1. Log on to the Apex One management web console.
2. Go to Agents > Agent Management.
3. Click Apex One domain from Apex One server lists.
4. Click Settings and select Predictive Machine Learning Settings.
5. Tick to Enable Predictive Machine Learning.

6. Under Detection Settings, enable the following:

   • File type set Action to Quarantine

   • Process type set Action to Terminate

     

7. Click Save to deploy changes.

1. Log on to the Apex One management web console.
2. Go to Agents > Agent Management.
3. Click Settings and go Web Reputation Settings.

4. On the Internal Agents tab, tick the checkbox for Enable Web Reputation on the following operating systems. Select the following;

   • Select Windows Desktop and Server platforms
   • Check HTTPS URLs

   • Send queries to Smart Protection Server

     

5. Click Apply to All Agents to deploy changes

1. Log on to the Apex One management web console.
2. Go to Agents > Agent Management.
3. Click Settings and go Behavior Monitoring Settings.

4. Tick the checkbox for Enable Malware Behavior Blocking and select Known and potential threats from the dropdown next to Threats to block.

   • Protect documents against unauthorized encryption or modification & automatically back up files changed by suspicious programs
   • Block processes commonly associated with ransomware
   • Enable program inspection to detect and block compromised executable files
   • Terminate programs that exhibit abnormal behavior associated with exploit attacks.

5. Under Newly Encountered Programs:

    

   This notification requires that administrators enable Real-time Scan and Web Reputation.

    
   • Tick the checkbox for Monitor newly encountered programs downloaded through HTTP or email applications.

   • Select Prompt user from the dropdown.

     

6. To enable Unauthorized Change Prevention Service on desktop and server platforms:

   1. Select the Apex One domain
   2. Click Settings and go to Additional Service Settings.
   3. Under Unauthorized Change Prevention service, tick to enable both Windows desktops and Windows Server platforms.

   4. Under Windows server platforms, tick to enable Only enable services required by Security Agent Self-protection features.

      

7. Click Save to deploy changes.

1. Log on to the Apex One management web console.
2. Go to Agents > Agent Management.
3. Click Apex one domain from Apex One server lists.
4. Click Settings and go to Additional Service Settings > Advance Protection Services.

5. Tick to enable Windows desktop and Windows Server platforms.

   

6. Click Save to deploy changes.

1. Log on to the Apex One management web console.
2. Go to Agents > Agent Management.
3. Click Apex one domain from Apex One server lists.
4. Click Settings and go to Additional Service Settings > Suspicious Connection Service.

5. Tick to enable Windows desktop and Windows Server platforms.

   

6. Click Save to deploy changes.
7. To go to Suspicious Connection Settings.
8. Click Apex one domain from Apex One server lists.
9. Click Settings and select Suspicious Connection Settings.

10. Tick the checkboxes for the following:

    • Detect network connections made to address in the Global C&C List. Select "block" from the dropdown and Log and allow access to User-defined Blocked IP list addresses.
    • Detect connections using malware network fingerprinting. Select block from the dropdown and Clean suspicious connections when C&C callback is detected.

      Image

    

1. Log on to the OfficeScan web console.
2. Go to Agents > Agent Management.
3. Click Settings and go to Web Reputation Settings.
4. On the Internal Agents tab, tick the checkbox for "Enable Web reputation policy on the following operating systems", and below it, select the following as well:
   • Check HTTPS URLs
   • Send queries to Smart Protection Server

   

5. Click Apply to All Agents to deploy changes.
6. To enable Web Reputation Service on server platform endpoints:
   1. Select the required OfficeScan agent installed on a Windows Server platform.
   2. Repeat steps 3 and 4.
    

   You must configure and deploy Web Reputation policies to OfficeScan agents running on Windows Server platforms one at a time.

    

   

7. Click Save to deploy changes.

Part I

1. Log on to the OfficeScan web console.
2. Go to Agents > Agent Management.
3. Click Settings and go to Behavior Monitoring Settings.
4. Tick the checkbox for Enable Malware Behavior Blocking and select “Known and potential threats” from the dropdown beside Threats to block.
5. Under Ransomware Protection, select the following checkboxes:
   • Protect documents against unauthorized encryption or modification, and under it, Automatically back up files changed by suspicious programs
   • Block processes commonly associated with ransomware
   • Enable program inspection to detect and block compromised executable files (Server platforms excluded)
6. To enable Unauthorized Change Prevention Service on server platform endpoints:
   1. Select the required OfficeScan agent installed on a Windows Server platform.
   2. Click Settings and go to Additional Service Settings.
   3. Tick "Enable service on the following operating systems".

      

   4. Repeat steps 3 to 5.

      

7. Click Saveto deploy changes.
    

   Behavior Monitoring does not support certain Windows platforms as the UI described.

    

Part II

1. Log on to the OfficeScan web console.
2. Go to Agents > Global Agent Settings > Behavior Monitoring Settings.
3. Tick the checkbox for "Monitor newly encounter programs downloaded through HTTP or email applications (Server platform excluded)".
    

   You must enable Web Reputation Services on the agent to allow OfficeScan to scan HTTP traffic.

    
4. Select "Prompt user before executing" from the dropdown.

   

1. Log on to the OfficeScan web console.
2. To enable Browser Exploit Solution on desktop platforms:
   1. Go to Agents > Agent Management.
   2. Click Settings.
   3. Go to Additional Services Settings > Advanced Protection Services.
   4. Tick the checkbox for "Enable service on the following operating systems".

      

   5. Click Apply to All Agents to deploy changes.
3. To enable Browser Exploit Solution on server platform endpoints:
   1. Go to Agent > Agent Management.
   2. Select the required OfficeScan agent installed on a Windows Server platform.
   3. Click Settings.
   4. Go to Additional Service Settings > Advanced Protection Services.
   5. Tick the checkbox for "Enable service on the following operating systems".

      

   6. Click Save to deploy changes.
4. Go to Agents > Agent Management.
5. Go to Settings > Web Reputation Settings.
6. Go to the Browser Exploit Prevention section and enable "Block pages containing malicious script".

   

7. Click Save to deploy changes.

1. Log on to the OfficeScan web console.
2. Go to Agents > Agent Management > Additional Service Settings.
3. Tick the checkboxes for “Enable Service on the following operation systems” under Suspicious Connection Service.

   

4. Go to Agents > Agent Management > Suspicious Connection Settings.
5. Tick the checkboxes for the following:
   • Log network connections made to address in the Global C&C List, and under it, Log and allow access to User-defined Blocked IP list addresses
   • Log connections using malware network fingerprinting, and under it, Clean suspicious connections when C&C callback is detected

   

6. Click Save.
7. To enable Suspicious Connection policies on Windows Server platforms:
   1. Select the required OfficeScan agent installed on a Windows Server platform.
   2. Repeat steps 3 to 5.

   

8. Click Save to deploy changes.

1. Log on to the OfficeScan web console.
2. Go to Agents > Agent Management.
3. Click Settings and go to Web Reputation Settings.
4. On the Internal Agentstab, tick the checkbox for "Enable Web reputation policy on the following operating systems". Select the following:
   • Check HTTPS URLs
   • Send queries to Smart Protection Server

   

5. Click Apply to All Agents to deploy changes.
6. To enable Web Reputation Service on server platform endpoints:
   1. Select the required OfficeScan agent installed on a Windows Server platform.
   2. Repeat steps 3 and 4.
    

   You must configure and deploy Web Reputation policies to OfficeScan agents running on Windows Server platforms one at a time.

    

   

7. Click Save to deploy changes.

1. 1. Log on to the OfficeScan web console.
   2. Go to Agents > Agent Management.
   3. Click Settings and go to Behavior Monitoring Settings.
   4. Tick the checkbox for Enable Malware Behavior Blocking and select “Known and potential threats” from the dropdown beside Threats to block.
   5. Under Ransomware Protection, select the following checkboxes:
      • Protect documents against unauthorized encryption or modification & Automatically back up files changed by suspicious programs
      • Block processes commonly associated with ransomware
      • Enable program inspection to detect and block compromised executable files
      • Terminate programs that exhibit abnormal behavior associated with exploit attacks
   6. Under Newly Encountered Programs:
      1. Tick the checkbox for “Monitor newly encountered programs downloaded through HTTP or email applications”.
      2. Select "Prompt user" from the dropdown.
       

      You must enable Web Reputation Services on the agent to allow OfficeScan to scan HTTP traffic.

       
   7. To enable Unauthorized Change Prevention Service on server platform endpoints:
      1. Select the required OfficeScan agent installed on a Windows Server platform.
      2. Click Settings and go to Additional Service Settings.
      3. Tick "Enable service on the following operating systems".

         

      4. Repeat steps 3 to 6.

         

   8. Click Save to deploy changes.

1. Log on to the OfficeScan web console.
2. To enable Browser Exploit Solution on desktop platforms:
   1. Go to Agents > Agent Management.
   2. Click Settings.
   3. Go to Additional Services Settings > Advanced Protection Services.
   4. Tick the checkbox for "Enable service on the following operating systems".

      

   5. Click Apply to All Agents to deploy changes.
3. To enable Browser Exploit Solution on server platform endpoints:
   1. Go to Agent > Agent Management.
   2. Select the required OfficeScan agent installed on a Windows Server platform.
   3. Click Settings.
   4. Go to Additional Service Settings > Advanced Protection Services.
   5. Tick the checkbox for "Enable service on the following operating systems".

      

   6. Click Save to deploy changes.
4. Go to Agents > Agent Management.
5. Go to Settings > Web Reputation Settings.
6. Go to the Browser Exploit Prevention section and enable "Block pages containing malicious script".

   

7. Click Save to deploy changes.

1. Log on to the OfficeScan web console.
2. Go to Agents > Agent Management > Additional Service Settings.
3. Tick the checkbox “Enable Service on the following operation systems” under Suspicious Connection Service.

   

4. Click Apply to All Agents to deploy changes.
5. Go to Agents > Agent Management > Suspicious Connection Settings.
6. Tick the checkboxes for the following:
   1. "Detect network connections made to address in the Global C&C List". Select "block" from the dropdown and "Log and allow access to User-defined Blocked IP list addresses".
   2. "Detect connections using malware network fingerprinting". Select "block" from the dropdown and "Clean suspicious connections when C&C callback is detected".

   

7. Click Apply to All Agents to deploy changes.
8. To enable Suspicious Connection policies on Windows Server platforms:
   1. Select the required OfficeScan agent installed on a Windows Server platform.
   2. Repeat steps 3 to 5.

   

9. Click Save to deploy changes.