) times with filename eicartest.txt and malwaretest.txt.

   

2. Verify the logs in the agent console by clicking the virus/malware in the notification window on the agent side.
    

   Wait until the virus logs are sent to the OfficeScan server.
3. Log on to the OfficeScan server and go to Logs > Agents > Security Risk.

   Security Risk Logs will open.

4. Verify the logs in the Virus/Malware column.

   

5. Log on to the TMCM console and go to Directories > Users/Endpoints > Endpoint.
6. In the Search box, select "Endpoint" then type the IP address of the target endpoint to isolate.

   In the screenshot below, the target IP address is 10.205.202.54.

    

   The OfficeScan XG server must be registered to the TMCM server.

   

7. Click the endpoint name in the console from Step 5.

   In this example, you have to click WIN10EECM and you will be redirected to the below page.

   

8. Open the Task dropdown in the uppermost part of the page and click ISOLATE.

   

   The notification "Isolation command has been sent. Waiting for the agent to be notified" will appear.

   

   The OfficeScan agent will receive a notification similar to below screenshots:

   Notification:

   

   Agent console status:

   

9. Click OK on the Endpoint Isolated window.

   

   The OfficeScan agent should now be isolated and ready for investigation. The isolated endpoint will still be shown as Online in the OfficeScan Agent Management console.

   

1. Log on to the console, then go to Directories > Users/Endpoints > Endpoint > Filters > Network Connection > Isolated.

   

2. Click the endpoint name from the result of step 1, then go to Task.

   It will show three (3) options:

   • Assign Tags
   • Restore
   • Modify Allowed Traffic

   

3. Go to Administration > Command Tracking and search for "Deploy Isolate/Restore".