Configuring the "Shared Folder Session Outbreak Detected" notification in OfficeScan (OSCE)

There are malwares or viruses that propagate through shared folders. OfficeScan can send a notification if there is an unusual increase in network share sessions within a defined length of time as this indicates a possible infection or outbreak. To enable this notification:

1. Log on to the OfficeScan management console
2. For OfficeScan 11.0/XG, go to Administration > Notifications > Outbreak > Shared Folder Sessions.
   For OfficeScan 10.6 and below, go to Notifications > Administrator Notifications > Outbreak Notifications > Shared Folder Sessions.
3. You can set the following criteria:

   Shared Folder Sessions: 100 (default)
   Time period: 3 minutes (default)

    

   The value in the example above means that if Shared Folder Sessions exceeds 100 in 3 minutes, a notification will be sent out. If normal network operations exceed 100 Shared Folder Sessions at a single time, increase the value to a more appropriate number.

When enabled, the OfficeScan client monitors the shared folder sessions every 10 seconds, and then reports the number of new connections back to the OfficeScan server.