Trend Micro Apex Central
as a Service

TM

Administrator's Guide
Widget and Policy Management Guide
Centralized Security Management for Endpoints

Trend Micro Incorporated reserves the right to make changes to thisdocument and to the product described herein without notice. Before
installing and using the product, review the readme files, release notes,
and/or the latest version of the applicable documentation, which areavailable from the Trend Micro website at:
http://docs.trendmicro.com/en-us/enterprise/apex-one-as-a-service.aspx
Trend Micro, the Trend Micro t-ball logo, Trend Micro Apex Central,
Trend Micro Apex One, Control Manager, and OfficeScan are trademarks
or registered trademarks of Trend Micro Incorporated. All other productor company names may be trademarks or registered trademarks of theirowners.
Copyright © 2023. Trend Micro Incorporated. All rights reserved.
Document Part No.: APEM09828/230905
Release Date: September 2023
Protected by U.S. Patent No.: 5,623,600; 5,889,943; 5,951,698; 6,119,165

This documentation introduces the main features of the product and/or
provides installation instructions for a production environment. Readthrough the documentation before installing or using the product.
Detailed information about how to use specific features within the productmay be available at the Trend Micro Online Help Center and/or the Trend
Micro Knowledge Base.

Table of Contents
Preface
Preface ................................................................................. 1
Documentation ..................................................................... 2
Audience .............................................................................. 2
Document Conventions ......................................................... 3
Terminology ......................................................................... 4

Part I: Introduction
Chapter 1: The Dashboard
About the Dashboard .......................................................... 1-2
Tabs and Widgets ................................................................ 1-2
Working with Tabs ........................................................ 1-2
Working with Widgets ................................................... 1-4
Summary Tab ..................................................................... 1-6
Critical Threats Widget ................................................. 1-6
Users with Threats Widget ............................................. 1-9
Endpoints with Threats Widget .................................... 1-10
Product Component Status Widget ............................... 1-11
Product Connection Status Widget ............................... 1-13
Ransomware Prevention Widget .................................. 1-14
Threat Investigation Tab .................................................... 1-15
Critical Threats Widget ................................................ 1-15
Security Posture Tab ......................................................... 1-18
Compliance Indicators ................................................ 1-19
Critical Threats ........................................................... 1-20
Resolved Events .......................................................... 1-21
Security Posture Chart ................................................. 1-21
Security Posture Details Pane ...................................... 1-22iTrend Micro Apex Central™ as a Service Widget and Policy Management Guide

Data Loss Prevention Tab .................................................. 1-25
DLP Incidents by Severity and Status Widget ................. 1-26
DLP Incident Trends by User Widget ............................ 1-27
DLP Incidents by User Widget ...................................... 1-28
DLP Incidents by Channel Widget ................................ 1-29
DLP Template Matches Widget ..................................... 1-30
Top DLP Incident Sources Widget ................................. 1-31
DLP Violated Policy Widget .......................................... 1-31
Compliance Tab ................................................................ 1-32
Product Application Compliance Widget ....................... 1-32
Product Component Status Widget ............................... 1-33
Product Connection Status Widget ............................... 1-35
Agent Connection Status Widget .................................. 1-36
Threat Statistics Tab .......................................................... 1-37
Apex Central Top Threats Widget ................................. 1-37
Apex Central Threat Statistics Widget ........................... 1-38
Threat Detection Results Widget .................................. 1-40
Policy Violation Detections Widget ............................... 1-42
C&C Callback Events Widget ........................................ 1-42

Chapter 2: Policy Management
Policy Management ............................................................ 2-2
Creating a New Policy ................................................... 2-2
Filtering by Criteria ................................................ 2-5
Assigning Endpoints to Filtered Policies ............. 2-7
Specifying Policy Targets ......................................... 2-9
Working with Parent Policy Settings ....................... 2-10
Copying Policy Settings ............................................... 2-13
Inheriting Policy Settings ............................................ 2-14
Modifying a Policy ...................................................... 2-16
Importing and Exporting Policies ................................. 2-18
Deleting a Policy ......................................................... 2-19
Changing the Policy Owner ......................................... 2-20
Understanding the Policy List ...................................... 2-21
Reordering the Policy List ........................................... 2-24
ii

Table of Contents

Policy Status ..................................................................... 2-25

Chapter 3: Policy Resources
Application Control Criteria ................................................ 3-2
Defining Allowed Application Criteria ............................ 3-4
Defining Blocked Application Criteria ............................ 3-6
Application Match Methods ........................................... 3-8
Application Reputation List ..................................... 3-8
File Paths ............................................................... 3-9
File Path Example Usage .................................. 3-11
Certificates ........................................................... 3-13
Hash Values .......................................................... 3-14
Data Loss Prevention ......................................................... 3-15
Data Identifier Types ................................................... 3-16
Expressions .......................................................... 3-17
Predefined Expressions ................................... 3-17
Viewing Settings for Predefined Expressions ....
3-17
Customized Expressions .................................. 3-18
Criteria for custom expressions ................. 3-18
Creating a Customized Expression ............. 3-20
Importing Customized Expressions ............ 3-21
File Attributes ....................................................... 3-22
Creating a File Attribute List ............................ 3-22
Importing a File Attribute List ......................... 3-23
Keywords ............................................................. 3-24
Predefined Keyword Lists ................................ 3-24
How keyword lists work .................................. 3-25
Number of keywords condition .................. 3-25
Distance condition .................................... 3-25
Custom keyword lists ...................................... 3-26
Custom keyword list criteria ...................... 3-26
Creating a Keyword List ............................. 3-27
Importing a Keyword List .......................... 3-29
Data Loss Prevention Templates ................................... 3-29
Predefined DLP Templates ..................................... 3-30
iii

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Custom DLP templates .......................................... 3-30
Condition statements and logical pperators ...... 3-31
Creating a Template ........................................ 3-32
Importing Templates ....................................... 3-33
Intrusion Prevention Rules ................................................ 3-34
Intrusion Prevention Rule Properties ........................... 3-36
Device Control Allowed Devices ......................................... 3-38

Part II: Apex Central Widgets
Chapter 4: Apex Central Dashboard Widgets
Apex Central Top File-based Threats Widgets ....................... 4-2
Endpoint Protection Verification Widget .............................. 4-2
Hosts with C&C Callback Attempts Widget ........................... 4-4
Policy Status ....................................................................... 4-4
Quick Launch ..................................................................... 4-5
Unique Compromised Hosts Over Time Widget .................... 4-6

Part III: Apex One Widgets
Chapter 5: Apex One Dashboard Widgets
Top Blocked Applications .................................................... 5-2
Top Endpoints Affected by IPS Events Widget ....................... 5-2
Top IPS Attack Sources ........................................................ 5-2
Top IPS Events .................................................................... 5-3
Top Violated Application Control Criteria ............................. 5-3

Part IV: Apex One Security Agent Policies

iv

Table of Contents

Chapter 6: Security Agent Program Settings
Additional Service Settings .................................................. 6-2
Configuring Additional Security Agent Services .............. 6-2
Privileges and Other Settings ............................................... 6-4
Configuring Agent Privileges ......................................... 6-4
Configuring Other Agent Settings .................................. 6-9
Cache Settings for Scans ........................................ 6-12
Digital Signature Cache ................................... 6-12
On-demand Scan Cache ................................... 6-13
POP3 Mail Scan ..................................................... 6-15
Update Agents .................................................................. 6-16
Assigning Security Agents as Update Agents ................. 6-16

Chapter 7: Application Control Policy Settings
Application Control ............................................................ 7-2
Configuring Application Control Settings (Agent) ............ 7-2

Chapter 8: Behavior Monitoring Policy Settings
Behavior Monitoring ........................................................... 8-2
Malware Behavior Blocking ........................................... 8-2
Ransomware Protection .......................................... 8-2
Anti-Exploit Protection ............................................ 8-5
Newly Encountered Program Protection ......................... 8-5
Event Monitoring .......................................................... 8-6
Behavior Monitoring Exception List ............................... 8-9
Exception List Wildcard Support ............................ 8-10
Exception List Environment Variable Support ......... 8-14
Configuring Behavior Monitoring Rules and Exceptions ...... 8-15

Chapter 9: Anti-malware Policy Settings
Scan Method Types ............................................................. 9-2
Guidelines for Switching Scan Methods .......................... 9-2v

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Manual Scan ....................................................................... 9-4
Configuring Manual Scan Settings ................................. 9-4
Manual Scan: Target Tab ......................................... 9-4
Manual Scan: Action Tab ......................................... 9-7
Manual Scan: Scan Exclusion Tab ........................... 9-10
Real-time Scan .................................................................. 9-13
Configuring Real-time Scan Settings ............................. 9-13
Real-time Scan: Target Tab .................................... 9-14
Real-time Scan: Action Tab .................................... 9-18
Real-time Scan: Scan Exclusion Tab ....................... 9-21
Scan Now ......................................................................... 9-23
Configuring Scan Now Settings .................................... 9-23
Scan Now: Target Tab ............................................ 9-24
Scan Now: Action Tab ............................................ 9-27
Scan Now: Scan Exclusion Tab ............................... 9-30
Scheduled Scan ................................................................. 9-33
Configuring Scheduled Scan Settings ............................ 9-33
Scheduled Scan: Target Tab ................................... 9-34
Scheduled Scan: Action Tab ................................... 9-39
Scheduled Scan: Scan Exclusion Tab ...................... 9-42
Scan Actions ..................................................................... 9-44
ActiveAction ............................................................... 9-45
Custom Scan Actions ................................................... 9-46
Quarantine Directory ............................................ 9-47
Uncleanable Files ........................................................ 9-49
Files Infected with Trojans .................................... 9-51
Files Infected with Worms ..................................... 9-52
Write-protected Infected Files ............................... 9-52
Password-protected Files ....................................... 9-52
Backup Files ......................................................... 9-52
Scan Exclusion Support ..................................................... 9-52
Trend Micro Product Directory Exclusions ................... 9-53
Wildcard Exceptions ................................................... 9-53
vi

Table of Contents

Chapter 10: Web Reputation Policy Settings
Web Reputation ................................................................ 10-2
Configuring a Web Reputation Policy ................................. 10-2
HTTPS URL Scan Support ............................................ 10-6

Chapter 11: Unknown Threat Protection
Predictive Machine Learning ............................................. 11-2
Configuring Predictive Machine Learning Settings ........ 11-3
Configuring Sample Submission Settings ............................ 11-5
Configuring Suspicious Connection Settings ....................... 11-6

Chapter 12: Device Control Policy Settings
Device Control .................................................................. 12-2
Configuring Device Control Settings ................................... 12-2
Permissions for Devices .............................................. 12-5
Wildcard Support for the Device Control Allowed Programs
List ............................................................................ 12-7
Specifying a Digital Signature Provider ......................... 12-8

Chapter 13: Scan Exclusion Lists
Spyware/Grayware Approved List ...................................... 13-2
Managing the Spyware/Grayware Approved List ........... 13-2
Rule Exceptions ................................................................ 13-2
Configuring Rule Exceptions ....................................... 13-3
Trusted Program List ......................................................... 13-3
Configuring the Trusted Programs List ......................... 13-4

Chapter 14: Endpoint Sensor Policy Settings
Endpoint Sensor ............................................................... 14-2
Configuring Endpoint Sensor Settings ................................ 14-2
vii

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Chapter 15: Vulnerability Protection Policy Settings
Vulnerability Protection .................................................... 15-2
Configuring Vulnerability Protection Settings ..................... 15-2
Advanced Logging Policy Modes .................................. 15-6

Part V: Apex One Server Policies
Chapter 16: Apex One Server Policy Settings
Global Agent Settings ........................................................ 16-2
Security Settings ......................................................... 16-2
System Settings ........................................................... 16-6
Root Certificate Locations ..................................... 16-9
Network Settings ....................................................... 16-10
Agent Control Settings ............................................... 16-12

Part VI: Apex One Data Loss Prevention Policies
Chapter 17: Apex One Data Loss Prevention Policy Settings
Data Loss Prevention (DLP) ............................................... 17-2
Configuring a Data Loss Prevention Policy .......................... 17-3
Configuring Data Loss Prevention Rules ....................... 17-4
Transmission Scope and Targets for Network Channels............................................................................. 17-6
Network Channels ................................................ 17-6
Email Clients .................................................. 17-7
System and Application Channels .......................... 17-9
Device List Tool .................................................... 17-9
Running the Device List Tool ........................... 17-9
Data Loss Prevention Actions ............................... 17-10
Data Loss Prevention Exceptions ................................ 17-12
Defining Non-monitored and Monitored Targets ... 17-13
Transmission Scope: All Transmissions .......... 17-14
viii

Table of Contents

Transmission Scope: Only Transmissions Outside
the Local Area Network ................................. 17-15
Decompression Rules .......................................... 17-16

Chapter 18: Apex One Data Discovery Dashboard Widgets
Top Sensitive File Policy Detections Widget ........................ 18-2
Top Endpoints with Sensitive Files Widget .......................... 18-3
Top Data Discovery Template Matches Widget .................... 18-5
Top Sensitive Files Widget ................................................. 18-6

Chapter 19: Apex One Data Discovery Policy Settings
Creating Data Discovery Policies ........................................ 19-2

Part VII: Apex One (Mac) Widgets and Policies
Chapter 20: Apex One (Mac) Dashboard Widgets
Key Performance Indicators Widget ................................... 20-2
Configuring Key Performance Indicators ...................... 20-2
Configuring Widget Settings ........................................ 20-3

Chapter 21: Apex One (Mac) Policy Settings
Scan Method Types ........................................................... 21-2
Scan Methods Compared ............................................. 21-2
Switching from Smart Scan to Conventional Scan ......... 21-3
Switching from Conventional Scan to Smart Scan ......... 21-4
Scan Types ....................................................................... 21-6
Real-time Scan ............................................................ 21-7
Configuring Real-time Scan Settings ....................... 21-7
Real-time Scan: Target Tab .............................. 21-8
Real-time Scan: Action Tab .............................. 21-8
Supported Compressed File Types ................... 21-9
Scan Actions ................................................. 21-10
ix

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Manual Scan ............................................................. 21-12
Configuring Manual Scan Settings ........................ 21-12
Manual Scan: Target Tab ................................ 21-12
Manual Scan: Action Tab ............................... 21-14
Supported Compressed File Types .................. 21-14
Scan Actions ................................................. 21-15
Scheduled Scan ......................................................... 21-17
Configuring Scheduled Scan Settings .................... 21-17
Scheduled Scan: Target Tab ............................ 21-17
Scheduled Scan: Action Tab ........................... 21-19
Supported Compressed File Types .................. 21-21
Scan Actions ................................................. 21-22
Cache Settings for Scans .................................................. 21-23
Scan Exclusions ............................................................... 21-24
Configuring Scan Exclusion Lists ................................ 21-25
Update Settings ............................................................... 21-28
Pure IPv6 Agent Limitations ....................................... 21-30
Configuring Agent Update Settings ............................. 21-30
Web Reputation ............................................................... 21-31
Configuring Web Reputation Settings ......................... 21-32
Configuring the Approved and Blocked URL Lists ........ 21-34
Device Control ................................................................ 21-35
Configuring Device Control Settings ........................... 21-35
Permissions for Storage Devices ................................. 21-36
Endpoint Sensor .............................................................. 21-37
Configuring Endpoint Sensor Settings ........................ 21-38
Trusted Program List ....................................................... 21-38
Configuring the Trusted Program List ......................... 21-39
Predictive Machine Learning Settings ............................... 21-39
Privileges and Other Settings ........................................... 21-39
Protected Security Agent Files .................................... 21-40

Index
x

Table of Contents

Index ............................................................................... IN-1

xi

xii

Preface

Preface
Welcome to the Trend Micro Apex Central™ as a Service Widget and Policy
Management Guide. This document explains how to configure Dashboard
widgets and Policy Management settings on Apex Central.
Topics in this section:

1Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Documentation
Trend Micro Apex Central documentation includes the following:
Document

Description

Readme file

Contains a list of known issues and may also contain late-breaking
product information not found in the Online Help or printed
documentation

Administrator's Guide

A PDF document that provides detailed instructions of how to
configure and manage Trend Micro Apex Central and managed
products, and explanations on Trend Micro Apex Central concepts andfeatures

Online Help

HTML files compiled in WebHelp format that provide "how to's", usage
advice, and field-specific information. The Help is also accessible fromthe Trend Micro Apex Central console

Widget and Policy
Management Guide

Contains information that explains how to configure dashboard
widgets and policy management settings in Trend Micro Apex Central
To access this guide, go
to https://docs.trendmicro.com/en-us/enterprise/apex-central-as-aservice-widget-and-policy-management-guide/preface-wpg-.aspx.

Automation Center

Online user guides and references that explain how to
use the Trend Micro Apex Central Automation APIs: https://
automation.trendmicro.com/apex-central/home

Data Protection Lists(Chapter 1 only)

A PDF document that lists predefined data identifiers and templates
for Data Loss Prevention

Knowledge BaseAn online database of problem-solving and troubleshooting
information. It provides the latest information about known productissues. To access the Knowledge Base, go to the following website:
http://success.trendmicro.com

Download the latest version of the PDF documents and readme at:
http://docs.trendmicro.com/en-us/enterprise/apex-one-as-a-service.aspx

Audience
Apex Central documentation is intended for the following users:2

Preface• Apex Central Administrators: Responsible for Apex Central installation,
configuration, and management. These users are expected to haveadvanced networking and server management knowledge.
• Managed Product Administrators: Users who manage Trend Micro
products that integrate with Apex Central. These users are expected tohave advanced networking and server management knowledge.

Document Conventions
The documentation uses the following conventions.
Table 1. Document Conventions
Convention

Description

UPPER CASE

Acronyms, abbreviations, and names of certain commands
and keys on the keyboard

Bold

Menus and menu commands, command buttons, tabs, andoptions

Italics

References to other documents

Monospace

Sample command lines, program code, web URLs, file names,and program output

Navigation > Path

The navigation path to reach a particular screen
For example, File > Save means, click File and then click
Save on the interface

Note

Tip

ImportantConfiguration notes

Recommendations or suggestions

Information regarding required or default configuration
settings and product limitations

3

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Convention
WARNING!

Description
Critical actions and configuration options

Terminology
The following table provides the official terminology used throughout theApex Central documentation:
Terminology

Description

Administrator (or Apex Central
administrator)

The person managing the Apex Central server

Security Agent

The managed product program installed on an endpoint

Components

Responsible for scanning, detecting, and taking actions
against security risks

Apex Central console, web
console, or management
consoleThe web-based user interface for accessing, configuring, andmanaging a Apex Central
Note
Consoles for integrated managed products areindicated by the managed product name. For
example, the Apex One web console.

4

Managed endpoint

The endpoint where the managed product Security Agent isinstalled

Managed productA Trend Micro product that integrates with Apex Central

Managed server

The endpoint where the managed product is installed

Server

The endpoint where the Apex Central server is installed

Security risk

The collective term for virus/malware, spyware/grayware,and web threatsPreface

Terminology

Description

Dual-stack

Entities that have both IPv4 and IPv6 addresses

Pure IPv4

An entity that only has an IPv4 address

Pure IPv6

An entity that only has an IPv6 address

5Part I
Introduction

Chapter 1

The Dashboard
This section discusses how to use the Apex Central as a Service dashboard
tabs and widgets.
Topics include:

1-1Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

About the Dashboard
The Dashboard appears when you open the Apex Central as a Service web
console or click Dashboard on the main menu. Each Apex Central as aService user account has a completely independent dashboard. Any changes
to the dashboard belonging to a specific user account will not affect the
dashboards of the other user accounts.
The Dashboard contains the following:• Tabs• Widgets

Tabs and Widgets
Widgets are the core components of the Dashboard. Widgets provide specificinformation about various security-related events.
The information that widgets display comes from:• Trend Micro Apex Central database• Registered managed products• Trend Micro Smart Protection Network
Tabs provide a container for widgets. The Dashboard supports up to 30 tabs.

Working with Tabs
Manage tabs by adding, renaming, changing the layout, deleting, andautomatically switching between tab views.
Procedure
1.

Go to the Dashboard.

2.

To add a tab:a.

1-2

Click the add icon ().

The Dashboard

b.
3.

4.

5.

6.

Type a name for the new tab.

To rename a tab:a.

Hover over the tab name and click the down arrow.

b.

Click Rename and type the new tab name.

To change the layout of the widgets for a tab:a.

Hover over the tab name and click the down arrow.

b.

Click Change Layout.

c.

Select the new layout from the screen that appears.

d.

Click Save.

To delete a tab:a.

Hover over the tab name and click the down arrow.

b.

Click Delete and confirm.

To play a tab slide show:a.

Click the Settings button to the right of the tab display.

1-3

Trend Micro Apex Central™ as a Service Widget and Policy Management Guideb.

Enable the Tab Slide Show control.

c.

Select the length of time each tab displays before switching to thenext tab.

Working with Widgets
Manage widgets by adding, moving, resizing, renaming, and deleting items.
You can also modify the products that contribute data for the widget.
Procedure
1.

Go to the Dashboard.

2.

Click a tab.

3.

To add a widget:a.

1-4

Click the Settings button to the right of the tab display.

The Dashboardb.

Click Add Widgets.

c.

Select widgets to add.
• In the drop-down on top of the widgets, select a category tonarrow down the selections.
• Use the search text box on top of the screen to search for a
specific widget.

d.

Click Add.

4.

To move a widget to a new location on the same tab, drag-and-drop awidget to a new location.

5.

Resize widgets on a multi-column tab by pointing the cursor to the rightedge of the widget and then moving the cursor to the left or right.

6.

To rename a widget:7.

a.

Click the settings icon (b.

Type the new title.

c.

Click Save.

>).

To modify the product scope of the widget:a.

Click the settings icon (

>

).

1-5

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

8.

b.

Click the double arrow button () in the Scope field.

c.

(Optional) Click the funnel icon (products.

d.

Select the products that contribute data for the widget and click OK.

e.

Click Save.

) to filter and search for

To delete a widget, click the delete icon (>).

Summary Tab
The Summary tab contains a predefined set of widgets that provides an
overview of the security status of your network.
Note
You can add, delete, or modify the widgets that display on the Summary tab.

Available widgets:• Critical Threats• Users with Threats• Endpoints with Threats• Product Connection Status• Product Component Status• Ransomware Prevention

Critical Threats Widget
This widget displays the total number of unique critical threat types detectedon your network and the number of affected users and threat detections foreach threat type.
Click the settings icon (1-6>) to change the default View.

The Dashboard• On the Summary tab or a custom tab, the Affected users view is selectedby default.
• On the Threat Investigation tab, the Threat detections view is selectedby default.
Note• The widget lists critical threat types in order of severity.
• Individual users may be affected by more than one critical threat type.

Use the Period drop-down to select the time range for the data that displays.

Figure 1-1. Affected Users View

The Affected users view displays the number of Important Users and Other
Users affected by each threat type.
• Click the count in the Important Users or Other Users column, and thenclick the affected user you want to view.
• You can define important users or endpoints on the User/Endpoint
Directory screen.

1-7Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Figure 1-2. Threat Detections View

The Threat detections view displays the number of detections for eachcritical threat type.
• Click a critical threat type to view the specific threat detections.
• Click the hyperlink for a specific threat detection to view details about
the affected users and automatically start a Root Cause Analysis todetermine whether the threat has affected other endpoints on yournetwork.
Critical threat detections include the following threat types.
Threat Type

1-8

Description

Ransomware

Malware that prevents or limits users from accessing their system
unless a ransom is paid

Known Advanced
Persistent Threats(APT)

Intrusions by attackers that aggressively pursue and compromisechosen targets, often conducted in campaigns—a series of failed andsuccessful attempts over time to get deeper and deeper into a target
network—and not isolated incidents

Social engineering
attacks

Malware or hacker attacks that exploits a security vulnerability foundin documents, such as a PDF file

The Dashboard

Threat Type

Description

Vulnerability attacks

Malware or hacker attacks that exploits a security weakness typicallyfound in programs and operating systems

Lateral movements

Searches for directories, email, and administration servers, and otherassets to map the internal structure of a network, obtain credentials toaccess these systems, and allow the attacker to move from system tosystem

Unknown threats

Suspicious objects (IP addresses, domains, file SHA-1 hash values,
email messages) with the "high" risk level, as detected by Deep
Discovery Inspector, endpoint security products, or other productswith Virtual Analyzer

C&C callbacks

Attempts to communicate with a command-and-control (C&C) server
to deliver information, receive instructions, and download othermalwareUsers with Threats Widget
This widget displays information about users with security threat detections.
Use the Range drop-down to select the time period for the data that displays.
Click the Important Users or Other Users tabs to switch between the
different views.
The table lists affected users in order by critical threat type severity first, andthen by the number of threat detections for the user.
• Click the number in the Threats column for the user you want to view.
The Most Critical Threat column displays the following threat types.
Threat TypeC&C callback

Description
Attempts to communicate with a command-and-control (C&C) server
to deliver information, receive instructions, and download othermalware1-9

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Threat Type

Description

Known Advanced
Persistent Threat(APT)

Intrusions by attackers that aggressively pursue and compromisechosen targets, often conducted in campaigns—a series of failed andsuccessful attempts over time to get deeper and deeper into a target
network—and not isolated incidents

Lateral movement

Searches for directories, email, and administration servers, and otherassets to map the internal structure of a network, obtain credentials toaccess these systems, and allow the attacker to move from system tosystemRansomware

Malware that prevents or limits users from accessing their system
unless a ransom is paid

Social engineering
attackMalware or hacker attacks that exploits a security vulnerability foundin documents, such as a PDF file

Unknown threats

Suspicious objects (IP addresses, domains, file SHA-1 hash values,
email messages) with the "high" risk level, as detected by Deep
Discovery Inspector, endpoint security products, or other productswith Virtual Analyzer

Vulnerability attack

Malware or hacker attacks that exploits a security weakness typicallyfound in programs and operating systems

Endpoints with Threats Widget
This widget displays information about endpoints with security threat
detections.
Use the Range drop-down to select the time period for the data that displays.
Click the Important Users or Other Users tabs to switch between the
different views.
The table lists affected users in order by critical threat type severity first, andthen by the number of threat detections for the user.
• Click the number in the Threats column for the user you want to view.
The Most Critical Threat column displays the following threat types.

1-10

The Dashboard

Threat Type

Description

C&C callback

Attempts to communicate with a command-and-control (C&C) server
to deliver information, receive instructions, and download othermalwareKnown Advanced
Persistent Threat(APT)

Intrusions by attackers that aggressively pursue and compromisechosen targets, often conducted in campaigns—a series of failed andsuccessful attempts over time to get deeper and deeper into a target
network—and not isolated incidents

Lateral movement

Searches for directories, email, and administration servers, and otherassets to map the internal structure of a network, obtain credentials toaccess these systems, and allow the attacker to move from system tosystemRansomware

Malware that prevents or limits users from accessing their system
unless a ransom is paid

Social engineering
attackMalware or hacker attacks that exploits a security vulnerability foundin documents, such as a PDF file

Unknown threats

Suspicious objects (IP addresses, domains, file SHA-1 hash values,
email messages) with the "high" risk level, as detected by Deep
Discovery Inspector, endpoint security products, or other productswith Virtual Analyzer

Vulnerability attack

Malware or hacker attacks that exploits a security weakness typicallyfound in programs and operating systems

Product Component Status Widget
This widget displays the component versions and compliance status ofmanaged products or endpoints on your network. Use this widget to track
managed products or endpoints with outdated components.
The default view displays the latest versions of components managed byTrend Micro Apex Central and the compliance status of managed products.
The Pattern and Engine sections list components in order of the highest rateof non-compliance first. You can click the Rate column to change the sortorder.

1-11

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Click any of the components in the Pattern or Engine columns to view a pie
chart that displays the number of managed products or endpoints using eachcomponent version.
Click the counts in the Outdated/All columns to view information about thecomponent versions on outdated managed products, all managed products,
outdated endpoints, or all endpoints.
Click the settings icon (>) to configure the following options:

Note
The settings icon () does not display for widgets on the Summary tab.

• To modify the product scope of the widget, click the double arrow
button ( ) in the Scope field and select the products that contributedata.
• To edit the components that display in the widget, select or clear
components from the Pattern or Engine fields.
• To display compliance information for managed products, endpoints, orboth, specify the Source.
• To specify whether to view data from all components reported bymanaged products or to view data from only components managed byTrend Micro Apex Central, select the View.
Data

Description

Pattern

Displays the name of the pattern file, template, or antispam ruleEngineDisplays the name of the scan engine

Latest Version

Displays the following information:• The latest version of the component downloaded by Trend Micro
Apex Central• The latest version of the component that is available fordownload (reported by managed products)

1-12

The Dashboard

Data
Outdated/All

Description
Displays the following information:• Outdated: The number of managed products or endpoints withoutdated components
Click the first count in the Outdated/All column to view
information about the component versions on the outdated
managed products or endpoints.
• All: The total number of managed products or endpoints that use
the component
Click the second count in the Outdated/All column to view
information about the component versions on all managed
products or endpoints.
Note
This column displays when Both is selected for the Source.

Rate

Displays the percentage of managed products or endpoints withoutdated components
Note
This column displays when Both is selected for the Source.

Product Connection Status Widget
This widget displays the connection status of all managed products that
register to the Apex Central as a Service server.
The default view lists the connection status and managed server name ofeach managed product for which the logged on user account has accessrights.
• To change the product scope, click the settings icon (a new Scope.

>) and select

1-13Trend Micro Apex Central™ as a Service Widget and Policy Management Guide• To view a summary of the total number of managed products for eachconnection status, click the settings icon ( > ) and switch the View
to Summary.
Click View details to view detailed information on the Log Query screen.
StatusDescription

ActiveIndicates that the product service is running and communication with
the Apex Central as a Service server is established successfully

Inactive

Indicates that the product service is not running or is unable toestablish communication with the Apex Central as a Service server

AbnormalIndicates that the product service has not communicated with theApex Central as a Service server within the user-defined agent
communication time-out interval

Ransomware Prevention Widget
This widget provides an overview of all the attempted ransomware attacks
for a specified time range.
The default view displays a summary of all the ransomware detections andcategorizes all the attempts based on the infection channel.
• Click the ransomware detection count to view additional details.
Channel

1-14

Description

Messages

Ransomware detected in email messages or email attachments

WebsitesRansomware detected by Web Reputation Services

Network traffic

Ransomware detected by Apex One Suspicious Connections and Deep
Discovery Inspector

Cloud sync

Ransomware detected by Cloud App Security on cloud storage
and Office 365 servers (Exchange Online, SharePoint Online, and
OneDrive), or detected by Apex One in local folders on Apex One
agents that sync with cloud storage

Files

Ransomware detected by File Reputation Services

The Dashboard

ChannelBehaviors

Description
Ransomware detected by Apex One Behavior MonitoringThreat Investigation Tab
The Threat Investigation tab contains widgets tailor-made for security
analysts to perform endpoint detection and response (EDR).
The predefined widgets include:• Critical Threats

Critical Threats Widget
This widget displays the total number of unique critical threat types detectedon your network and the number of affected users and threat detections foreach threat type.
Click the settings icon (>) to change the default View.

• On the Summary tab or a custom tab, the Affected users view is selectedby default.
• On the Threat Investigation tab, the Threat detections view is selectedby default.
Note• The widget lists critical threat types in order of severity.
• Individual users may be affected by more than one critical threat type.

1-15

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Use the Period drop-down to select the time range for the data that displays.

Figure 1-3. Affected Users View

The Affected users view displays the number of Important Users and Other
Users affected by each threat type.
• Click the count in the Important Users or Other Users column, and thenclick the affected user you want to view.
• You can define important users or endpoints on the User/Endpoint
Directory screen.

1-16

The Dashboard

Figure 1-4. Threat Detections View

The Threat detections view displays the number of detections for eachcritical threat type.
• Click a critical threat type to view the specific threat detections.
• Click the hyperlink for a specific threat detection to view details about
the affected users and automatically start a Root Cause Analysis todetermine whether the threat has affected other endpoints on yournetwork.
Critical threat detections include the following threat types.
Threat Type

Description

Ransomware

Malware that prevents or limits users from accessing their system
unless a ransom is paid

Known Advanced
Persistent Threats(APT)

Intrusions by attackers that aggressively pursue and compromisechosen targets, often conducted in campaigns—a series of failed andsuccessful attempts over time to get deeper and deeper into a target
network—and not isolated incidents

Social engineering
attacks

Malware or hacker attacks that exploits a security vulnerability foundin documents, such as a PDF file

1-17

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Threat Type

Description

Vulnerability attacks

Malware or hacker attacks that exploits a security weakness typicallyfound in programs and operating systems

Lateral movements

Searches for directories, email, and administration servers, and otherassets to map the internal structure of a network, obtain credentials toaccess these systems, and allow the attacker to move from system tosystem

Unknown threats

Suspicious objects (IP addresses, domains, file SHA-1 hash values,
email messages) with the "high" risk level, as detected by Deep
Discovery Inspector, endpoint security products, or other productswith Virtual Analyzer

C&C callbacks

Attempts to communicate with a command-and-control (C&C) server
to deliver information, receive instructions, and download othermalwareSecurity Posture Tab
The Security Posture tab provides a holistic summary of your network
protection status by consolidating data about the compliance levels, criticalthreat detections, and detections stopped on your network. You can use the
Security Posture chart to quickly identify high risk users and groups from an
integrated Active Directory structure.
Note
To change the sample chart data and display sites or reporting lines based onyour company network, enable Active Directory integration or create custom
sites based on IP addresses.

By default, the Security Posture tab is toggled to Chart view ( ). To
display the chart nodes, critical threats, and antivirus pattern complianceinformation in a table, toggle the Table view ().
Click the settings icon (displays on the tab.

1-18

>

) to change the following information that

The Dashboard• Organization: Specify the display name of the organization.
• Active Directory grouping: Specify whether the nodes on the chart
represent Sites or Reporting Lines from your Active Directory.
• Groups to display: Select the top number of groups at the highest risk
• Period: Specify the time range for the data that displays on the chart.

Compliance Indicators
This section of the Security Posture tab provides information about theantivirus pattern compliance level or the Data Loss Prevention compliancelevel of your network.
As your network compliance level changes, the color of the complianceindicator icon changes to reflect the thresholds configured on the Active
Directory and Compliance Settings screen.
The default view displays information for the Antivirus pattern complianceindicator.
Note
Changing the compliance indicator also changes the compliance level
information that displays in the Security Posture chart.

To change the compliance information that displays, click the name of theselected compliance indicator next to the down arrow icon ( ) and selectone of the following indicators from the drop-down.

1-19Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Indicator
Antivirus patterncompliance

Description
Displays the following information:• The percentage of Security Agents using acceptable Virus Pattern
and Smart Scan Agent Pattern versions• The total number of endpoints with outdated antivirus patterns
on your network
Click the count for Endpoints with outdated patterns to view
detailed information about the affected endpoints in the User/
Endpoint Directory.

Data Loss Prevention
complianceDisplays the following information:• The percentage of Data Loss Prevention enabled Security Agentswith an acceptable number of threat detections• The total number of endpoints with Data Discovery threat
detections
Click the count for Endpoints with unacceptable threat
detections to view detailed information about the affected
endpoints in the User/Endpoint Directory.

Critical Threats
The Critical Threats section of the Security Posture tab displays the total
number of unique critical threats (by threat type) detected on your network,
the total number of affected users, and the number of affected important
users (marked by the star).
Click the number of affected users to view additional details on the User/
Endpoint Directory screen.
Critical threat detections include the following threat types.
Threat Type
Ransomware

1-20

Description
Malware that prevents or limits users from accessing their system
unless a ransom is paid

The Dashboard

Threat Type

Description

Known Advanced
Persistent Threat(APT)

Intrusions by attackers that aggressively pursue and compromisechosen targets, often conducted in campaigns—a series of failed andsuccessful attempts over time to get deeper and deeper into a target
network—and not isolated incidents

Social engineering
attackMalware or hacker attacks that exploits a security vulnerability foundin documents, such as a PDF file

Vulnerability attack

Malware or hacker attacks that exploits a security weakness typicallyfound in programs and operating systems

Lateral movement

Searches for directories, email, and administration servers, and otherassets to map the internal structure of a network, obtain credentials toaccess these systems, and allow the attacker to move from system tosystem

Unknown threats

Suspicious objects (IP addresses, domains, file SHA-1 hash values,
email messages) with the "high" risk level, as detected by Deep
Discovery Inspector, endpoint security products, or other productswith Virtual Analyzer

C&C callback

Attempts to communicate with a command-and-control (C&C) server
to deliver information, receive instructions, and download othermalwareResolved Events
This section of the Security Posture tab displays the total number of resolved
and unresolved events on your network.
Click the count for the Users affected by __ unresolved events field to view
detailed information about the users affected by unresolved events on yournetwork.

Security Posture Chart
The chart on the Security Posture tab displays the relationship between
the critical threat ratio and compliance level of your network. The x-axis
indicates the ratio of critical threats to total endpoints within a site orreporting line. The y-axis indicates the compliance levels of the sites orreporting lines for the selected compliance indicator. You can use this data
1-21

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

to quickly identify high risk users and groups from an integrated Active
Directory structure.
Note
To change the sample chart data and display sites or reporting lines based onyour company network, enable Active Directory integration or create custom
sites based on IP addresses.

Hover over a node to view compliance and critical threat information forparticular sites or reporting lines. The tail on a node indicates the direction
from which the security status has changed over the specified time period.
• Click the settings icon ( > ) to change the Active Directorygrouping (Sites, Reporting Lines) represented by the node.
• You can also customize sites and reporting lines by using the Active
Directory and Compliance Settings screen.
The default view displays the selected compliance indicator information for
all nodes on your network for the last 7 days.
• Select a different compliance indicator to change the complianceinformation that displays.
• Click the settings icon (displays.

>) to change the Period for the data that

• Click a node to view detailed information about the selected node in thesummary panel on the right.

Security Posture Details Pane
The details pane on the Security Posture tab displays more detailed
information about the compliance levels, critical threat detections, and total
resolved/unresolved events on your network.
The default view displays the selected compliance indicator information for
all nodes on your network for the last 7 days.

1-22

The Dashboard• Select a different compliance indicator to change the complianceinformation that displays.
• Click a node on the chart to display only the information for the selectednode.
• Click the settings icon (displays.

>) to change the Period for the data that

Table 1-1. Compliance Information
Indicator
Antivirus patterncompliance

Description
Displays the percentage of Security Agents using acceptable Virus
Pattern and Smart Scan Agent Pattern versions
You can also view the following details:• Managed agents: The number of endpoints that have Apex
One or Worry-Free Business Security Services Security Agents
installed• With compliant virus patterns: The number of managed
agents using acceptable Virus Pattern and Smart Scan Agent
Pattern versions• With outdated virus patterns: The number of managed
agents not using acceptable Virus Pattern and Smart Scan
Agent Pattern versions• Offline for 7 days: The number of managed agents thathave not communicated with the managed product server in
7 or more days
• Exceptions: The number of users or endpoints excluded
from the compliance calculations• Unmanaged endpoints: The number of endpoints that do nothave Apex One or Worry-Free Business Security Services Security
Agents installed
Expand the categories and click a count to view additional details
about the affected endpoints.

1-23

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Indicator
Data Loss Prevention
compliance

Description
Displays the percentage of Data Loss Prevention enabled Apex One
agents with an acceptable number of threat detections
You can also view the following details:• Managed agents: The number of endpoints that have Apex
One or Worry-Free Business Security Services Security Agents
installed• With acceptable threat detections: The number ofmanaged agents with an acceptable number of threat
detections• With unacceptable threat detections: The number ofmanaged agents that exceeded the acceptable number of
threat detections• Offline for 7 days: The number of managed agents thathave not communicated with the managed product server in
7 or more days
• Exceptions: The number of users or endpoints excluded
from the compliance calculations• Unmanaged endpoints: The number of endpoints that do nothave Apex One or Worry-Free Business Security Services Security
Agents installed
Expand the categories and click a count to view additional details
about the affected endpoints.

Table 1-2. Critical Threats
SectionCritical threats

Description
Displays the total number of unique critical threats (by threat type)detected on your network
Lists all the critical threat types affecting your network
For threat types with detections:• Expand the threat type to view a list of detections.
• Click a detection to view additional details on the Threat
Information screen.

1-24

The Dashboard

SectionAffected users

Description
Displays the total number of users affected by critical threats• Expand the section to view affected users.
• Click an affected user to view additional details on the User
information screen.

Affected endpoints

Displays the total number of endpoints affected by critical threats• Expand the section to view affected endpoints.
• Click an affected endpoint to view additional details on the
Endpoint information screen.

Table 1-3. Total Events
Description

Data
Total events

Displays the total number of events detected

Resolved events

Displays the number of resolved events on your network

Unresolved events

Displays the number of unresolved events on your network that
require action

Affected users

Displays the number of users affected by unresolved events on yournetwork
Click the count to view details about the affected users.

Data Loss Prevention Tab
The Data Loss Prevention tab contains widgets that display information
about DLP incidents, template matches, and incident sources.
The predefined widgets include:• DLP Incidents by Severity and Status• DLP Incident Trends by User
• DLP Incidents by User
• DLP Incidents by Channel

1-25Trend Micro Apex Central™ as a Service Widget and Policy Management Guide• DLP Template Matches• Top DLP Incident Sources• DLP Violated Policy

DLP Incidents by Severity and Status Widget
This widget checks the number of DLP incidents based on severity levels
and incident status. Data can be filtered by severity level, as well as display
the total number of new and high severity incidents. By default the widget
displays data from all the managed products that a user's account privileges
allow.
Important
This widget only displays data for Apex Central user accounts that have been
assigned Data Loss Prevention (DLP) user roles.
For more information about reviewing DLP incidents and configuring DLP
user roles, see https://docs.trendmicro.com/en-us/enterprise/apex-centralsaas/dlp_incidents.

Use the Range drop-down to select the time period for the data that displays.
Click the numbers in any column to open the Incident Information screen
and review the summary of incidents.
To look up a specific incident, type an ID in the Incident ID field and click
Search.
Tip
Each incident is assigned an ID number. ID numbers can be found by clicking
a table link, in Incident details updated event notifications, or in Data Loss
Prevention log query results.

Click the widget settings icon on the widget to access additional settings.

1-26

The Dashboard

Setting

Description

Title

Specify a new and meaningful title for the widget in the field.

Range

Specify the time range when the DLP incidents were triggered.

Scope

Specify the data scope displayed by the widget.
• Directly managed users• All managed users: Data is collected from both directly managed
users and people under the directly managed users

Severity

Specify the severity levels to filter the data.

Click Save to apply changes and update the widget data.

DLP Incident Trends by User Widget
This widget checks the number of DLP incident trends based on managed
users. Data can be filtered by severity level, or filtered to show only the total
number of incidents triggered by a specific user for a specified period oftime. By default the widget displays data from all the managed products thata user's account privileges allow.
Important
This widget only displays data for Apex Central user accounts that have been
assigned Data Loss Prevention (DLP) user roles.
For more information about reviewing DLP incidents and configuring DLP
user roles, see https://docs.trendmicro.com/en-us/enterprise/apex-centralsaas/dlp_incidents.

Use the Range drop-down to select the time period for the data that displays.
Click the sections from the graph to open the Incident Information screen
and review the summary of incidents.
Click the widget settings icon on the widget to access additional settings.

1-27

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Setting

Description

Title

Specify a new and meaningful title for the widget in the field.

Range

Specify the time range when the DLP incidents were triggered.

Scope

Specify the data scope displayed by the widget.
• Directly managed users• All managed users: Data is collected from both directly managed
users and people under the directly managed users.

Severity

Specify the severity levels to filter the data.

Users to display

Specify the number of managed users to display.

Click Save to apply changes and update the widget data.

DLP Incidents by User Widget
This widget checks the number of DLP incidents based on severity levels andmanaged users. Data can be filtered by severity level, as well as display the
total number of new and high severity incidents triggered by specific users.
By default the widget displays data from all the managed products that auser's account privileges allow. The widget shows a maximum of 50 users.
Important
This widget only displays data for Apex Central user accounts that have been
assigned Data Loss Prevention (DLP) user roles.
For more information about reviewing DLP incidents and configuring DLP
user roles, see https://docs.trendmicro.com/en-us/enterprise/apex-centralsaas/dlp_incidents.

Use the Range drop-down to select the time period for the data that displays.
Click the numbers in any column to open the Incident Information screen
and review the summary of incidents.

1-28

The Dashboard

To look up a specific user, type a few characters in the User field andclick Search. For example typing ke shows all user names with ke, suchas “Ken” and “Brooke”. You can also type a domain and user name, such as
domain1\chris.
Note
User names must not contain the following characters: " [ ] : ; | = + * ? / \ < &> ,Domain names must not contain the following characters: \ * + = | : ; " ? < &> ,Click the widget settings icon on the widget to access additional settings.
Description

Setting
Title

Specify a new and meaningful title for the widget in the field.

Range

Specify the time range when the DLP incidents were triggered.

Scope

Specify the data scope displayed by the widget.
• Directly managed users• All managed users: Data is collected from both directly managed
users and people under the directly managed users.

Severity

Specify the severity levels to filter the data.

Users to display

Specify the number of managed users to display.

Click Save to apply changes and update the widget data.

DLP Incidents by Channel Widget
This widget displays the total number of DLP incidents. Data can be filteredby the type of channels where the incident is triggered.
Use the Range drop-down to select the time period for the data that displays.
Use the Channel drop-down to filter out the type of channels where theincident is triggered.
This widget displays the number of DLP incidents and the ratio of channels
compared to the total number of incidents. This widget displays this data by:
1-29

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Data

Description

P2P

Displays all peer-to-peer DLP incidents by any managed product thatthe Data Scope specifies

IM

Displays all instant messaging DLP incidents by any managed productthat the Data Scope specifies

Webmail

Displays all webmail DLP incidents by any managed product that theData Scope specifies

Email

Displays all email DLP incidents by any managed product that theData Scope specifies

Web App

Displays all web application DLP incidents by any managed productthat the Data Scope specifies

Others

Displays the remaining DLP incidents by any managed product thatthe Data Scope specifies

Clicking links in the Channel column or sections from the graphs opens a
screen that displays detailed information.
Description

Data
ChannelType of channels where the DLP incidents is triggered

Incidents

Number of DLP incidents triggered

Percentage (%)

DLP incidents percentage of total number of incidents

To change the information that the widget displays, click> . On the
dialog box that appears, specify the Scope by clicking
and selecting theparent servers that the widget uses as its source.

DLP Template Matches Widget
This widget displays the type of DLP incidents on your network. Data can befiltered by template.
Use the Range drop-down to select the time period for the data that displays.
Clicking links in the Template column or sections from the graphs opens a
screen that displays detailed information.
1-30

The Dashboard

Data

Description

Template

Template triggered by DLP incidents

Incidents

Number of DLP incidents

Percentage (%)

DLP incidents percentage of total number of incidents

To change the information that the widget displays, click> . On the
dialog box that appears, specify the Scope by clicking
and selecting theparent servers that the widget uses as its source.

Top DLP Incident Sources Widget
This widget displays the total number of top DLP incident sources on yournetwork. This data includes users, email addresses, host names, and IP
addresses, which can be filtered by incident source.
Use the Range drop-down to select the time period for the data that displays.
Use the Show drop-down to select the data to be displayed.

DLP Violated Policy Widget
This widget displays the DLP violated policy. Use this widget to check the
total number of DLP incidents. By default data is sorted by the number ofincidents. To sort data by policy name, click the Policy column title.
Use the Range drop-down to select the time period for the data that displays.
Clicking links in the Incidents column opens a screen that displays detailed
information.
Data

Description

PolicyName of the policy where the DLP incidents is triggered

Incidents

Number of DLP incidents triggered

1-31

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Compliance Tab
The Compliance tab contains widgets that display information relating tocomponent or connection compliance for managed products or endpoints.
The predefined widgets are as follows:• Product Application Compliance• Product Component Status• Product Connection Status• Agent Connection Status

Product Application Compliance Widget
This widget displays the product version, language, build, and update status
for managed products. This provides administrators a quick way to discern
which managed product's applications are up-to-date and which require
updating.
You can choose to display the data in a bar chart or table by clicking the).
display icons (Click the counts in the Up-to-date and Out-of-date columns to open a screenthat displays detailed information. Trend Micro Apex Central performs a log
query to provide the detailed information.
Data

1-32

Description

Product

The managed product registered to Trend Micro Apex Central

VersionVersion of the managed productLanguage

Language version of the managed product

Build

Build number of the managed product

The Dashboard

Data
Up-to-date

Description
Number of products that are considered updated
Edit the widget to specify the minimum product version that shouldstill be considered "up-to-date".
Click the count to view more details about the product.

Out-of-date

Number of products that are "out-of-date"
Click the count to view more details about the product.

Up-to-date Rate (%)

Percentage of products that are "up-to-date"

By default the widget displays data from all the managed products that auser's account privileges allow.
Specify a bar graph or a table to display the data. By default, data is displayed
as a bar graph.
Click Edit to access the following options:• Click Scope > Browse to specify the products that contribute data for thewidget.
The data scope specifies the products which the widget uses to display
data. This can have a drastic affect on the usefulness of the informationthat the widget displays.
• On the Up-to-date range drop-down, specify the number of productversions away from the latest build that should still be considered "upto-date".
Click Save to apply changes and exit.

Product Component Status Widget
This widget displays the component versions and compliance status ofmanaged products or endpoints on your network. Use this widget to track
managed products or endpoints with outdated components.
The default view displays the latest versions of components managed byTrend Micro Apex Central and the compliance status of managed products.
1-33

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

The Pattern and Engine sections list components in order of the highest rateof non-compliance first. You can click the Rate column to change the sortorder.
Click any of the components in the Pattern or Engine columns to view a pie
chart that displays the number of managed products or endpoints using eachcomponent version.
Click the counts in the Outdated/All columns to view information about thecomponent versions on outdated managed products, all managed products,
outdated endpoints, or all endpoints.
Click the settings icon (>) to configure the following options:

Note
The settings icon () does not display for widgets on the Summary tab.

• To modify the product scope of the widget, click the double arrow
button ( ) in the Scope field and select the products that contributedata.
• To edit the components that display in the widget, select or clear
components from the Pattern or Engine fields.
• To display compliance information for managed products, endpoints, orboth, specify the Source.
• To specify whether to view data from all components reported bymanaged products or to view data from only components managed byTrend Micro Apex Central, select the View.
Data

1-34

Description

Pattern

Displays the name of the pattern file, template, or antispam ruleEngineDisplays the name of the scan engine

The Dashboard

Data
Latest Version

Description
Displays the following information:• The latest version of the component downloaded by Trend Micro
Apex Central• The latest version of the component that is available fordownload (reported by managed products)

Outdated/All

Displays the following information:• Outdated: The number of managed products or endpoints withoutdated components
Click the first count in the Outdated/All column to view
information about the component versions on the outdated
managed products or endpoints.
• All: The total number of managed products or endpoints that use
the component
Click the second count in the Outdated/All column to view
information about the component versions on all managed
products or endpoints.
Note
This column displays when Both is selected for the Source.

Rate

Displays the percentage of managed products or endpoints withoutdated components
Note
This column displays when Both is selected for the Source.

Product Connection Status Widget
This widget displays the connection status of all managed products that
register to the Apex Central as a Service server.
The default view lists the connection status and managed server name ofeach managed product for which the logged on user account has accessrights.
1-35

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide• To change the product scope, click the settings icon (a new Scope.

>) and select• To view a summary of the total number of managed products for eachconnection status, click the settings icon ( > ) and switch the View
to Summary.
Click View details to view detailed information on the Log Query screen.
StatusDescription

ActiveIndicates that the product service is running and communication with
the Apex Central as a Service server is established successfully

Inactive

Indicates that the product service is not running or is unable toestablish communication with the Apex Central as a Service server

AbnormalIndicates that the product service has not communicated with theApex Central as a Service server within the user-defined agent
communication time-out interval

Agent Connection Status Widget
This widget displays the connection status of agents with their parent
servers. Agents for the following managed products are displayed:• Apex One• Apex One (Mac)
By default the widget displays data from all the managed products that auser's account privileges allow.
Click the values in the Online, Offline, or Total columns to view more
information. Trend Micro Apex Central performs a log query to provide theinformation.
Description

Data

1-36

ServerParent servers

OnlineAgents connected to their parent servers

The Dashboard

Data

Description

OfflineAgents disconnected from their parent servers

Total

Total number of endpoints

To change the information that the widget displays, click> . On theand selecting the
dialog box that appears, specify the Scope by clicking
parent servers that the widget uses as its source.

Threat Statistics Tab
The Threat Statistics tab contains widgets that display aggregated detectionsof security threats.
The predefined widgets include:• Apex Central Top Threats• Apex Central Threat Statistics• Threat Detection Results• Policy Violation Detections• C&C Callback Events

Apex Central Top Threats Widget
This widget displays information about the malicious files and malicious
URLs detected for a specified time range.
You can choose to display the data in a bar chart or table by clicking thedisplay icons ().
Use the drop-down list above the chart/table to select the type of threat data
to display.
• Malicious Files: Ranks the malicious files detected on your network by
the number of detections• Malicious URLs: Ranks the malicious URLs detected on your network by
the number of detections
1-37

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Click a bar, threat name, or detection number to open the Log Query screenthat displays information about the affected endpoints, threat details, anddetection count.
The default view displays the top 10 threats from all the managed products
for which the logged on user account has access rights.
• Click the settings icon ( > ) to edit the widget title, product scope, or
number of threats that displays.

Apex Central Threat Statistics Widget
This widget displays the total number of security threat detections on yournetwork. Data can be filtered by security threat type or by the location on
your network where the threat is detected.
• Product Category
Data
File server

Security threats on file servers detected by any managed productthat the Data Scope specifies

Network

Security threats on your network detected by any managed
product that the Data Scope specifies

Unknown

Unidentified security threats

Mail

Security threats on email servers detected by any managed
product that the Data Scope specifies

Desktop

Security threats on desktops detected by any managed productthat the Data Scope specifies

Gateway

Security threats at the gateway detected by any managed productthat the Data Scope specifies

Apex Central server

Security threats on Apex Central servers detected by any managed
product that the Data Scope specifies• Violation Type

1-38

Description

The Dashboard

Data

Description

Behavior Monitoring Behavior Monitoring violation detected by any managed productthat the Data Scope specifies
Content Violation

Content security violations (spam, blocked keywords andexpressions) detected by any managed product that the Data
Scope specifies

Device Control

Device Control violation detected by any managed product thatthe Data Scope specifies

Firewall Violation

Firewall violation by any managed product that the Data Scope
specifies

Network Content
Inspection

Network Content Inspection violation detected by any managed
product that the Data Scope specifies

Predictive Machine
Learning

Predictive Machine Learning detection by any managed productthat the Data Scope specifies

Spyware/Grayware

Spyware/grayware detected by any managed product that theData Scope specifies

Suspicious Files

Suspicious file detection by any managed product that the Data
Scope specifies

Virus/Malware

Viruses/malware detected by any managed product that the Data
Scope specifies

Web Security

Web security violations (malicious URLs, blocked URLs) detectedby any managed product that the Data Scope specifies

Note
The widget can display data for only one information type at a time.

Click the links in the Detections column to open a screen that displays
detailed information. Apex Central performs a log query to provide thedetailed information.

1-39

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Data

Description

Type

Type of security threat or managed product where the threat is
detected

Detections

Number of security threats detected

Percentage (%)

Security threat percentage of total number of detected threatsSpecify the date range for the data that the widget displays:• Today• Last 7 days
• Last 14 days
• Last 30 days
Specify how the widget displays the data:• Pie chart• Bar chart• Tabular• Line chart
By default the widget displays data from all the managed products that auser's account privileges allow.
> . On the
To change the information that the widget displays, click
dialog box that appears, specify the Scope by clicking
and selecting theparent servers that the widget uses as its source.

Threat Detection Results Widget
This widget displays the number of threat detections and the ratio of threats
compared to the total number of detections. The widget can display data for
only one information type at a time. Clicking links in the Detections column
opens a screen that displays detailed information. Apex Central performs a
log query to provide the detailed information.

1-40

The Dashboard

Data
Results

Description
The action or result of the action performed by the managed product
Note
This column does not display for the Web Security threattype

Policy/Rule

The type of policy/rule applied under the Web Security threat type.
Note
This column does not display for other listed threat types.

Detections

The number of security threats detected

Percentage (%)

The percentage of total detections that are security threats

This widget displays threat detections for the following threat types:
Table 1-4. Threat Types
Threat Type

Description

Virus/Malware

Displays the action taken on all files by any managed product that theData Scope specifies. For example: Cleaned, Access denied, and so on.

Spyware/Grayware

Displays the action taken on all files by any managed product thatthe Data Scope specifies. For example: Successful, Further action
required, and so on.

Content Security

Displays the action taken on all email messages by any managed
product that the Data Scope specifies. For example: Deleted,
Attachments stripped, and so on.

Web Security

Displays all web security violations blocked using the policies by any
managed product that the Data Scope specifies. For example: Fileblocking, File name, and so on.

Network Virus

Displays the action taken on all network viruses by any managed
product that the Data Scope specifies

1-41Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Click the settings icon ( >type of threats that displays.

) to edit the widget title, product scope, or

Policy Violation Detections Widget
This widget displays the policy violation detections for Network VirusWall
Enforcer devices. Clicking links in the Detections column opens a screenthat displays detailed information. Apex Central performs a log query toprovide the detailed information.
Data

Description

Type

Lists Service Violations as a type of security threat

UpdatedLast updated date

Detections

Number of service violations Network VirusWall Enforcer devices
detectClick the settings icon (>) to edit the widget title or product scope.

Note
This widget only displays policy violation detections for Network VirusWall
Enforcer.

Click Save to apply changes and exit.

C&C Callback Events Widget
This widget displays the number of C&C callback attempts based oncompromised hosts or callback addresses. The widget can display data for
only one information type at a time. Clicking the numbers in any table
cells opens the C&C Callback Events screen, which contains the following
callback summary data:
Data
Compromised Host

1-42

Description
Affected host or email address

The Dashboard

Data

Description

Callback Address

URL, IP address, or email address to which a compromised host
attempts a callback

C&C Server Location

Region and country where the C&C server locates

Callback Attempts

Number of contacts made between callback addresses andcompromised hosts

LatestCallback Address/
Compromised Host

URL, IP address, or email address to which the last callback attempt
was logged

Callback Addresses/
Compromised Hosts(with numbers
displayed in thecolumns)

Number of compromised hosts or callback addresses associated withthe callback attempts

Logged By

Name of the managed product that logged the event

Click the settings icon (>) to edit the following:• Title: Modify the title of the C&C Callback Events widget.
• Scope: Clicksource.

and select the parent servers that the widget uses as the• C&C list source: Select Global Intelligence, Virtual Analyzer, or Userdefined as the C&C list sources.
• Items to display: Select the number of items to display on the widget.
Click Save to apply changes and exit.

1-43Chapter 2

Policy Management
This section contains information about how to perform policy management
on managed products and endpoints.
Important
Each managed product provides different policy settings that you canconfigure and deploy to policy targets. You can find a complete list of
supported managed products and the policy settings for each in the Apex
Central as a Service Widget and Policy Management Guide.
You can download a PDF version of the guide, or view the guide online, using
the following link:
https://docs.trendmicro.com/en-us/enterprise/apex-one-as-a-service.aspx

Topics include:

2-1

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Policy Management
Policy management allows administrators to enforce product settings on
managed products and endpoints from a single management console.
Administrators create a policy by selecting the targets and configuring a listof product settings.
To perform policy management on a new managed product or endpoint,
move the managed product from the New Entity folder to another folder in
the Product Directory structure.

Creating a New Policy
Important
Each managed product provides different policy settings that you canconfigure and deploy to policy targets. You can find a complete list of
supported managed products and the policy settings for each in the Apex
Central as a Service Widget and Policy Management Guide.
You can download a PDF version of the guide, or view the guide online, using
the following link:
https://docs.trendmicro.com/en-us/enterprise/apex-one-as-a-service.aspx

Procedure
1.

Go to Policies > Policy Management.
The Policy Management screen appears.

2.

Select the type of product settings from the Product list.
The screen refreshes to display policies created for the selected
managed product.
For more information about configuring policy settings for specificmanaged products, see the Trend Micro Apex Central Widget and Policy
Management Guide.

2-2

Policy Management

3.

Click Create.
The Create Policy screen appears.

4.

Type a policy name.

5.

Specify targets.
Trend Micro Apex Central provides several target selection methods that
affect how a policy works.
Note
To include a managed product or endpoint as a target, make sure theproduct version of the managed product or endpoint supports policy
management in Trend Micro Apex Central. The Policy Template Settings
screen (Policies > Policy Resources > Policy Template Settings) contains
information about supported product versions.

The policy list arranges the policy targets in the following order:• Specify Targets: Use this option to select specific endpoints or
managed products.
• Filter by Criteria: Use this option to allocate endpoints
automatically based on the filtering criteria.
• None (Draft only): Use this option to save the policy as a draft
without choosing any targets.
6.

Click a managed product feature to expand it and configure its settings.
Repeat this step to configure all features.
• Each feature has a link to a Help topic that discusses the feature andhow to use it.
• For certain product settings, Trend Micro Apex Central needs
to obtain specific setting options from the managed products. If
administrators select multiple targets for a policy, Trend Micro Apex
Central can only obtain the setting options from the first selected2-3Trend Micro Apex Central™ as a Service Widget and Policy Management Guidetarget. To ensure a successful policy deployment, make sure theproduct settings are synchronized across the targets.
• If you are creating a policy for Apex One Security Agent that you
want to act as a parent to a future child policy, configure settings
that can be inherited, customized, or extended on the child policy.
• For a list of Apex One agent settings that can be inherited,customized, or extended, see Working with Parent Policy Settings
on page 2-10.
• For details on creating a child policy, see Inheriting Policy
Settings on page 2-14.
7.

Click Deploy or Save.
If you clicked Deploy, Trend Micro Apex Central starts the deployment.
The deployed policy appears in the list on the Policy Management
screen. It usually takes a few minutes for Trend Micro Apex Central
to deploy the policy to the targets.
Click Refresh on the Policy Management screen to update the status
information in the policy list. If the status of the deployment remains
pending after an extended period of time, there might be issues withthe targets. Check if there is a connection between Trend Micro Apex
Central and the targets. Also check if the targets are working properly.
Once Trend Micro Apex Central deploys a policy to the targets, thesettings defined in the policy overwrite the existing settings in thetargets. Trend Micro Apex Central enforces the policy settings in thetargets every 24 hours. Although local administrators can make changes
to the settings from the managed product console, the changes are
overwritten every time Trend Micro Apex Central enforces the policy
settings.
• Trend Micro Apex Central enforces the policy settings on the targets
every 24 hours. Since policy enforcement only occurs every 24
hours, the product settings in the targets may not align with thepolicy settings if local administrators make changes through the
managed product console between the enforcement period.

2-4Policy Management• Policy settings deployed to IMSVA servers take priority over the
existing settings on the target servers instead of overwriting them.
IMSVA servers save these policy settings on the top of the list.
• If an Apex One Security Agent assigned with a Trend Micro Apex
Central policy has been moved to another Apex One domain, theagent settings will temporarily change to the ones defined by that
Apex One domain. Once Trend Micro Apex Central enforces thepolicy again, the agent settings will comply with the policy settings.

Filtering by Criteria
Use this option to allocate endpoints automatically based on the filtering
criteria.
This option:• Is only available on the following managed products:• Apex One Security Agent• Apex One Data Loss Prevention• Apex One (Mac)• Uses a filter to automatically assign current and future targets to thepolicy• Is useful for deploying standard settings to a group of targets
Administrators can change the priority of filtered policies in the policy list.
When an administrator reorders the policy list, Trend Micro Apex Central
re-assigns the targets to different filtered policies based on the target criteria
and the user roles of each policy creator.
Trend Micro Apex Central can only assign endpoints without policies to a
new filtered policy. To re-allocate an endpoint already assigned to a filteredpolicy, move another filtered policy with the matching criteria up the priority
list.
See Assigning Endpoints to Filtered Policies on page 2-7 for more information
on how Trend Micro Apex Central assign targets to filtered policies.
2-5Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Procedure
1.

On the Create Policy screen, go to the Targets section, select Filter byCriteria, and then click Set Filter.
The Filter by Criteria screen appears.

2.

Select the following options and define the criteria.
Criteria
Match keywords in

Description
Define keywords based on the host name or Trend Micro Apex
Central display name.
Note
Trend Micro Apex Central performs partial matchingfor single keyword searches. You can search multiple,
comma-separated keywords, however,Trend Micro Apex
Central only provides full string matches for eachkeyword provided.

IP addresses

Define a range of IP addresses and click Add.
Note
• Policy management only supports IPv4 addresses.
• When a new managed product or endpoint registers
to Trend Micro Apex Central, it takes about an hourfor the managed product or endpoint to become
available for searching by IP address.

Operating systems

2-6

Select one or more operation systems from the drop-down list.

Policy Management

Criteria
Directories

Description
Select one of the following directories and define the criteria.
• Product Directory: Select folders from the Product Directory
structure• Active Directory: Select organizational units from an
integrated Active Directory structure• Apex One domain hierarchy: Type at least one Apex One
domain hierarchy keyword

3.

Click Save.
The Create Policy screen reloads.

Assigning Endpoints to Filtered Policies
When a new endpoint registers to Trend Micro Apex Central, it goes throughthe filtered policies in the list in descending order. Trend Micro Apex Central
assigns the new endpoint to a filtered policy when the following conditions
are both satisfied:• The new endpoint matches the target criteria in the policy• The policy creator has the permission to manage the new endpoint
The same action applies to an endpoint already assigned to a policy, but thepolicy creator later deletes the policy.
Note
For endpoints just registered to Trend Micro Apex Central and for thosejust released from deleted policies, there is a three-minute grace period
during which no endpoint allocation occurs. These endpoints are temporarily
without policies during this period.

If an endpoint does not meet the target criteria in any filtered policies, theendpoint does not associate with any policies. Trend Micro Apex Central
allocates these endpoints again when the following actions occur:

2-7

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide• Create a new filtered policy• Edit a filtered policy• Reorder the filtered policies• Daily endpoint allocation schedule
Trend Micro Apex Central uses a daily endpoint allocation schedule toensure that endpoints are assigned to the correct policies. This action
occurs once at 3:15 pm every day. When endpoint properties change,such as the operating system or IP address, these endpoints require thedaily schedule to re-assign them to the correct policies.
Note• If the endpoints are offline during the daily endpoint allocation
schedule, the policy status for these endpoints will remain pending
until they go online.
• If the Apex One domain of the endpoint is changed, Trend Micro
Apex Central deploys the updated the policy after 10 minutes.

When the above actions occur, Trend Micro Apex Central allocate endpoints
based on the following conditions:
Table 2-1. Endpoint Allocation for Filtered Policies
New endpoints or
endpoints fromdeleted policies
Create a new policy
Edit a policy
Reorder the filtered policies
Daily endpoint allocation
schedule

2-8

Endpoints without
policies

Endpoints with
policies

Policy Management

Specifying Policy Targets
Use this option to select specific endpoints or managed products.
This option:• Uses the search or browse function to locate specific targets andmanually assigns them to the policy• Is useful when administrators plan to deploy specific settings only to acertain targets• Remains static on the top of the policy list and takes priority over any
filtered policies
Procedure
1.

On the Create Policy screen, go to the Targets section, select Specify
Target(s), and then click Select.
The Specify Targets screen appears.

2.

Use Search or Browse to locate the targets.
• Search: Use the following search criteria to find endpoints or
managed products. The search results display the endpoints or
managed products matching all of the selected criteria.
• Match keywords in: Define keywords based on the host nameor Trend Micro Apex Central display name.
• IP addresses: Define a range of IP addresses and click Add.
Note
• Policy management only supports IPv4 addresses.
• When a new managed product or endpoint registers to
Trend Micro Apex Central, it takes about an hour forthe managed product or endpoint to become available forsearch by IP address.

2-9Trend Micro Apex Central™ as a Service Widget and Policy Management Guide• Operating systems: Select one or more operating systems fromthe drop-down.
• Browse: Browse the Product Directory or Active Directory to locate
endpoints or managed products to assign to the policy.
3.

Select the endpoints or managed products and then click Add Selected
Targets.

4.

Wait for the numbers in View Action List and View Results to change.

5.

Click OK.
The Create Policy screen reloads.

Working with Parent Policy Settings
Trend Micro Apex Central administrators who create a parent policy for
an Apex One Agent can configure certain policy settings to be inherited,customized, or extended.
Note
These options are not available on other managed products.

• Inherit from parent• A child policy administrator cannot change the setting at all. An
Apex One administrator can manually change the setting from theApex One server console. However, the setting will be overwritten
when Trend Micro Apex Central deploys policies to the Apex One
server.
For example, a Trend Micro Apex Central administrator can create aparent policy that enforces the exclusion of PDF files from a Manual
Scan.
• Changes to the setting on the parent policy are always enforced on
the child policy.
• If the permission on the parent policy changes from "Inherit fromparent" to "Are customizable" or "Extend from parent", the child
2-10Policy Management

policy administrator can customize or extend the current setting.
Changes to the setting on the parent policy are no longer enforced.
• Are customizable• A child policy can deviate from the setting configured in the parent
policy.
For example, if Scheduled Scan on the parent policy runs weekly
but is customizable, the child policy administrator can change theschedule to daily.
• Changes to the setting on the parent policy are never enforced on
the child policy.
• If the permission on the parent policy changes from "Arecustomizable" to "Inherit from parent", the current setting on theparent policy overwrites the setting on the child policy. Changes tothe setting on the parent policy are always enforced.
• Extend from parent• A child policy administrator can add to the items configured in theparent policy.
For example, if the parent policy excludes 20 file names from being
scanned during a Manual Scan, the administrator can add 10 more
safe and trustworthy files to the child policy.
• Items added or removed from the parent policy are also added or
removed from the child policy. A removed item can be added backto the child.
• If the permission on the parent policy changes from "Extend fromparent" to "Inherit from parent", items in the child policy that haveno match in the parent are removed. Changes to the items on theparent policy are always enforced.
The following table lists the parent policy settings that can be inherited,customized, or extended.

2-11

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Available Options
Setting and Path

Inherit
From
ParentAre
Customizable

Extend From Parent

Scan schedule
Scheduled Scan Settings >Target tab > Schedule section
File extensions to scan
Manual Scan / Real-time
Scan / Scan Now / Scheduled
Scan Settings > Target tab >Files to Scan section > Fileswith the following extensions
optionScan exclusion lists(directories, files, and fileextensions to exclude fromscans)
Manual Scan / Real-time
Scan / Scan Now / Scheduled
Scan Settings > Scan
Exclusion tab

Approved Programs
Behavior
Monitoring>Exceptions tab

2-12

Note
When selecting Extend
from parent from ascan exclusion list,
the list expands toshow a Child Policy
Restrictions section
where the parent
policy creators can
specify items thatchild policies cannot
exclude from scans.

Policy Management

Available Options
Setting and Path

Inherit
From
ParentAre
Customizable

Extend From Parent

Blocked Programs
Behavior
Monitoring>Exceptions tab
Exceptions
Predictive Machine Learning
Trusted program list
Trusted Program List

Copying Policy Settings
Administrators can copy the settings from an existing policy, create a newpolicy with the same settings, and deploy the settings to different endpoints
or managed products.
Note
It is not possible to copy the settings of a child Apex One Agent policy. To
determine whether the Apex One Agent policy is a child or a parent, checkthe Parent Policy column. A clickable value displays if the policy is a child,and N/A if otherwise.

Procedure
1.

Go to Policies > Policy Management.
The Policy Management screen appears.

2.

Select the type of product settings from the Product list.
The screen refreshes to display policies created for the selected
managed product.
2-13

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

3.

Select a policy from the list.

4.

Click Copy Settings.
The Copy and Create Policy screen appears.

5.

In the Policy Name field, type a name for the policy.

6.

Assign Targets to the policy.

7.

(Optional) Change settings as necessary.

8.

Click Deploy.
Note• After clicking Deploy, please wait two minutes for Trend Micro Apex
Central to deploy the policy to the targets. Click Refresh on the
Policy Management screen to update the status information in thepolicy list.
• Trend Micro Apex Central enforces the policy settings on the targets
every 24 hours.

Inheriting Policy Settings
Create a new child policy by inheriting the settings of an existing parent
policy. A child policy cannot be copied and its settings cannot be inherited.
This task requires a parent policy for the Apex One agent. A parent policy
for the Apex One agent has the value N/A displayed under the Parent Policy
column.
Procedure
1.

Go to Policies > Policy Management.
The Policy Management screen appears.

2.
2-14

Select Apex One Agent from the Product list.

Policy Management

The screen refreshes to display policies created for the selected
managed product.
3.

Select a parent policy that does not have locally managed settings.

4.

Click Inherit Settings.
The Inherit and Create Policy screen appears.

5.

In the Policy Name field, type a name for the policy.

6.

Assign Targets to the policy.

7.

(Optional) Review the settings that can be customized or extended andthen make changes as necessary. For a list of settings to review, see
Working with Parent Policy Settings on page 2-10.
Note
A setting cannot be customized or extended if the option selected on theparent policy is Inherit from parent.

For example:• If the Scheduled Scan setting is customizable, you can change theschedule from weekly to daily.
• If the scan exclusion list for Real-time Scan can be extended, you
can type additional file names that you deem safe and trustworthy.
After the child policy is created, it will add those file names to thescan exclusion list.
8.

Click Deploy.

2-15

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Note• After clicking Deploy, please wait two minutes for Trend Micro Apex
Central to deploy the policy to the targets. Click Refresh on the
Policy Management screen to update the status information in thepolicy list.
• Trend Micro Apex Central enforces the policy settings on the targets
every 24 hours.

Modifying a Policy
Administrators can modify policy targets and settings as necessary. The rootaccount owner can modify every policy in the list, while other accountowners can only modify the policies they created. After a policy is modified,
Trend Micro Apex Central deploys the policy to the targets.
Important
Each managed product provides different policy settings that you canconfigure and deploy to policy targets. You can find a complete list of
supported managed products and the policy settings for each in the Apex
Central as a Service Widget and Policy Management Guide.
You can download a PDF version of the guide, or view the guide online, using
the following link:
https://docs.trendmicro.com/en-us/enterprise/apex-one-as-a-service.aspx

For a parent policy for the Apex One agent, if you modified the targets
and settings for specific features, the modifications will apply to all childpolicies and deployed to the respective targets. Some settings on a parent
policy support permissions, which control the changes allowed on childpolicies. Modifications to these parent policy permissions are also applied
to child policies and deployed to targets. For a list of settings that support
permissions, see Working with Parent Policy Settings on page 2-10.
For example:
2-16

Policy Management• If you changed the scan schedule permission from "Inherit from parent"
to "Are customizable", administrators can start to customize the existingschedule on their child policies.
• If you changed the Manual Scan file extensions permission from
"Extend from parent" to "Inherit from parent", any file extensions thatadministrators added to child policies will be removed. In addition,
administrators will no longer be able to add file extensions.
Procedure
1.

Navigate to Policies > Policy Management.
The Policy Management screen appears.

2.

Select the type of product settings from the Product list.
The screen refreshes to display policies created for the selected
managed product.

3.

Click a policy name in the Policy column.
The Edit Policy screen appears.

4.

Modify the policy.
Note
Modifying the filtering criteria in a filtered policy can affect target
allocation. Trend Micro Apex Central may re-assign some targets to otherfiltered policies, or add additional targets to the current policy.

5.

Click Deploy.
It may take some time for Trend Micro Apex Central to deploy thepolicy to the targets. Click Refresh on the Policy Management screen
to update the status information in the policy list. If the status of the
deployment remains pending after an extended period of time, there
might be issues with the targets. Check if there is a connection between
Trend Micro Apex Central and the targets. Also check if the targets areworking properly.
2-17Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Trend Micro Apex Central enforces the policy settings on the targets
every 24 hours.

Importing and Exporting Policies
Export policies for backup or to import to another Trend Micro Apex Central
server of the same version.
Note• Trend Micro Apex Central exports policy settings but not policy targets.
• A parent policy stays as a parent after the export or import.
• A child policy becomes a parent after the export. Consequently, it is aparent after the import.
• Trend Micro Apex Central cannot import a policy if its name is the sameas an existing child policy. If the existing policy is not a child, Trend
Micro Apex Central overwrites it after the import.
• For more information, see the following topics:• Creating a New Policy on page 2-2• Inheriting Policy Settings on page 2-14

Procedure
1.

Go to Policies > Policy Management.
The Policy Management screen appears.

2.

Select the type of product settings from the Product list.
The screen refreshes to display policies created for the selected
managed product.

3.

2-18

To export, select one or several policies, click Export Settings, and thensave the resulting policy file.

Policy Management• If you exported a single policy, the resulting file has the extension*.cmpolicy.
• If you exported several policies, the resulting file is a compressed(*.zip) file containing the individual .cmpolicy files.
4.

To import, click Import Settings and then locate and load the policy file.
• You can import an entire *.zip file or import individual*.cmpolicy files one by one.
• If the policy already exists in the policy list, a confirmation prompt
appears, asking if you want to overwrite the existing policy.
Click OK to proceed.
The screen refreshes and displays the imported policy at the top of thelist.
For more information about reordering the policy list, see Reordering the
Policy List on page 2-24.

Deleting a Policy
Administrators can remove a policy from the list. Trend Micro Apex Central
then re-allocates the targets associated with the deleted policy if the targets
match the filtering criteria of another policy. Those without a match become
endpoints without policies, and they keep the settings defined by the deleted
policy unless a managed product administrator modifies the settings.
Trend Micro Apex Central only allows policy creators to delete their own
policies. However, the root account can delete every policy in the list.
It is not possible to delete an Apex One Agent parent policy with settings
inherited by an existing child policy.
Procedure
1.

Go to Policies > Policy Management.
The Policy Management screen appears.
2-19

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

2.

Select the type of product settings from the Product list.
The screen refreshes to display policies created for the selected
managed product.

3.

Select the policy to delete.

4.

Click Delete.
A confirmation screen appears.

5.

Click OK.

Changing the Policy Owner
The default owner of a policy is the user account that created the policy. You
can use the Policy Management screen to change the owner of a policy to
any Apex Central as a Service user account. You can also change the policy
owner to an Active Directory group, which designates all Active Directoryusers within the group as owners of the policy.
Important
If you change the owner of a policy to a user account that does not have accessrights to the specified targets, the new owner can modify the policy settings
but cannot view the policy data.

Procedure
1.

Go to Policies > Policy Management.
The Policy Management screen appears.

2.

Select one or more policies to change the owner.

3.

Click Change Owner.
The Change Policy Owner screen appears.

2-20

4.

Select a user account from the drop-down list.

5.

Click Save to change the owner.

Policy Management

Apex Central as a Service sends an email notification to all user accounts
assigned the “Administrator” role.

Understanding the Policy List
The policy list displays the information and status of policies created by allusers. When a new endpoint registers to Trend Micro Apex Central, it goes
through the filtered policies in the list in descending order. Trend Micro
Apex Central assigns the new endpoint to a filtered policy when the following
conditions are both satisfied:• The new endpoint matches the target criteria of the policy• The policy creator has the permission to manage the new endpoint
The following table describes the policy list columns that display on the
Policy Management screen. Click a column to sort the data.
Table 2-2. Policy List
ColumnPriority

Description
Displays the priority of the policies• Trend Micro Apex Central lists policies from the highest to thelowest priority.
• When administrators create a filtered policy, Trend Micro Apex
Central saves the new policy as the lowest priority policy.
• A specified policy takes priority over any filtered policies andremains on the top of the list. Administrators cannot reorderspecified policies.
• Trend Micro Apex Central places draft policies at the bottom of
the list.

Policy

Displays the name of the policy

2-21Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

ColumnPolicy Version

Description
This column only appears if the selected product is Apex One
Security Agent.
Displays the latest policy version deployed
Note
Some targets might not have the latest policy version
deployed. To view the current policy deployed on specifictargets, click the number in the Deployed column.

Parent Policy

This column only appears if the selected product is Apex One
Security Agent.
If a policy is a child policy (that is, it inherited its settings from a parent
policy), this column shows the name of the parent policy. Otherwise,N/A displays.

Deviations

This column only appears if the selected product is Apex One
Security Agent.
If a policy is a child policy, this column shows the number of settings
that have been changed on the policy and are therefore inconsistent
with settings on the parent policy. If settings are consistent between
the policy and its parent, 0 (zero) displays.
If a policy is not a child policy, N/A displays.

2-22

Policy Management

ColumnOwner

Description
Displays the user who is currently assigned the policy
Note
The default owner is the user who created the policy.
• If you change the owner of a policy to a user accountthat does not have access rights to the specified targets,the new owner can modify the policy settings but cannot
view the policy data.
• You can also assign multiple owners by assigning thepolicy to an Active Directory group.
For more information, see Changing the Policy Owner on page2-20.

Last Editor

Displays the user who last edited the policy

Last EditedThis column only appears if the selected product is Apex One
Security Agent.
Displays when the policy was last editedTargets

Displays how administrators select targets for the policy.
• Specified: Uses the browse or search function to select specifictargets for the policy. Specified policies remain static on the topof the policy list and take priority over filtered policies.
• Filtered: Uses a filter to automatically assign current and future
endpoints to the policy. Administrators can rearrange the priorityof filtered policies. Hover over an item to conveniently view thefilter criteria and make adjustments as necessary.
• Label: Uses endpoint labels to assign endpoints to the policy.
• None: The policy creator saved the policy as a draft without
selecting any targets.

2-23

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

ColumnDeployed

Description
Displays the number of targets that have applied the policy settings orhave unactivated product services
Click the number to view the policy status.

Pending

Displays the number of targets that have not applied the policy
settings
Click the number to view the policy status.

Offline

Displays the number of targets that have offline agents
Click the number to view the policy status.

With Issues

Displays the number of targets that have not applied thepolicy settings due to unsupported policy deployment, no policy
configuration, system errors, endpoint communication errors withthe product server, unsupported endpoints, locally changed settings,
disabled product services, or partial deployment
Click the number to view the policy status.

Note
The numbers in Deployed and Pending columns only reflect the endpoints or
managed products that an administrator has permission to manage.

Reordering the Policy List
Administrators can use the Reorder button to change the order of thefiltered policies. Rearranging the policy list can affect target allocation.
Trend Micro Apex Central may re-assign some targets to different filteredpolicies.
Note• Specified policies remain static and always take priority over filteredpolicies.
• This function is only available for managing Apex One settings.

2-24

Policy Management

Procedure
1.

Go to Policies > Policy Management.
The Policy Management screen appears.

2.

Select the type of product settings from the Product list.
The screen refreshes to display policies created for the selected
managed product.

3.

Click Reorder.
The Reorder Policies screen appears.

4.

Rearrange the order of the Priority column.

5.

Click Save.
Note
After clicking Save, please wait two minutes for Trend Micro Apex
Central to re-assign the targets. Click Refresh on the Policy Management
screen to update the status information in the policy list.

Policy Status
Policy status allows administrators to check if Trend Micro Apex Central has
successfully deployed a policy to its targets.
To check the policy deployment status, use one of the following methods:• On the Policy Management screen, click a number in the policy list. The
Log Query screen appears.
• On the dashboard, click a number in the Policy Status widget. The Log
Query screen appears.
• Perform a log query
The following table provides the descriptions and suggestions about eachpolicy status:
2-25Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Table 2-3. Policy Status
Policy Status

Description

Suggestions

Pending

Trend Micro Apex Central isprocessing the policy.

Wait a few minutes and then checkthe status again.

Without policy

Trend Micro Apex Central has not
assigned a policy to this endpoint ormanaged product.

Assign a policy to the endpoint ormanaged product.

Deployed

Trend Micro Apex Central has
successfully deployed the policy.

N/A

Endpoint unable
to connect toserver• The endpoint did not receive
the policy settings.

• Check the connection status of
the endpoint• The server is currently busy.

• Connect the endpoint to thecompany network• Wait for the updated policy
statusInapplicableproduct settings

The managed product cannot
process some of the policy settings.

• Verify the policy settings• Update to the latest policy
template version• Check the settings on the
managed product• Verify the IP address of the
managed product on theManaged Servers screen
If the IP address is incorrect,
unregister and then register
the managed product again to
Trend Micro Apex Central.
• Refer to the Administrator's
Guide for the managed product

Unsupported
endpoint

2-26

The endpoint does not support
some features specified in the policy
settings.

Upgrade the agent to a supported
version.

Policy Management

Policy Status

Description

Suggestions

Settings
changed locallySome settings on the endpoint
or managed product do notcomply with the settings specified
in the policy because themanaged product administrator has
made some changes through the
managed product console.

Verify the settings on the managed
product console.

Unactivatedlicenses

The managed product has not
activated the licenses for some ofthe services specified in the policy
settings.

Activate the licenses for the
related services from the LicenseManagement screen on the Trend
Micro Apex Central console

Disabled
product services

The managed product has disabledsome of the services specified in thepolicy settings.

Enable the related services on the
managed product.

Partially
deployed

Trend Micro Apex Central has
enforced a portion of the policy
settings.

Wait a few minutes and then checkthe status again.

Managed by[Trend Micro
Apex Central
server name]

Another Trend Micro Apex Central
is currently managing the managed
product.

Remove the managed product from
the Managed Server list and add the
managed product to the list again.

Invalid username orpassword

The user name or password forauthentication is incorrect.

Verify the user name or password.

Invalid productserver orauthentication
information

The server name or theauthentication information isincorrect.

Verify the server name and theauthentication information.

2-27

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Policy Status

Description

Unable toautomaticallylog on to
product

Trend Micro Apex Central cannot
use the single sign-on function toaccess the managed product.

Suggestions• Check the single sign-on
function in the ProductDirectory• Check the connection status of
the MCP agent• Change the server connection
type from Automatic to
Manual in the Managed
Servers list.

Web server
configurationerror

A web service error has occurred.

Product
communication
error

Unable to access the productconsole.

Check the IIS configuration.

• Check if you can connect tothe managed product's web
console.
• Check the settings of the
managed product.

2-28

Unable toconnect toproduct

Trend Micro Apex Central cannot
establish a connection with the
managed product.

• Check the connection status of
the managed product.

Unsupported
product version

The managed product version is notsupported.

Upgrade the managed product to asupported version.

Network
configurationerror

A network connection error has
occurred.

Check the network connection.

System error.
Error ID: [error
ID number].

A system error has occurred.

Contact your Trend Micro support
representative.

• Check the network connection

Chapter 3

Policy Resources
This section contains information about policy resources for integrated
products/services.
Important
Each managed product provides different policy settings that you canconfigure and deploy to policy targets. You can find a complete list of
supported managed products and the policy settings for each in the Apex
Central as a Service Widget and Policy Management Guide.
You can download a PDF version of the guide, or view the guide online, using
the following link:
https://docs.trendmicro.com/en-us/enterprise/apex-one-as-a-service.aspx

Topics include:

3-1

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Application Control Criteria
Configure Application Control criteria that you can then assign to Security
Agent policy rules. You can create “Allow” and “Block” criteria to limit theapplications that users can execute or install on protected endpoints. You
can also create assessment criteria to monitor the applications executing on
endpoints and then refine the criteria based on the usage results.
Important
You must configure Application Control criteria before deploying an
Application Control policy to Security Agents.
Each managed product provides different policy settings that you canconfigure and deploy to policy targets. You can find a complete list of
supported managed products and the policy settings for each in the Apex
Central as a Service Widget and Policy Management Guide.
You can download a PDF version of the guide, or view the guide online, using
the following link:
https://docs.trendmicro.com/en-us/enterprise/apex-one-as-a-service.aspx

The following table outlines the tasks available on the Application Control
Criteria screen.

3-2

Policy Resources

Task
Add criteria

Description
Click the Add Criteria drop-down button and select from thefollowing options:• Allow: Click to define “Allow” or “Lockdown” criteria
For more information, see Defining Allowed Application Criteria on
page 3-4.
• Block: Click to define “Block” or “Assessment” criteria
For more information, see Defining Blocked Application Criteria on
page 3-6.
• Copy: Select an existing criteria and click Copy to define newcriteria based on the existing settings• Import: Click to select a ZIP package exported from a compatible
Application Control source
Note
If the imported package contains criteria names thatmatch preexisting criteria, you have the option to
Overwrite existing criteria or Skip the import of thecriteria with duplicated names.

Export criteria

Select the check box to the left of existing criteria andclick Export to save the selected criteria to a ZIP package(<timestamp>_iACRuleExport.zip)

Delete criteria

Select the check box to the left of existing criteria and click Delete toremove the selected criteria from the list
WARNING!
If you selected criteria used by existing Apex One Security
Agent policies, you must confirm that you want to delete andremove the criteria from all affected Security Agent policies.
You cannot undo this action.

3-3

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Task
Modify criteria

Description
Click a Criteria Name to modify the criteria settings
Note
Affected endpoints receive modified criteria settings the nexttime the Security Agents connect to the server.

View policy
associations

Click the value in the Target Policies column to display a list of all
Apex One Security Agent policies that implement the criteria.
Tip
Click a policy name to open a new browser tab on which you
can view or modify the policy settings.

Defining Allowed Application Criteria
Application Control provides the ability to define criteria that specificallyallow certain applications to execute. You can define allow criteria to ensurethat Application Control never blocks a certain application, or you can create
a complete list of applications allowed to execute on endpoints and thendeploy a Lockdown policy to the endpoints. While in Lockdown mode, users
cannot execute, access, or install any application that you did not include in
the allow criteria.
For more information about Lockdown policies, see Application Control Policy
Settings.

Procedure
1.

Go to Policies > Policy Resources > Application Control Criteria.
The Application Control Criteria screen appears.

2.

Click Add Criteria and select Allow.
The Allow Criteria Settings screen appears.

3-4

Policy Resources3.

Type a unique Name for the criteria.

4.

Select the level of Trust permission for the applications.
Permission

Description

Example Use

Application
cannotexecuteexternal
processes

Applications cannot access any
external processes or start anyother applications

Use when you want to allow
standalone applications to run on
endpoints but prevent access toother processes

Application
can execute
otherprocesses

Applications can start external
processes and applications thatusers are unable to access directly

For example, this setting allows
Microsoft Word to run but
prevents embedded OLE objects
from executing.
Use when you want to allow
applications to run on endpoints
and still allow access to required
child processes or add-ons.
For example, this setting allows
Internet Explorer to run andalso allows Internet Explorer to
execute any installed plug-ins.

Inheritable
executionrights (notrecommended)

5.

Applications can install andstart external processes andapplications, and the childapplications can also install andstart external processes andapplications

Use when you want to allow
installation packages to executeon the endpoint
Inheritable execution rights(not recommended) allows theinstallation package to perform
all installation tasks and then also
allows the installed application torun all required processes.

Select the Match method used to identify applications and configure
required settings.

3-5Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

MethodDescription

Application
Reputation
List

Allows you to apply the criteria to applications that Trend Micro has
tested and assigned a security score forFile paths

Allows you to apply the criteria to any application installed in thespecified location

For more information, see Application Reputation List on page 3-8.

For more information, see File Paths on page 3-9.
Certificates

Allows you to apply the criteria to applications based on certificate
validity and certificate attributes
For more information, see Certificates on page 3-13.

Hash values

Allows you to apply the criteria to applications based on SHA-1 or
SHA-256 hash values
For more information, see Hash Values on page 3-14.

Gray Software
List

Allows you to include applications to the criteria that Trend Micro has
tested and found to be potentially harmful
The Gray Software List is a subset of the Application Reputation Listand contains applications that may be malicious if not used properly.
Trend Micro recommends blocking or monitoring applications in theGray Software List to ensure that your network remains secure.

6.

Click Save.

Defining Blocked Application Criteria
Application Control provides the ability to define criteria that specifically
block certain applications from executing. You can define block criteria toensure that Application Control always blocks certain applications or you cancreate “Assessment” criteria to monitor the applications that users access.
Procedure
1.

Go to Policies > Policy Resources > Application Control Criteria.
The Application Control Criteria screen appears.

3-6

Policy Resources2.

Click Add Criteria and select Block.
The Block Criteria Settings screen appears.

3.

Type a unique Name for the criteria.

4.

To create a monitoring rule, select Enable assessment mode.
Note
Application Control logs all applications that match the assessment
criteria but takes no further action. Application Control allows theapplications to execute normally.

5.

Select the Match method used to identify applications and configure
required settings.
MethodDescription

Application
Reputation
List

Allows you to apply the criteria to applications that Trend Micro has
tested and assigned a security score forFile paths

Allows you to apply the criteria to any application installed in thespecified location

For more information, see Application Reputation List on page 3-8.

For more information, see File Paths on page 3-9.
Certificates

Allows you to apply the criteria to applications based on certificate
validity and certificate attributes
For more information, see Certificates on page 3-13.

Hash values

Allows you to apply the criteria to applications based on SHA-1 or
SHA-256 hash values
For more information, see Hash Values on page 3-14.

3-7

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

MethodDescription

Gray Software
List

Allows you to include applications to the criteria that Trend Micro has
tested and found to be potentially harmful
The Gray Software List is a subset of the Application Reputation Listand contains applications that may be malicious if not used properly.
Trend Micro recommends blocking or monitoring applications in theGray Software List to ensure that your network remains secure.

6.

Click Save.

Application Match Methods
Application Control provides multiple methods for identifying applications
to include in the allow and block criteria.
NoteApplication Control also provides the Gray Software List which you cannot
modify.
The Gray Software List is a subset of the Application Reputation List andcontains applications that may be malicious if not used properly. Trend Microrecommends blocking or monitoring applications in the Gray Software List toensure that your network remains secure.

Application Reputation List
The Application Reputation List is a comprehensive list of applications tested
by Trend Micro. The list includes most popular operating system files andbinaries as well as applications for desktops, servers, and mobile devices.
Trend Micro periodically provides updates to the list.
Important
Ensure that you have turned on regular updates to the Certified Safe Software
Pattern to stay up-to-date with the latest application information.

3-8

Policy Resources

You can search for applications by typing the name of Vendors or
Applications. Select applications using the data provided.
Data
Application

Description
The name of the application
Tip
To view detailed information for each application version, expand
the Application Reputation List.

AIR Score

A comprehensive security score based on an application's popularity andreputation

Global Usage

The global prevalence of the application
Tip
Click the prevalence to view a regional breakdown of theapplication usage.

File Paths
You can configure Application Control to specifically target certain directory
locations based on absolute path, storage type, and Perl Compatible Regular
Expressions (PCRE).
Select whether to match by a specific path or a storage type, and specify thematch string type (String or Regular Expression (PCRE)). Type the file paths
that apply to the criteria.

3-9Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Note• Application Control supports the use of the asterisk (*) wildcard when
specifying a String type match. The asterisk character can represent one
or more characters in a subdirectory of the specified string location.
• Application Control does not support the use of environment variables
when specifying file paths for String or Regular Expression (PCRE) typematches.
• You cannot use wildcard characters to indicate the entire contents of theselected storage location.
• You can specify up to 100 file paths.
Table 3-1. Supported Storage Locations
Storage
Location

Environme
nt Variable

Specific path

Notapplicable

Description
Only applies to applications in the exact path specified
Note
Application Control does not check device type whenusing this location type.

3-10

Any built-in
storage$FixedDrives

Only applies to applications in the path specified and stored
on an internal storage device (internal hard disk drive)

Any local
storage$LocalDrives

Only applies to applications in the path specified and stored
on a non-removable local storage device (internal or external
hard disk drive)Any
removable
storage$Removable
DrivesOnly applies to applications in the path specified and stored
on a removable storage device (USB drive, CD/DVD)

Network path

$RemoteDriv
es

Only applies to applications in the path specified and stored
on a shared network resource

Policy Resources

Storage
Location

Environme
nt Variable

Program Files
folder$ProgramFiles

Only applies to applications in the path specified and stored in
the Program Files folders (default folders C:\Program Filesand C:\Program Files (x86))

Systemvolume$SystemDrive

Only applies to applications in the path specified and stored in
the default Windows system drive

Description

File Path Example Usage
Goal
Monitor allusers'

Downloads

folderAllow Rule-

Block Rule
1. Enable
assessment
mode
2. Any local storage
3. String
4. C:\Users\*\Dow
nloads\*Results
Logs all attempts toaccess applications in
all users' Downloads
folder.
Monitors:• C:\Users\john_
doe\Downloads\
start.exe• C:\Users\Admin
istrator\Downl
oads\start.exe

3-11Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Goal
Block allapplications
located in any
folder under
theMyApps
subfolder of
either Program
Files directory

Allow Rule-

Block Rule
1. Program Files
folders
2. String
3. \MyApps*

Results
Blocks:• C:\Program

Files(x86)\MyA
pps\start.exe• C:\Program

Files\MyApps\start.exe• C:\Program

Files(x86)\MyA
pps\bin\start.
exe

Allows:• C:\Program

Files(x86)\sta
rt.exeAllow allapplications
located in any
folder under
theMyApps
subfolder of
either Program
Files directory
but Block allotherapplications/folders

1. Program Files
folders
2. String
3. \MyApps*

1. Any local storage
2. String
3. C:\Program
Files\*

Blocks:• C:\Program

Files(x86)\sta
rt.exeAllows:AND
1. Any local storage
2. String
3. C:\Program

Files (x86)\*• C:\Program

Files(x86)\MyA
pps\start.exe• C:\Program

Files\MyApps\start.exe• C:\Program

Files(x86)\MyA
pps\bin\start.
exe

3-12

Policy Resources

Goal

Allow Rule

Block Rule

Block only
applications
located intheMyApps
subfolder of
either Program
Files directory
but Allow all
otherapplications/folders

1. Allow thesubfolders of the
MyApps directory

1. Program Files
foldersa. Program
Files folders

2. String
3. \MyApps\*

b. String

Results
Blocks:• C:\Program

Files(x86)\MyA
pps\start.exe• C:\Program

Files\MyApps\start.exec. \MyApps\*\*Allows:• C:\Program

Files(x86)\sta
rt.exe• C:\Program

Files(x86)\MyA
pps\bin\start.
exe

Block a specificapplication filename in any
folder

-1. Specific path
2. Regularexpression(PCRE)
3. .*\\(?

i)test(?-i)\..*

Blocks:• C:\MyApps\test.exe• C:\Users\guet\
AppData\Local\
Temp\test.exe• C:\Program

Files(x86)\MyA
pps\test.exe

Certificates
You can configure Application Control to specifically target applications
based on the “trust” level of a certificate and that contain specific certificate
attributes.
Select the type of certificate “trust” level and then specify the required
certificate “Issuer” or “Subject” information.

3-13

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Note
Application Control supports the use of the asterisk (*) wildcard when
specifying Certificate attributes, although you must use the wildcard in
conjunction with other characters to limit the scope. For example, you cannot
use only the wildcard character in any field.

The following table describes the different “trust” types.
Type

Description

Trusted (valid)

You must have included the certificate in the trusted certificates list and thecertificate must not have expired

Trusted(expired)

You must have added the certificate in the trusted certificates list but thecertificate has already expired

Untrusted

The certificate is unknown or you did not add the certificate to the trusted
certificates list

Note
The “trust” level combinations for Allow and Block criteria differ.

Hash Values
You can configure Application Control to match applications using SHA-1 or
SHA-256 hash value formats. You can choose to manually specify hash values
or import a list of generated values.
Select your Input method and follow the on-screen instructions.
Input Method
Manual

3-14

Description
Allows you to manually specify up to 100 hash values (and descriptions)Policy Resources

Input Method
ImportDescription
Allows you to import a ZIP package containing a properly formatted hashvalue list in CSV format
You can choose to use the Hash Generator tool or manually create the CSV
file using the CSV sample format.
WARNING!
You can only import one file into each set of criteria. If you attempt
to import a new hash value list into the criteria, Application
Control completely overwrites the existing values.
• Hash Generator tool: Download and execute the tool on a target
endpoint that you have installed with all necessary applications. The
tool automatically creates a valid ZIP package containing the hashvalues of all applications found on the endpoint.
• CSV sample format: Download the sample file and follow the
instructions to properly populate the hash value list. Once you havecompleted the list, compress the file in ZIP format before importing
into the set of criteria.
Important
The hash value list cannot contain a mixture of SHA-1 andSHA-256 formats. You must create separate hash value files
and separate Application Control criteria for each type of hashvalue format.

Data Loss Prevention
Data Loss Prevention (DLP) safeguards an organization's confidential andsensitive data-referred to as digital assets-against accidental disclosure andintentional theft. DLP allows you to:• Identify the digital assets to protect• Create policies that limit or prevent the transmission of digital assets
through common channels, such as email and external devices
3-15

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide• Enforce compliance to established privacy standards
DLP evaluates data against a set of rules defined in policies. Policies
determine the data that must be protected from unauthorized transmission
and the action that DLP performs when it detects transmission.
Important
Each managed product provides different policy settings that you canconfigure and deploy to policy targets. You can find a complete list of
supported managed products and the policy settings for each in the Apex
Central as a Service Widget and Policy Management Guide.
You can download a PDF version of the guide, or view the guide online, using
the following link:
https://docs.trendmicro.com/en-us/enterprise/apex-one-as-a-service.aspx

Data Identifier Types
Digital assets are files and data that an organization must protect against
unauthorized transmission. Administrators can define digital assets using
the following data identifiers:• Expressions: Data that has a certain structure.
For details, see Expressions on page 3-17.
• File attributes: File properties such as file type and file size.
For details, see File Attributes on page 3-22.
• Keyword lists: A list of special words or phrases.
For details, see Keywords on page 3-24.
Note
Administrators cannot delete a data identifier that a DLP template is using.
Delete the template before deleting the data identifier.

3-16

Policy Resources

Expressions
An expression is data that has a certain structure. For example, credit
card numbers typically have 16 digits and appear in the format "nnnn-nnnnnnnn-nnnn", making them suitable for expression-based detections.
Administrators can use predefined and customized expressions.
For details, see Predefined Expressions on page 3-17 and Customized Expressions
on page 3-18.

Predefined Expressions
Data Loss Prevention comes with a set of predefined expressions. These
expressions cannot be modified or deleted.
Data Loss Prevention verifies these expressions using pattern matching andmathematical equations. After Data Loss Prevention matches potentiallysensitive data with an expression, the data may also undergo additionalverification checks.
For a complete list of predefined expressions, see the Data Protection Lists
document at:
http://docs.trendmicro.com/en-us/enterprise/data-protection-referencedocuments.aspx.
Viewing Settings for Predefined Expressions
Note
Predefined expressions cannot be modified or deleted.

Procedure
1.

Go to Policies > Policy Resources > DLP Data Identifiers.

2.

Click the Expression tab.

3.

Click the expression name.

3-17

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

4.

View settings in the screen that opens.

Customized Expressions
Create customized expressions if none of the predefined expressions meetthe company's requirements.
Expressions are a powerful string-matching tool. Become comfortable withexpression syntax before creating expressions. Poorly written expressions
can dramatically impact performance.
When creating expressions:• Refer to the predefined expressions for guidance on how to define valid
expressions. For example, when creating an expression that includes adate, refer to the expressions prefixed with "Date".
• Note that Data Loss Prevention follows the expression formats definedin Perl Compatible Regular Expressions (PCRE). For more information
on PCRE, visit the following website:
http://www.pcre.org/• Start with simple expressions. Modify the expressions if they are causing
false alarms or fine tune them to improve detections.
Administrators can choose from several criteria when creating expressions.
An expression must satisfy the chosen criteria before Data Loss Prevention
subjects it to a DLP policy. For details about the different criteria options, see
Criteria for custom expressions on page 3-18.
Criteria for custom expressions

View the available options for creating custom expressions.

3-18

Policy Resources

Table 3-2. Criteria options for customized expressions
Criteria
None

Rule
None

ExampleAll - Names from US Census Bureau• Expression: [^\w]([A-Z][az]{1,12}(\s?,\s?|[\s]|\s([A-Z])\.\s)[A-Z][a-z]{1,12})[^\w]Specific characters

An expression must include
the characters you havespecified.
In addition, the number ofcharacters in the expression
must be within the minimum
and maximum limits.

SuffixSuffix refers to the last
segment of an expression.
A suffix must include thecharacters you have specified
and contain a certain numberof characters.
In addition, the number ofcharacters in the expression
must be within the minimum
and maximum limits.

US - ABA Routing Number• Expression: [^\d]([0123678]\d{8})[^\d]• Characters: 0123456789• Minimum characters: 9• Maximum characters: 9
All - Home Address• Expression: \D(\d+\s[a-z.]+\s([a-z]+\s){0,2} (lane|ln|street|st|avenue|
ave| road|rd|place|pl|drive|dr|circle|
cr|court|ct|boulevard|blvd)\.? [0-9az,#\s\.]{0,30}[\s|,][a-z]{2}\ s\d{5}(\d{4})?)[^\d-]• Suffix characters: 0123456789• Number of characters: 5• Minimum characters in theexpression: 25• Maximum characters in theexpression: 80

3-19

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Criteria

Rule

Single- character
separator

An expression must have
two segments separated bya character. The charactermust be 1 byte in length.
In addition, the numberof characters left of theseparator must be within
the minimum and maximum
limits. The number ofcharacters right of theseparator must not exceed
the maximum limit.

ExampleAll - Email Address• Expression:[^\w.]([\w\.]{1,20}@[a-z0-9]{2,20}[\.][a-z]{2,5}[a-z\.]{0,10})[^\w.]• Separator: @• Minimum characters to the left: 3• Maximum characters to the left: 15• Maximum characters to the right: 30

Creating a Customized Expression

Procedure
1.

Go to Policies > Policy Resources > DLP Data Identifiers.

2.

Click the Expression tab.

3.

Click Add.
A new screen displays.

4.

Type a name for the expression. The name must not exceed 100 bytes inlength and cannot contain the following characters:• ><*^|&?\/

5.

Type a description that does not exceed 256 bytes in length.

6.

Type the displayed data.
For example, if you are creating an expression for ID numbers, type asample ID number. This data is used for reference purposes only andwill not appear elsewhere in the product.

7.

3-20

Choose one of the following criteria and configure additional settings
for the chosen criteria (see Criteria for custom expressions on page 3-18):

Policy Resources• None• Specific characters• Suffix• Single-character separator
8.

Test the expression against an actual data.
For example, if the expression is for a national ID, type a valid ID
number in the Test data text box, click Test, and then check the result.

9.

Click Save if you are satisfied with the result.
Note
Save the settings only if the testing was successful. An expressionthat cannot detect any data wastes system resources and may impact
performance.

Importing Customized Expressions

Use this option if you have a properly-formatted .dat file containing theexpressions. You can generate the file by exporting the expressions fromeither the server you are currently accessing or from another server.

Procedure
1.

Go to Policies > Policy Resources > DLP Data Identifiers.

2.

Click the Expression tab.

3.

Click Import and then locate the .dat file containing the expressions.

4.

Click Open.
A message appears, informing you if the import was successful. If an
expression to be imported already exists, it will be skipped.

3-21

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

File Attributes
File attributes are specific properties of a file. You can use two file attributes
when defining data identifiers, namely, file type and file size. For example,a software development company may want to limit the sharing of thecompany's software installer to the R&D department, whose members are
responsible for the development and testing of the software. In this case, theApex Central administrator can create a policy that blocks the transmissionof executable files that are 10 to 40 MB in size to all departments except R&D.
By themselves, file attributes are poor identifiers of sensitive files.
Continuing the example in this topic, third-party software installers sharedby other departments will most likely be blocked. Trend Micro therefore
recommends combining file attributes with other DLP data identifiers for amore targeted detection of sensitive files.
For a complete list of supported file types, see the Data Protection Lists
document at:
http://docs.trendmicro.com/en-us/enterprise/data-protection-referencedocuments.aspx.

Creating a File Attribute List
Procedure
1.

Go to Policies > Policy Resources > DLP Data Identifiers.

2.

Click the File Attribute tab.

3.

Click Add.
A new screen displays.

4.

Type a name for the file attribute list. The name must not exceed 100
bytes in length and cannot contain the following characters:• ><*^|&?\/

3-22

5.

Type a description that does not exceed 256 bytes in length.

6.

Select your preferred true file types.

Policy Resources

7.

If a file type you want to include is not listed, select File extensions
and then type the file type’s extension. Data Loss Prevention checks files
with the specified extension but does not check their true file types.
Guidelines when specifying file extensions:• Each extension must start with an asterisk (*), followed by aperiod (.), and then the extension. The asterisk is a wildcard,
which represents a file’s actual name. For example, *.pol matches
12345.pol and test.pol.
• You can include wildcards in extensions. Use a question mark (?) to
represent a single character and an asterisk (*) to represent two or
more characters. See the following examples:- *.*m matches the following files: ABC.dem, ABC.prm, ABC.sdcm- *.m*r matches the following files: ABC.mgdr, ABC.mtp2r,
ABC.mdmr- *.fm? matches the following files: ABC.fme, ABC.fml, ABC.fmp• Be careful when adding an asterisk at the end of an extension
as this might match parts of a file name and an unrelated
extension. For example: *.do* matches abc.doctor_john.jpg andabc.donor12.pdf.
• Use semicolons (;) to separate file extensions. There is no need to
add a space after a semicolon.
8.

Type the minimum and maximum file sizes in bytes. Both file sizes must
be whole numbers larger than zero.

9.

Click Save.

Importing a File Attribute List
Use this option if you have a properly-formatted .dat file containing the fileattribute lists. You can generate the file by exporting the file attribute lists
from either the server you are currently accessing or from another server.

3-23

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Procedure
1.

Go to Policies > Policy Resources > DLP Data Identifiers.

2.

Click the File Attribute tab.

3.

Click Import and then locate the .dat file containing the file attributelists.

4.

Click Open.
A message appears, informing you if the import was successful. If a fileattribute list to be imported already exists, it will be skipped.

Keywords
Keywords are special words or phrases. You can add related keywords toa keyword list to identify specific types of data. For example, "prognosis","blood type", "vaccination", and "physician" are keywords that may appear ina medical certificate. If you want to prevent the transmission of medical
certificate files, you can use these keywords in a DLP policy and thenconfigure Data Loss Prevention to block files containing these keywords.
Commonly used words can be combined to form meaningful keywords. For
example, "end", "read", "if", and "at" can be combined to form keywords
found in source codes, such as "END-IF", "END-READ", and "AT END".
You can use predefined and customized keyword lists. For details, see
Predefined Keyword Lists on page 3-24 and Custom keyword lists on page 3-26.

Predefined Keyword Lists
Data Loss Prevention comes with a set of predefined keyword lists. These
keyword lists cannot be modified or deleted. Each list has its own built-in
conditions that determine if the template should trigger a policy violation.
For details about the predefined keyword lists in Data Loss Prevention, see
the Data Protection Lists document at:
http://docs.trendmicro.com/en-us/enterprise/data-protection-referencedocuments.aspx
3-24

Policy Resources

How keyword lists work
Number of keywords condition

Each keyword list contains a condition that requires a certain number of
keywords be present in a document before the list triggers a violation.
The number of keywords condition contains the following values:• All: All of the keywords in the list must be present in the document.
• Any: Any one of the keywords in the list must be present in the
document.
• Specific number: There must be at least the specified number of
keywords in the document. If there are more keywords in the document
than the number specified, Data Loss Prevention triggers a violation.
Distance condition

Some of the lists contain a “distance” condition to determine if a violation
is present. “Distance” refers to the amount of characters between the firstcharacter of one keyword and the first character of another keyword.
Consider the following entry:
First Name:_John_ Last Name:_Smith_
The Forms - First Name, Last Name list has a “distance” condition of fifty(50) and the commonly used form fields of “First Name” and “Last Name”. In
the example above, Data Loss Prevention triggers a violation as the numberof characters between the “F” in First Name and the “L” in Last Name isequal to eighteen (18).
For an example of an entry that does not trigger a violation, consider thefollowing:
The first name of our new employee from Switzerland is John. His last
name is Smith.
In this example, the number of characters between the “f” in “first name”
and the “l” in “last name” is sixty-one (61). This exceeds the distancethreshold and does not trigger a violation.

3-25

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Custom keyword lists
Create custom keyword lists if none of the predefined keyword lists meets
your requirements.
There are several criteria that you can choose from when configuring a
keyword list. A keyword list must satisfy your chosen criteria before data loss
prevention subjects it to a policy. Choose one of the following criteria foreach keyword list:• Any keyword• All keywords• All keywords within <x> characters• Combined score for keywords exceeds threshold
For details regarding the criteria rules, see Custom keyword list criteria on page
3-26.
Custom keyword list criteria

View criteria used to create custom keyword lists for use in data loss
prevention templates.
Table 3-3. Criteria for a keyword list
Criteria

3-26

Rule

Any keyword

A file must contain at least one keyword in the keyword list.

All keywords

A file must contain all the keywords in the keyword list.

Policy Resources

Criteria
All keywords
within <x>characters

Rule
A file must contain all the keywords in the keyword list. In addition, eachkeyword pair must be within <x> characters of each other.
For example, your 3 keywords are WEB, DISK, and USB and the number ofcharacters you specified is 20.
If Data Loss Prevention detects all keywords in the order DISK, WEB, andUSB, the number of characters from the "D" (in DISK) to the "W" (in WEB)and from the "W" to the "U" (in USB) must be 20 characters or less.
The following data matches the criteria: DISK####WEB############USB
The following data does not match the criteria:
DISK*******************WEB****USB(23 characters between "D" and "W")
When deciding on the number of characters, remember that a small
number, such as 10, usually results in a faster scanning time but only covers
a relatively small area. This may reduce the likelihood of detecting sensitive
data, especially in large files. As the number increases, the area covered also
increases but scanning time might be slower.

Combinedscore forkeywords
exceeds
threshold

A file must contain one or more keywords in the keyword list. If only one
keyword was detected, its score must be higher than the threshold. If
there are several keywords, their combined score must be higher than thethreshold.
Assign each keyword a score of 1 to 10. A highly confidential word or phrase,such as "salary increase" for the Human Resources department, should havea relatively high score. Words or phrases that, by themselves, do not carrymuch weight can have lower scores.
Consider the scores that you assigned to the keywords when configuring
the threshold. For example, if you have five keywords and three of those
keywords are high priority, the threshold can be equal to or lower than the
combined score of the three high priority keywords. This means that thedetection of these three keywords is enough to treat the file as sensitive.

Creating a Keyword List

Procedure
1.

Go to Policies > Policy Resources > DLP Data Identifiers.

2.

Click the Keyword tab.
3-27

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

3.

Click Add.
A new screen displays.

4.

Type a name for the keyword list. The name must not exceed 100 bytes
in length and cannot contain the following characters:• ><*^|&?\/

5.

Type a description that does not exceed 256 bytes in length.

6.

Choose one of the following criteria and configure additional settings
for the chosen criteria:• Any keyword• All keywords• All keywords within <x> characters• Combined score for keywords exceeds threshold7.

8.

To manually add keywords to the list:a.

Type a keyword that is 3 to 40 bytes in length and specify whether it
is case-sensitive.

b.

Click Add.

To add keywords by using the "import" option:
Note
Use this option if you have a properly-formatted .csv file containing
the keywords. You can generate the file by exporting the keywords fromeither the server you are currently accessing or from another server.

a.

Click Import and then locate the .csv file containing the keywords.

b.

Click Open.
A message appears, informing you if the import was successful. If a
keyword to be imported already exists in the list, it will be skipped.

3-28

Policy Resources9.

To delete keywords, select the keywords and click Delete.

10. To export keywords:
Note
Use the "export" feature to back up the keywords or to import them toanother server. All keywords in the keyword list will be exported. It is notpossible to export individual keywords.

a.

Click Export.

b.

Save the resulting .csv file to your preferred location.

11. Click Save.
Importing a Keyword List

Use this option if you have a properly-formatted .dat file containing the
keyword lists. You can generate the file by exporting the keyword lists fromeither the server you are currently accessing or from another server.
Procedure
1.

Go to Policies > Policy Resources > DLP Data Identifiers.

2.

Click the Keyword tab.

3.

Click Import and then locate the .dat file containing the keyword lists.

4.

Click Open.
A message appears, informing you if the import was successful. If a
keyword list to be imported already exists, it will be skipped.

Data Loss Prevention Templates
A DLP template combines DLP data identifiers and logical operators (And,Or, Except) to form condition statements. Only files or data that satisfy acertain condition statement will be subject to a DLP policy.
3-29Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

For example, a file must be a Microsoft Word file (file attribute) AND
must contain certain legal terms (keywords) AND must contain ID numbers(expressions) for it to be subject to the "Employment Contracts" policy.
This policy allows Human Resources personnel to transmit the filethrough printing so that the printed copy can be signed by an employee.
Transmission through all other possible channels, such as email, is blocked.
You can create your own templates if you have configured DLP data
identifiers. You can also use predefined templates. For details, see Custom
DLP templates on page 3-30 and Predefined DLP Templates on page 3-30.
Note
It is not possible to delete a template that is being used in a DLP policy.
Remove the template from the policy before deleting it.

Predefined DLP Templates
Data Loss Prevention comes with the following set of predefined templates
that you can use to comply with various regulatory standards. These
templates cannot be modified or deleted.
• GLBA: Gramm-Leach-Billey Act• HIPAA: Health Insurance Portability and Accountability Act• PCI-DSS: Payment Card Industry Data Security Standard• SB-1386: US Senate Bill 1386
• US PII: United States Personally Identifiable Information
For a detailed list on the purposes of all predefined templates, and examplesof data being protected, see the Data Protection Lists document at:
http://docs.trendmicro.com/en-us/enterprise/data-protection-referencedocuments.aspx

Custom DLP templates
Create your own DLP templates if you have configured data identifiers.
3-30

Policy Resources

A DLP template combines data identifiers and logical operators (And, Or,
Except) to form condition statements.
For more information and examples on how condition statements andlogical operators work, see Condition statements and logical pperators on page
3-31.

Condition statements and logical pperators
Apply conditions and operators to custom DLP templates.
Data loss prevention evaluates condition statements from left to right. Use
logical operators carefully when configuring condition statements. Incorrect
usage leads to an erroneous condition statement that will likely produce
unexpected results.
See the examples in the following table.
Table 3-4. Sample condition statements
Condition statement

Interpretation and example[Data Identifier1] And [Data
Identifier 2] Except [Data
Identifier 3]

A file must satisfy [Data Identifier 1] and [Data Identifier 2] but
not [Data Identifier 3].
For example:
A file must be [an Adobe PDF document] and must contain [anemail address] but should not contain [all of the keywords inthe keyword list].

[Data Identifier 1] Or [Data
Identifier 2]

A file must satisfy [Data Identifier 1] or [Data Identifier 2].
For example:
A file must be [an Adobe PDF document] or [a Microsoft Word
document].

Except [Data Identifier 1]

A file must not satisfy [Data Identifier 1].
For example:
A file must not be [a multimedia file].

As the last example in the table illustrates, the first data identifier in thecondition statement can have the "Except" operator if a file must not satisfy
3-31

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

all of the data identifiers in the statement. In most cases, however, the firstdata identifier does not have an operator.

Creating a Template
Procedure
1.

Go to Policies > Policy Resources > DLP Templates.

2.

Click Add.
A new screen displays.

3.

Type a name for the template. The name must not exceed 100 bytes inlength and cannot contain the following characters:• ><*^|&?\/

4.

Type a description that does not exceed 256 bytes in length.

5.

Select data identifiers and then click the "add" icon.
When selecting definitions:• Select multiple entries by pressing and holding the CTRL key andthen selecting the data identifiers.
• Use the search feature if you have a specific definition in mind. You
can type the full or partial name of the data identifier.
• Each template can contain a maximum of 30 data identifiers.

3-32

6.

To create a new expression, click Expressions and then click Add
new expression. In the screen that appears, configure settings for the
expression.

7.

To create a new file attribute list, click File attributes and then click Add
new file attribute. In the screen that appears, configure settings for the
file attribute list.

8.

To create a new keyword list, click Keywords and then click Add new
keyword. In the screen that appears, configure settings for the keyword
list.

Policy Resources

9.

If you selected an expression, type the number of occurrences, whichis the number of times an expression must occur before Data Loss
Prevention subjects it to a policy.

10. Choose a logical operator for each definition.
Note
Use logical operators carefully when configuring condition statements.
Incorrect usage leads to an erroneous condition statement that will likely
produce unexpected results. For examples of correct usage, see Condition
statements and logical pperators on page 3-31.

11. To remove a data identifier from the list of selected identifiers, click thetrash bin icon.
12. Below Preview, check the condition statement and make changes if thisis not your intended statement.
13. Click Save.

Importing Templates
Use this option if you have a properly-formatted .dat file containing thetemplates. You can generate the file by exporting the templates from either
the server you are currently accessing or from another server.

Procedure
1.

Go to Policies > Policy Resources > DLP Templates.

2.

Click Import and then locate the .dat file containing the templates.

3.

Click Open.
A message appears, informing you if the import was successful. If atemplate to be imported already exists, it will be skipped.

3-33

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Intrusion Prevention Rules
The Intrusion Prevention Rules screen displays the Intrusion Prevention
Rules supported by Trend Micro Apex Central Vulnerability Protection.
Intrusion Prevention Rules examine the actual content of network packets(and sequences of packets). Based on the conditions set within the Intrusion
Prevention Rule, various actions are then carried out on these packets. These
actions include replacing specifically defined or suspicious byte sequences,or completely dropping packets and resetting the connection.
• To filter the list of rules, use the Search box to specify full or partial
strings that appear in any of the columns.
• To sort the list of Intrusion Prevention Rules by column data, click acolumn heading.
• To view detailed Intrusion Prevention Rule Properties, click the link in
the Rule Name column of a rule.
• To exclude traffic from one or more source endpoints from Vulnerability
Protection scanning, click Configure Exceptions and specify the source
IP addresses.
Note
You can add up to 100 entries to the exception list.
NoteTrend Micro Apex Central automatically imports/updates Intrusion
Prevention Rules from the Apex One server during manual or scheduled
component updates.

3-34

Policy Resources

Important
Each managed product provides different policy settings that you canconfigure and deploy to policy targets. You can find a complete list of
supported managed products and the policy settings for each in the Apex
Central as a Service Widget and Policy Management Guide.
You can download a PDF version of the guide, or view the guide online, using
the following link:
https://docs.trendmicro.com/en-us/enterprise/apex-one-as-a-service.aspx

The following table outlines the rule information that displays on the
Intrusion Prevention Rules screen.
Description

ColumnIdentifier

The unique identifier tag for the Intrusion Prevention Rule

Rule Name

The name of the Intrusion Prevention Rule

Application TypeThe Application Type this Intrusion Prevention Rule is grouped under

Severity

The severity level that Trend Micro assigns to the rule
Note
The severity of a rule has no effect on how the rule is
implemented or applied. Severity levels can be useful assorting criteria when viewing a list of Intrusion Prevention
Rules.

Mode

The network engine detection mode used by the Intrusion Prevention
module. Click a mode to configure the setting for the rule.

3-35

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

ColumnType

Description
The type of vulnerability detected:• Smart: Known or unknown (for example, zero-day) vulnerability• Exploit: Known exploit (usually signature based) for a known
vulnerability• Vulnerability: Known vulnerability for which one or more
exploits may exist

CVE

The Common Vulnerabilities and Exposures (CVE®) identifier that
MITRE assigns to the vulnerability
For more information, see http://cve.mitre.org/.

Microsoft

The Common Vulnerabilities and Exposures (CVE®) identifier that
Microsoft assigns to the vulnerability

CVSS Score

The Common Vulnerability Scoring System (CVSS) severity score of thevulnerability according the National Vulnerability Database
For more information, see http://nvd.nist.gov/cvss.cfm.

Last Updated

The date and time the rule was last modified

Intrusion Prevention Rule Properties
The Intrusion Prevention Rule Properties screen displays detailed
information about a specific Intrusion Prevention Rule and vulnerability.
Click the General tab or the Vulnerability to view details about the rule.
The following tables describe the information provided on the General tab
and Vulnerability tab.
Table 3-5. General Information
Data

3-36

Description

Identifier

The unique identifier tag for the Intrusion Prevention RuleName

The name of the Intrusion Prevention Rule

Policy Resources

Data
Description

Description
The description of the Intrusion Prevention Rule
Note
Apex One Vulnerability Protection does not support theconfiguration options available on the standalone version ofTrend Micro Vulnerability Protection.

Application TypeThe Application Type this Intrusion Prevention Rule is grouped underPriority

The priority level of the Intrusion Prevention Rule. Higher priority rules
are applied before lower priority rules.

Severity

The severity level that Trend Micro assigns to the rule
Note
The severity of a rule has no effect on how the rule is
implemented or applied. Severity levels can be useful assorting criteria when viewing a list of Intrusion Prevention
Rules.

Mode

The network engine detection mode used by the Intrusion Prevention
module. Click a mode to configure the setting for the rule.

Type

The type of vulnerability detected:• Smart: Known or unknown (for example, zero-day) vulnerability• Exploit: Known exploit (usually signature based) for a known
vulnerability• Vulnerability: Known vulnerability for which one or more
exploits may exist

IssuedThe date the rule was released (not downloaded)

Last Updated

The date and time the rule was last modified

3-37

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Table 3-6. Vulnerability Information
Data

Description

Severity

The severity level of the vulnerability

CVSS Score

The Common Vulnerability Scoring System (CVSS) severity score of thevulnerability according the National Vulnerability Database
For more information, see http://nvd.nist.gov/cvss.cfm.

Description

The description of the vulnerability

External References

Provides links to external references for more information about thevulnerability

Device Control Allowed Devices
Import or export lists of Device Control Allow Devices that apply to all Apex
One Security Agent policy targets.
Note• Only Security Agents with Data Protection enabled override the “Block”
or “Read” action on devices added to the Device Control Allowed Devices
list.
• The Device Control Allowed Devices list does not apply to Security
Agents without Data Protection and Security Agents with Device Control
permission not set to “Block” or “Read”.

3-38

Policy Resources

Item
ImportDescription
Select a properly formatted CSV file containing a list of all the devices
you want to allow on all Apex One Security Agent endpoints.
Important
Importing a new list overwrites the previous list completely.
To retain the existing list, export the list before importing a
new CSV file.

Last imported

The date/time the server imported the current list

Total allowed devices

The total number of allowed devices in the currently applied list

ExportExports the current allowed list in CSV format

3-39

Part II
Apex Central Widgets

Chapter 4

Apex Central Dashboard Widgets
This section contains help topics for Apex Central specific widgets supported
on the Apex Central as a Service dashboard.
Topics include:

4-1

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Apex Central Top File-based Threats Widgets
This widget tracks the distribution of the top malicious files detected on
endpoints across the network and displays the product-detected distribution
as one of the top 10/25/50 file-based threats (viruses and spyware/grayware).
Click any node in the graph to open a screen that displays detailed
information. Apex Central performs log query to provide the detailed
information.
Specify the date range for the data that the widget displays:• Today• Last 7 days
• Last 14 days
• Last 30 days
Specify the threat for the widget to display. The widget can display data for
only one file-based threat at a time. By default the widget displays data fromall the managed products that a user's account privileges allow.
Click the widget settings icon on the widget to access additional settings.
Setting

Description

Title

Specify a new and meaningful title for the widget in the field.

ScopeSpecify the data scope displayed by the widget.
The scope determines the products which the widget uses to display
data.

Top ThreatsSpecify the number of threats to display.

Click Save to apply changes and update the widget data.

Endpoint Protection Verification Widget
This widget displays the Apex One and Deep Security protection status ofendpoints from an integrated Active Directory structure.
4-2

Apex Central Dashboard Widgets

Important
Before using this widget:• Synchronize the Apex One client tree with the Active Directory tree.
Refer to the Apex One documentation for further instructions.
• Go to Administration > Settings > Endpoint Protection Verification to
enable the widget and configure Active Directory server, Apex One server,and Deep Security server connection settings.

Click the settings icon (>) to configure the following:• Apex One servers: Click the browse button (servers that contribute data for the widget.

) to specify the Apex One• Deep Security servers: Click the browse button ( ) to specify the Deep
Security servers that contribute data for the widget.
• Columns: Specify the columns for the widget to display in the data table.
Click an organization unit in the Active Directory structure to view thefollowing the information.
Description

ColumnComputer

Displays the endpoint name

Apex One

Displays whether the endpoint is protected by an Apex One or VDI
clientDeep Security

Displays whether the endpoint is protected by a Deep Security agent

Physical Host

Displays the physical server where virtual endpoints reside

Pattern

Displays the version of the pattern file that the Apex One or VDI client
uses

Scan Engine

Displays the version of the scan engine that the Apex One or VDI client
uses

Client Version

Displays the client program version

4-3

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

ColumnDescription

Deep Security Profile

Displays the Deep Security profile in use

Server Name

Displays the Apex One and/or Deep Security server with which theendpoints connect

Hosts with C&C Callback Attempts Widget
This widget displays the total unique compromised hosts and groups them by
C&C list source.
The default view displays data for the current day.
Use the Range drop-down to select the time period for the data that displays.
You can view data for Today, Last 7 days, Last 14 days, or Last 30 days.
Data

Description

Hosts matched with Global Intelligence

C&C callbacks detected by Trend Micro
Global Intelligence network, including SmartProtection Network.

Hosts matched with dynamic analyzers

C&C callbacks detected by dynamic analyzers,
including Virtual Analyzer and the Network
Content Inspection Engine.
Analyzers are built in to products such as
Deep Discovery Inspector and Apex One.

Hosts matched with user-defined lists inmanaged products

C&C callbacks detected by products using auser-defined list.
An example of a user-defined list is the Deny
List in Deep Discovery Inspector.

Policy Status
This widget displays the deployment status of your policies.
Clicking the name of a policy or the number of targets opens a new Log
Query screen to provide detailed information.

4-4

Apex Central Dashboard Widgets

Data

Description

Policy

Displays the name of the policy

Deployment Status

Displays the percentage of targets that comply with the policy settings

Deployed

Displays the number of targets that have applied the policy settings orhave unactivated product services

Pending

Displays the number of targets that have not applied the policy
settings
Note
If Hotfix 2575 is not installed, the Pending column includes
the number of targets that have offline agents.

Offline

Displays the number of targets that have offline agents
Important
This feature requires installing Hotfix 2575. Otherwise, thePending column includes the number of targets that haveoffline agents and the Offline column does not display.

With Issues

Displays the number of targets that have not applied thepolicy settings due to unsupported policy deployment, no policy
configuration, system errors, endpoint communication errors withthe product server, unsupported endpoints, locally changed settings,
disabled product services, or partial deployment

Endpoints/Products
without policies

Displays the number of endpoints or managed products with no policy
appliedTotal endpoints/
products

Displays the number of endpoints or managed products theadministrator can manage

Quick LaunchThis widget displays shortcuts to the Product Directory and Policy
Management.

4-5

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Unique Compromised Hosts Over Time Widget
This widget displays the unique compromised hosts logged by managed
products within the last 30 days.
This widget groups and displays the unique compromised hosts as circles.
The circle size relatively represents the number of compromised hosts.
• Small: 1 to 5
• Medium: 6 to 10• Large: 11 or more
Mouse-over a computer icon or host name to display additional
compromised hosts.
Use the Callback address drop-down to display compromised hosts that had
callback attempts to the selected callback address.
Note
The Callback address drop-down contains the top 25 callback addresses.
The widget only displays the first callback attempt from a compromised hostto the selected callback address.

Change the managed products that the widget uses as its source by clicking
the settings icon ( > ). In the dialog box that appears, specify the Scopeby clicking
and selecting the managed products to use as the source.

4-6

Part III
Apex One Widgets

Chapter 5

Apex One Dashboard Widgets
This section describes the available Apex One dashboard widgets in Trend
Micro Apex Central.
Topics include:

5-1

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Top Blocked Applications
This widget provides an overview of the top applications that users
attempted to access in violation of an Application Control policy.
Use the settings button to change the default number of applications that
display.

Top Endpoints Affected by IPS Events Widget
This widget provides information about the endpoints affected by the most
IPS events detected. IPS events are triggered by Intrusion Prevention Rules
for Vulnerability Protection.
Use the Period drop-down to select the time range for the data that displays.
Use the settings icon (endpoints to display.

>) to change the default number of affected
Description

Data
Endpoint

The name of the endpoint

IP Address

The IP address of the endpoint

Detections

The number of IPS events detected on the endpointTop IPS Attack Sources
This widget provides information about the top attack sources for IPS events
detected on your network. IPS events are triggered by Intrusion Prevention
Rules for Vulnerability Protection.
Use the Period drop-down to select the time range for the data that displays.
Use the settings icon (sources to display.

5-2>) to change the default number of attack

Apex One Dashboard Widgets

Data

Description

Attack Source

The IP address of the known attack source

Location

The location of the attack source

Detections

The number of IPS events detected on the endpointTop IPS Events
This widget provides information about the Intrusion Prevention Rules
triggering the most IPS events on your network. IPS events are triggered
by Intrusion Prevention Rules for Vulnerability Protection.
Use the Period drop-down to select the time range for the data that displays.
You can also use the second drop-down to display only the top Detected orPrevented IPS events.
Use the settings icon ( > ) to change the default number of triggered
Intrusion Prevention Rules to display.
Data

Description

Rule Name

The name of the Intrusion Prevention Rule

Severity

The severity level that Trend Micro assigns to the rule

Total

The number of IPS events triggered by the Intrusion
Prevention Rule

Top Violated Application Control Criteria
This widget provides an overview of the top Application Control criteria thatusers triggered while attempting to access unauthorized applications.
Use the settings button to change the default number of matches that display.

5-3

Part IV
Apex One Security Agent Policies

Chapter 6

Security Agent Program Settings
This section describes how you can manage the Security Agent program
installed on endpoints.
Topics include:

6-1

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Additional Service Settings
The Security Agent program requires that you enable additional services
in order to allow certain features to function properly. The following table
describes the available services and the features that require each service.
Service

Description

Unauthorized Change
Prevention Service(TMBMSRV.exe)

Regulates application
behavior andverifies program
trustworthinessFeatures• Predictive Machine Learning• Behavior Monitoring• Device Control• Certified Safe Software Service• Agent Self-protection

Firewall Service(TmPfw.exe)

Regulates network
connection accesspermissions• Apex One Firewall

Suspicious
Connection Service

Provides advanced
protection against
C&C callbacks• User-defined IP Approved and Blocked
Lists• Global C&C IP List (Network Content
Inspection Engine)• Malware network fingerprinting(Relevance Rule Pattern)

Data Protection
Service(dsagent.exe)

Provides advanced
monitoring ofsensitive data andrestricts device
access on endpoints• Data Loss Prevention

Advanced
Protection Service(TMCCSF.exe))

Facilitates advanced
scanning andprotection features• Predictive Machine Learning• Device Control (Block access)• Data Discovery (managed using theTrend Micro Apex Central console)• Browser Exploit Prevention• Behavior Monitoring

Configuring Additional Security Agent Services
Select to enable the required service on Windows desktops or Windows
Server platforms.
6-2

Security Agent Program Settings

Service
Unauthorized
ChangePrevention
Service

Additional Notes
For Windows Server platforms, select the level of protection to enable.
• Full mode: Enables all services and provides full access to all features• Performance mode: Enables a lightweight version of the service that
only allows the following features to be enabled and ignores all othersettings available in Full mode:• Behavior Monitoring > Enable Malware Behavior Blocking> Protect documents against unauthorized encryption or
modification
Important
Performance mode does not automatically enable any
settings. After enabling a specific feature, the Unauthorized
Change Prevention Service only enables the supported
feature and ignores all unsupported settings.

Firewall Service

Important
Enabling or disabling the service temporarily disconnects
endpoints from the network. Ensure that you change the settings
only during non-critical hours to minimize connection disruptions.

Suspicious
Connection
Service-

Data Protection
Service

Advanced
Protection
Service

Important
Enabling or disabling the service temporarily disconnects
endpoints from the network. Ensure that you change the settings
only during non-critical hours to minimize connection disruptions.
-6-3

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Important
Enabling additional services on Windows Server platforms may affect server
performance. After enabling a service on a Windows Server platform, Trend
Micro recommends that you monitor the server for some time to ensure thatno performance impact occurred.

Privileges and Other Settings
Configure Security Agents to grant users rights to configure personalized
settings, to display notification messages, and to protect critical Security
Agent files and services.

Configuring Agent Privileges
Procedure
1.

Configure settings as required.
SectionIndependent
Mode

Settings
Enable Independent mode: Allows users to disable the following
features on the Security Agent to prevent the Security Agent fromadversely affecting system performance:• The Security Agent does not accept policy settings from the server• The Security Agent does not initiate scan commands from theserver• The Security Agent does not send logs to the server
End users can manually initiate scans and updates on agents in
Independent mode.

Scans• Configure Manual Scan: Allows users to configure the Manual
Scan settings on the Security Agent console• Configure Real-time Scan: Allows users to configure the Realtime Scan settings on the Security Agent console• Configure Scheduled Scan: Allows users to configure theScheduled Scan settings on the Security Agent console

6-4Security Agent Program Settings

SectionScheduled
Scans

Settings• Postpone Scheduled Scan: Allows users to postpone a
Scheduled Scan before the scan starts or stop a currently runningscan for a specified period
Note
Users can only stop a running scan once. Once thescan restarts, the Security Agent rescans all files on theendpoint.
• Skip and stop Scheduled Scan: Allows users to skip or stop arunning Scheduled Scan one time
Note
Users cannot skip or stop a Scheduled Scan more than
one time. Even after a system restart, Scheduled Scan
resumes scanning based on the next scheduled time.

6-5

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

SectionFirewallSettings• Display the Firewall settings on the Security Agent console:
Allows users to configure the Firewall settings on the Security
Agent console• Allow users to enable/disable the firewall, Intrusion
Detection System, and the firewall violation notification
message: Displays the Enable/Disable Firewall and Enable/
Disable IDS Mode menu options on the Security Agentsystem tray icon
Note
The Apex One Firewall protects agents andservers on the network using stateful inspection,high performance network virus scanning, andelimination. If you grant users the privilege to enable
or disable the firewall and its features, warn themnot to disable the firewall for an extended period oftime to avoid exposing the endpoint to intrusions
and hacker attacks.
• Allow Security Agents to send firewall logs to the Apex One
server: Configures the Security Agent to send Firewall logs to theserver, allowing you to analyze network traffic

Behavior
Monitoring

Display the Behavior Monitoring settings on the Security Agentconsole: Allows users to configure the Behavior Monitoring settings
on the Security Agent console

Trusted
Program List

Display the Trusted Program List on the Security Agent console:
Allows users to configure the Trusted Program List on the Security
Agent console

Mail Scan

Display the Mail Scan settings on the Security Agent console:
Allows users to configure the Mail Scan settings on the Security AgentconsoleIf enabled, Real-time Scan can detect and take action on POP3
email messages retrieved from the mail server that contain malicious
threats.

6-6

Security Agent Program Settings

SectionProxy Settings

Settings
Allow users to configure proxy settings: Allows users to use userconfigured proxy settings only in the following instances:• When Security Agents perform "Update Now".
• When users disable, or the Security Agent cannot detect,
automatic proxy settings.
WARNING!
Incorrect user-configured proxy settings can cause update
problems. Exercise caution when allowing users to configure
their own proxy settings.

Component
Updates• Perform "Update Now": Displays the Update Now menu option
on the Security Agent system tray icon
• Enable/Disable schedule-based updates: Displays the Enable/
Disable Schedule-based Updates menu option on the Security
Agent system tray icon
NoteAdministrators must first select the Enable schedulebased updates on Security Agents setting on the Other
Settings tab before the menu item appears on the
Security Agent menu.

6-7Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Section
Unload andUnlockSettings
The Security Agent unloading and unlocking privilege allows users to
temporarily stop the Security Agent or gain access to advanced web
console features with or without a password.
• Does not require a password• Requires a password: Type the required password andconfirmation password
Note
Passwords must meet the following complexity
requirements:• Length of 8 to 32 characters• At least one of each: uppercase (A-Z), lowercase (az), numeric (0-9), and special character• Cannot contain non-printable ASCII characters
Important
If you select Requires a password and do not specify apassword, Trend Micro Apex Central applies the following
default password:• For Apex One on-premises: The password provided
during server installation• For Apex One as a Service: The account name used toprovision the console

6-8Security Agent Program Settings

SectionSettings

Uninstallation

The Security Agent uninstallation privilege allows users to uninstall the
Security Agent program on local endpoints.
• Does not require a password• Requires a password: Type the required password andconfirmation password
Note
Passwords must meet the following complexity
requirements:• Length of 8 to 32 characters• At least one of each: uppercase (A-Z), lowercase (az), numeric (0-9), and special character• Cannot contain non-printable ASCII characters
Important
If you select Requires a password and do not specify apassword, Trend Micro Apex Central applies the following
default password:• For Apex One on-premises: The password provided
during server installation• For Apex One as a Service: The account name used toprovision the console

Configuring Other Agent Settings
Procedure
1.

Configure settings as required.

6-9

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

SectionSettings

Coexist Mode
Conversion

Permanently convert Security Agents using coexist mode into
fully-functional Security Agents: Activates all functions on Security
Agents installed in “Co-exist mode”
Important
You cannot undo this action. After converting coexist mode
Security Agents into fully-functional Security Agents, theagent program attempts to uninstall any incompatible thirdparty security software on the endpoint. After the conversion
completes, Apex One enables all necessary services andfunctions related to normal Security Agent functionality.
If you need to use a coexist mode Security Agent on aconverted endpoint, you must unistall the Security Agent
program and reinstall a coexist mode Security Agent.

UpdateSettings• Security Agents download updates from the Trend Micro
ActiveUpdate Server: Configures Security Agents that cannot
connect to the specified update source to attempt to update fromthe Trend Micro ActiveUpdate server• Enable schedule-based updates on Security Agents: Configures
all Security Agents to enable schedule-based updates by default• Security Agents only update the following components:
Controls how component updates proceed on the Security Agents• All components (including hotfixes and the agent
program): Security Agents update all components• Pattern files, engines, drivers: Security Agents do not
upgrade the Security Agent program or deploy hotfixes• Pattern files: Security Agents do not upgrade the Security
Agent program, deploy hotfixes, or update engines anddrivers

Web
Reputation
Settings

6-10

Display a notification when a website is blocked: Displays anotification message on the Security Agent after blocking a URL that
violates a Web Reputation policySecurity Agent Program Settings

SectionSettings

Behavior
Monitoring
Settings

Display a notification when a program is blocked: Displays anotification message on the Security Agent after blocking a programthat violates a Behavior Monitoring policy

C&C Contact
Alert Settings

Display a notification when a C&C callback is detected: Displays
a notification message on the Security Agent after detecting a C&C
callback

CentralQuarantine
RestoreSettings

Display a notification when a quarantined file is Restored: Displays
a notification message on the Security Agent after restoring aquarantined file

Predictive
MachineLearning
Settings

Display a notification when a threat is detected: Displays anotification message on the Security Agent after Predictive Machine
Learning detects an unknown threat

Scheduled
Scan Settings

Display a notification before a scheduled scan occurs: Displays
a notification message on the Security Agent before a configured
Scheduled Scan starts

Cache Settings
for Scans• Enable the digital signature cache: Configures the Security
Agent to use the Behavior Monitoring Digital Signature Pattern
to exclude files from Manual Scans, Scheduled Scans, and ScanNow
• Enable the on-demand scan cache: Configures the Security
Agent to maintain a local on-demand scan cache to exclude fileduring Manual Scan, Scheduled Scan, and Scan Now to improvescan performance
For more information, see Cache Settings for Scans on page 6-12.

POP3 EmailScan Settings

Scan POP3 email: Enables POP3 mail scanning on the Security Agent
For more information, see POP3 Mail Scan on page 6-15.

6-11

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

SectionSettings

Security Agent
AccessRestriction

Do not allow users to access the Security Agent console from thesystem tray or Windows Start menu: Disables user access to the
Security Agent console using the system tray or Windows Start menu
NoteThis setting does not disable the Security Agent. The Security
Agent runs in the background and continues to provide
protection from security risks.

RestartNotification

Display a notification if the endpoint needs to restart to finish
cleaning infected files: Displays a notification message on the
Security Agent if the user needs to restart the endpoint to finish
cleaning a malicious file

Cache Settings for Scans
The Security Agent can build the digital signature and on-demand scan cache
files to improve its scan performance. When an on-demand scan runs, theSecurity Agent first checks the digital signature cache file and then the ondemand scan cache file for files to exclude from the scan. Scanning time is
reduced if a large number of files are excluded from the scan.

Digital Signature Cache
The digital signature cache file is used during Manual Scan, Scheduled Scan,
and Scan Now. Agents do not scan files whose signatures have been added tothe digital signature cache file.
The Security Agent uses the same Digital Signature Pattern used for Behavior
Monitoring to build the digital signature cache file. The Digital Signature
Pattern contains a list of files that Trend Micro considers trustworthy andtherefore can be excluded from scans.

6-12Security Agent Program Settings

Note
Behavior Monitoring is automatically disabled on Windows server platforms.
If the digital signature cache is enabled, Security Agents on these platforms
download the Digital Signature Pattern for use in the cache and do not
download the other Behavior Monitoring components.

Agents build the digital signature cache file according to a schedule, which is
configurable from the web console. Agents do this to:• Add the signatures of new files that were introduced to the system since
the last cache file was built• Remove the signatures of files that have been modified or deleted fromthe system
During the cache building process, agents check the following folders fortrustworthy files and then adds the signatures of these files to the digital
signature cache file:• %PROGRAMFILES%• %WINDIR%
The cache building process does not affect the endpoint's performance
because agents use minimal system resources during the process. Agentsare also able to resume a cache building task that was interrupted for somereason (for example, when the host machine is powered off or when awireless endpoint's AC adapter is unplugged).

On-demand Scan Cache
The on-demand scan cache file is used during Manual Scan, Scheduled Scan,
and Scan Now. Security Agents do not scan files whose caches have been
added to the on-demand scan cache file.
Each time scanning runs, the Security Agent checks the properties of threatfree files. If a threat-free file has not been modified for a certain period oftime (the time period is configurable), the Security Agent adds the cache of
the file to the on-demand scan cache file. When the next scan occurs, the file
will not be scanned if its cache has not expired.
6-13

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

The cache for a threat-free file expires within a certain number of days (thetime period is also configurable). When scanning occurs on or after thecache expiration, the Security Agent removes the expired cache and scans
the file for threats. If the file is threat-free and remains unmodified, thecache of the file is added back to the on-demand scan cache file. If the file isthreat-free but was recently modified, the cache is not added and the file will
be scanned again on the next scan.
The cache for a threat-free file expires to prevent the exclusion of infected
files from scans, as illustrated in the following examples:• It is possible that a severely outdated pattern file may have treated an
infected, unmodified file as threat-free. If the cache does not expire, theinfected file remains in the system until it is modified and detected by
Real-time Scan.
• If a cached file was modified and Real-time Scan is not functional during
the file modification, the cache needs to expire so that the modified filecan be scanned for threats.
The number of caches added to the on-demand scan cache file depends on
the scan type and its scan target. For example, the number of caches may beless if the Security Agent only scanned 200 of the 1,000 files in the endpoint
during Manual Scan.
If on-demand scans are run frequently, the on-demand scan cache file
reduces the scanning time significantly. In a scan task where all caches are
not expired, scanning that usually takes 12 minutes can be reduced to 1
minute. Reducing the number of days a file must remain unmodified andextending the cache expiration usually improve the performance. Since files
must remain unmodified for a relatively short period of time, more caches
can be added to the cache file. The caches also expire longer, which meansthat more files are skipped from scans.
If on-demand scans are seldom run, you can disable the on-demand scancache since caches would have expired when the next scan runs.

6-14

Security Agent Program Settings

POP3 Mail Scan
When Security Agents have the mail scan privileges, the Mail Scan option
displays on the Security Agent console. The Mail Scan option shows the POP3
mail scan.
The following table describes the POP3 mail scan program.
Table 6-1. Mail Scan Programs
Details
PurposePrerequisites

Description
Scans POP3 email messages for viruses/malware• Must be enabled by administrators from the web console
before users can use it
Note
You must enable the Display the Mail Scan settings
on the Security Agent console privilege to enable
POP3 mail scanning.
For more information, see Configuring Agent
Privileges on page 6-4.
• Action against viruses/malware configurable from the
Security Agent console but not from the web console

Scan types supported

Real-time Scan
Scanning is done as email messages are retrieved from the POP3
mail server.

Scan results• Information about detected security risks available afterscanning is complete• Scan results not logged on the Security Agent console's Logs
screen• Scan results not sent to the server

6-15

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Update Agents
To distribute the task of deploying components, domain settings, or agent
programs and hotfixes to Security Agents, assign some Security Agents to act
as Update Agents, or update sources for other Security Agents. This helps
ensure that Security Agents receive updates in a timely manner without
directing a significant amount of network traffic to the Apex One server.
If the network is segmented by location and the network link between
segments experiences a heavy traffic load, assign at least one Update Agenton each location.
Note
Security Agents assigned to update components from an Update Agent only
receive updated components and settings from the Update Agent. All Security
Agents still report their status back to the Apex One server.

Assigning Security Agents as Update Agents
Procedure1.

Select the items that Update Agents can share.
• Component updates• Domain settings• Security Agent programs and hot fixes

6-16

Chapter 7

Application Control Policy Settings
This section discusses how to configure Application Control policies on
Security Agents.
Topics include:

7-1

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Application Control
Application Control provides you with the ability to control which users haveaccess to specific applications on certain endpoints. You have the optionof creating an overall endpoint-based policy or, if integrated with Active
Directory, very granular user-based policies per endpoint.
After determining the scope of the policy, you can create application
matching criteria that define which applications to allow, block, or monitor.
For experienced users, you can create “Lockdown” criteria that only allow
trusted applications to execute and block all applications not explicitly
allowed by the rules.

Configuring Application Control Settings (Agent)
Before configuring an Application Control policy, ensure that you define all
required Application Control criteria. Application Control policies require
the use of preconfigured criteria that define which applications you want to“Allow” or “Block” on an endpoint or for a particular user.
For more information, see Application Control Criteria on page 3-2.
Procedure1.

Select Enable Application Control.

2.

In the User-defined Rules section, assign rules to the endpoint based on
the logged on user account.
Important• User-based Application Control is only available if you haveintegrated Active Directory. If you do not have Active Directory
integration, you can only assign criteria to the default All user
accounts rule.
• You cannot delete the default All user accounts rule.

a.
7-2

Add a new rule or modify an existing rule.

Application Control Policy Settings• To add a new rule, click Assign Rule.
• To modify an existing rule, click the value in the User Accounts
column of the table.
The Assign Rule screen appears.
b.

Specify the User Accounts to which you want to apply specific
Application Control criteria.
Important• User-based Application Control is only available if you haveintegrated Active Directory. If you do not have Active Directory
integration, you can only assign rules to the default All user
accounts rule.
• You can only assign 30 users or groups per rule. Create
additional rules if you need to assign a greater number of users
to a policy.

c.

Move the necessary criteria to the Selected criteria table by clicking
the criteria Name.

d.

Click Save.
Note
To change the Priority order of rules, select and drag rules to different
locations in the list. Application Control applies a first match rule tousers included in multiple rules.

3.

In the Additional Actions section, specify the action Application Control
takes when a user attempts to execute an application that does notmatch any of the User-defined Rule criteria.
• Allow: All other applications can execute: Application Control
takes no action on applications that do not match any of the Userdefined Rule criteria. Choose when using Application Control toblock or monitor application usage.
7-3

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide• Lockdown: Block all applications not identified during the last
inventory scan: After endpoints receive this command, Application
Control takes the following actions:a. Application Control scans the endpoint and creates a complete
application inventory.
b. Application Control “locks down” the endpoint and does not
permit access to:• Any application that does not specifically match Allow
criteria defined in the User-defined Rule table• Any application that does not specifically matchassessment criteria defined in the User-defined Rule table• Any application not found in the inventory scan results forthat particular endpoint• Exclude applications by Trend Micro trusted vendors: Selectto automatically allow all applications that Trend Micro threat
experts have determined come from trusted vendors• Enable assessment mode: Select to log access to applications
not specifically allowed to execute during Lockdown but do notblock the applications
Tip
Use assessment mode to determine which applications users
may require before you completely block access to allapplications you did not add to Allow Rules.

4.

In the Agent Notifications section, select Display a notification when
an application is blocked to display a notification on the endpoint when
Application Control blocks an application.

5.

In the Log Maintenance section:• Maximum log age (in days): Specify the maximum number of days
that the endpoint should keep log data

7-4

Application Control Policy Settings• Maximum number of logs a Security Agent can send each hour
per criteria: Specify the maximum number of logs each Security
Agent can send to the Apex One server every hour for each criteria
rule
Note
Depending on the number of Security Agents and your network
settings, the amount of network traffic that the server receives may
cause performance issues.
Important
You must remember to Deploy or Save your Apex One Security Agent
policy before leaving the screen. If you do not save the entire policy, youlose all changes.

7-5Chapter 8

Behavior Monitoring Policy Settings
This section describes how to configure Behavior Monitoring policies on
Security Agents.
Topics include:

8-1

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Behavior Monitoring
Behavior Monitoring constantly monitors endpoints for unusual
modifications to the operating system or on installed software. Behavior
Monitoring protects endpoints through Malware Behavior Blocking andEvent Monitoring. Complementing these two features are a user-configured
exception list and the Certified Safe Software Service.
Important
By default, Behavior Monitoring is disabled on all versions of Windows Server
platforms.

Malware Behavior Blocking
Malware Behavior Blocking provides a necessary layer of additional threatprotection from programs that exhibit malicious behavior. It observes
system events over a period of time. As programs execute different
combinations or sequences of actions, Malware Behavior Blocking detects
known malicious behavior and blocks the associated programs. Use thisfeature to ensure a higher level of protection against new, unknown, andemerging threats.
Malware Behavior Monitoring provides the following threat-level scanning
options:• Known threats: Blocks behaviors associated with known malware
threats• Known and potential threats: Blocks behavior associated with known
threats and takes action on behavior that is potentially malicious
After blocking a program with notifications enabled, the Security Agent
displays a notification on the endpoint.

Ransomware Protection
Ransomware Protection prevents the unauthorized modification or
encryption of files on agents by “ransomware” threats. Ransomware is a type8-2

Behavior Monitoring Policy Settingsof malware which restricts access to files and demands payment to restore
the affected files.
Apex One provides the following methods to protect your environment fromransomware threats.
Note
To reduce the chance of the Security Agent detecting a safe process as
malicious, ensure that the agent has Internet access to perform additionalverification processes using Trend Micro servers.

8-3

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

OptionDescription

Protect
documents against
unauthorizedencryption or
modification

You can configure Behavior Monitoring to detect a specific sequenceof events that may indicate a ransomware attack. After Behavior
Monitoring matches all of the following criteria, the Security Agentterminates and attempts to quarantine malicious programs:
1. A process not recognized as safe attempts to modify, delete, or
rename three files within a certain time interval.
2. The process attempted to modify a protected file extension type
Additionally enable Automatically back up files changed bysuspicious programs to create copies of files being encrypted on
endpoints. After the encryption process completes and Apex One
detects a ransomware threat, Apex One prompts end users to restore
the affected files without suffering any loss of data.
Note
Automatic file backup requires at least 100 MB of disk spaceon the agent endpoint and only backs up files that are lessthan 10 MB in size.
The backup folder location on agent endpoints is: <Agent
installation folder>\CCSF\module\DRE\data.
WARNING!
If Automatically back up files changed by suspicious
programs is not enabled, Apex One cannot recover the first
files affected by a ransomware threat.

Block processes
commonlyassociated withransomware

8-4

Ransomware commonly distributes executable files in specificlocations on endpoints before attempting to hijack files. Blocking
the processes started from these locations can help prevent theransomware from being able to hijack files.

Behavior Monitoring Policy Settings

OptionEnable program
inspection to
detect andblock compromised
executable files

Description
Program inspection monitors processes and performs API hooking
to determine if a program is behaving in an unexpected manner.
Although this procedure increases the overall detection ratio ofcompromised executable files, it may result in decreased system
performance.
Tip
Program inspection provides increased security if you selectKnown and potential threats in the Threats to block dropdown.

Anti-Exploit Protection
Anti-exploit protection works in conjunction with program inspection tomonitor the behavior of programs and detect abnormal behavior that
may indicate that an attacker has exploited a program vulnerability. Once
detected, Behavior Monitoring terminates the program processes.
ImportantAnti-exploit Protection requires that you select Enable program inspection to
detect and block compromised executable files.

Newly Encountered Program Protection
Behavior Monitoring works in conjunction with Web Reputation Services
and Real-time Scan to verify the prevalence of files downloaded throughweb channels, email applications, or Microsoft Office macro scripts. After
detecting a "newly encountered" file, administrators can choose to prompt
users before executing the file. Trend Micro classifies a program as newly
encountered based on the number of file detections or historical age of thefile as determined by the Smart Protection Network.
Behavior Monitoring scans the following file types for each channel:• Web (HTTP/HTTPS): Scans .exe files.

8-5Trend Micro Apex Central™ as a Service Widget and Policy Management Guide• Email applications: Scans .exe, and compressed .exe files in
unencrypted .zip and .rar files.
Note• Administrators must enable Web Reputation Services on the agent toallow the Security Agent to scan HTTP or HTTPS traffic before thisprompt can display.
• The Security Agent matches the file names downloaded through email
applications during the execution process. If the file name has beenchanged, the user does not receive a prompt.

Event Monitoring
Event Monitoring provides a more generic approach to protecting against
unauthorized software and malware attacks. It monitors system areas forcertain events, allowing administrators to regulate programs that trigger
such events. Use Event Monitoring if you have specific system protection
requirements that are above and beyond what is provided by Malware
Behavior Blocking.
The following table provides a list of monitored system events.
Table 8-1. Monitored System Events
Events8-6

Description

AI App Guard

Configure this policy to protect AI-integrated applications and related
files from malicious modifications.

Duplicated System
File

Many malicious programs create copies of themselves or othermalicious programs using file names used by Windows system files.
This is typically done to override or replace system files, avoid
detection, or discourage users from deleting the malicious files.

Hosts File
Modification

The Hosts file matches domain names with IP addresses. Many
malicious programs modify the Hosts file so that the web browser
is redirected to infected, non-existent, or fake websites.

Behavior Monitoring Policy Settings

EventsDescription

Suspicious Behavior

Suspicious behavior can be a specific action or a series of actions
that is rarely carried out by legitimate programs. Programs exhibiting
suspicious behavior should be used with caution.

New Internet Explorer
PluginSpyware/grayware programs often install unwanted Internet Explorer
plugins, including toolbars and Browser Helper Objects.

Internet Explorer
Setting Modification

Malware programs may change Internet Explorer settings, including
the home page, trusted websites, proxy server settings, and menu
extensions.

Security Policy
Modification

Modifications in Windows Security Policy can allow unwanted
applications to run and change system settings.

Program Library
Injection

Many malicious programs configure Windows so that all applications
automatically load a program library (DLL). This allows the malicious
routines in the DLL to run every time an application starts.

Shell Modification

Many malicious programs modify Windows shell settings to associatethemselves to certain file types. This routine allows malicious
programs to launch automatically if users open the associated files
in Windows Explorer. Changes to Windows shell settings can also allow
malicious programs to track the programs used and start alongsidelegitimate applications.

New Service

Windows services are processes that have special functions andtypically run continuously in the background with full administrative
access. Malicious programs sometimes install themselves as services
to stay hidden.

System File
Modification

Certain Windows system files determine system behavior, including
startup programs and screen saver settings. Many malicious programs
modify system files to launch automatically at startup and control
system behavior.

Firewall Policy
Modification

The Windows Firewall policy determines the applications that haveaccess to the network, the ports that are open for communication,and the IP addresses that can communicate with the computer. Many
malicious programs modify the policy to allow themselves to access tothe network and the Internet.

8-7

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

EventsDescription

System Process
Modification

Many malicious programs perform various actions on built-in
Windows processes. These actions can include terminating or
modifying running processes.

New Startup Program

Malicious applications usually add or modify autostart entries in the
Windows registry to automatically launch every time the computer
starts.

When Event Monitoring detects a monitored system event, it performs theaction configured for the event.
The following table lists possible actions that administrators can take onmonitored system events.
Table 8-2. Actions on Monitored System Events
ActionAssessDescription
The Security Agent always allows programs associated with an event to
run and logs the event for assessment.
This is the default action for all monitored system events.
Note
This option is not supported for the Program Library Injection(DLL injection) event on 64-bit systems.

Allow

8-8

The Security Agent always allows programs associated with an event torun.

Behavior Monitoring Policy Settings

ActionDescription

Ask when necessary

The Security Agent prompts users to allow or deny programs
associated with an event from running and adds the programs to the
exception list
If the user does not respond within a certain time period, the Security
Agent automatically allows the program to run. The default time period
is 30 seconds.
NoteThis option is not supported for the Program Library Injection(DLL injection) event on 64-bit systems.

Deny

The Security Agent always blocks programs associated with an eventfrom running and logs the event.
After blocking a program with notifications enabled, the Security Agent
displays a notification on the endpoint.

Behavior Monitoring Exception List
The Behavior Monitoring exception list contains programs that the Security
Agent does not monitor using Behavior Monitoring.
• Approved Programs: The Security Agent allows all programs in the
Approved Programs list to pass Behavior Monitoring scanning.
Note
Although Behavior Monitoring does not take action on programs added
to the Approved Programs list, other scan features (such as file-based
scanning) continue to scan the program before allowing the program torun.

• Blocked Programs: The Security Agent blocks all programs in the
Blocked Programs list. To configure the Blocked Programs list, enable
Event Monitoring.

8-9

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Configure the exception list from the web console. You can also grant users
the privilege to configure their own exception list from the Security Agentconsole.
For more information, see Configuring Agent Privileges on page 6-4.

Exception List Wildcard Support
The Behavior Monitoring Approved List supports the use of wildcard
characters when defining file path, file name, and file extension exception
types. Use the following tables to properly format your exception lists toensure that Apex One excludes the correct files and folders from scanning.
Supported wildcard characters:• Asterisk (*): Represents any character or string of characters• Question mark (?): Represents a single character
Important• The Behavior Monitoring Approved List does not support the useof wildcard characters to replace system drive designations or UNC
addresses.
• The Behavior Monitoring Block List does not support the use of wildcard
characters to replace folders.
Exception TypeDirectories

8-10

Wildcard Usage

MatchedNot MatchedC:\*• C:\sample.exe• D:\sample.exe

Excludes all files andfolders on the specified
drive• C:\folder\test.

• E:\folder\test.

doc

doc

Behavior Monitoring Policy Settings

Exception TypeWildcard Usage

MatchedNot Matched• C:\files\Sample• C:\sample.exe

Specific
files undera specificfolder layer

C:\*\Sample.exe
Sample.exe file only if• C:\temp\files\S

UNC paths\\<UNCpath>\*\Sample.exe• \\<UNC• R:\files\Sample• \\<UNC

Reason: Mapped
drives are notsupported.

Excludes thethe file is located inany subfolder of the C:\
directory

Excludes the

Sample.exe file only if

the file is located inany subfolder of thespecified UNC path.exe

ample.exe

path>\files\Sample.exe
path>\temp\files\Sample.exe.exe• \\<UNC

path>\Sample.exeReason: The filedoes not exist
within a subfolderof the UNC path.
File names
andextensions

C:\*.*• C:\Sample.exe• D:\sample.exe

Excludes all files withextensions in all folders
and subfolders of the
C:\ directory• C:\temp\Sample.

• C:\Sample

exe• C:\test.doc

Note
C:\Sample

does nothave a fileextensionand istherefore
notexcludedfromscanning.

8-11

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Exception TypeFile names

Wildcard Usage

MatchedNot Matched

C:\*.exe• C:\Sample.exe• C:\Sample.doc

Excludes all files withthe .exe extension in all
folders and subfolders of
the C:\ directory• C:\temp\test.ex• C:\temp\test.baet• C:\Sample
Note
C:\Sample

does nothave a fileextensionand istherefore
notexcludedfromscanning.

8-12

Behavior Monitoring Policy Settings

Exception TypeFileextensions

Wildcard Usage
C:\Sample.*

MatchedNot Matched• C:\Sample.exe• C:\Sample1.doc• C:\temp\Sample.

Excludes all files with
the name Sample andany extension in the C:\
directorybat• C:\Sample
Note
C:\Sample

does nothave a fileextensionand istherefore
notexcludedfromscanning.
Files in
specific
directory
structures

C:\*\*\Sample.exe

Excludes all files locatedwithin the second
subfolder layer or any
subsequent subfoldersof the C:\ directorywith the file name andextension Sample.exe• C:\files\temp\Sample.exe• C:\files\temp\t
est\Sample.exe• C:\Sample.exe• C:\temp\Sample.
exe• C:\files\temp\Sample.doc

8-13

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Exception TypeComplexpaths orfile names

Wildcard Usage

MatchedNot Matched

C:\Sam*e??.exe• C:\Sample12.exe• C:\SaSmple12.exExcludes all files withnames that satisfy thefollowing conditions:• C:\SamSamSample
12.exee

Reason: Does notstart with "Sam"• Begin with thecharacters "Sam"• C:\SamSamSam12.

• The third last
character of the filename must be "e"Reason: Does notcontain "e" as thethird last character• At least 1 character
exists between the
opening "Sam"string and closing"e??" string of thefile name• Exactly 2 characters
exist before the fileextension and afterthe "e" in the filename
• The file extension
is .exe
If a file meets all
the required conditions
and is located the
C:\ directory, Behavior
Monitoring excludes thefile from scans.

exe• C:\Same12.exe
Reason: Does notinclude characters
between thestarting "Sam"string and third last"e" character• C:\Sample1.exe
Reason: Does notinclude 2 characters
before the extension
and after the "e"• C:\Sample12.doc
Reason: Incorrect
extension

Exception List Environment Variable Support
The following table lists the environment variables you can use when adding
a file or folder path to the list.

8-14

Behavior Monitoring Policy Settings

Environment
Variable

ExampleEquivalent Path$allappdata$$allappdata$\test\sample.exe

C:\ProgramData\test\sample.exe$allprograms$$allprograms$\test\sample.exe

C:\ProgramData\Microsoft\Windows\StartMenu\Programs\test\sample.exe$programdir$$programdir$\test\sample.exe

C:\Program Files\test\sample.exe$programdirx86$$programdirx86$\test\sample.exe

C:\Program Files(x86)\test\sample.exe$rootdir$$rootdir$\test\sample.exe

C:\test\sample.exe$systemdir$$systemdir$\test\sample.exe

C:\Windows\System32\test\sample.
exe$systemdirx86$$systemdirx86$\test\sample.exe

C:\Windows\SysWOW64\test\sampl
e.exe$tempdir$$tempdir$\test\sample.exe

C:\Windows\Temp\test\sample.exe$userprofile$$userprofile$\test\sample.exe

C:\user\{current_user_account}\test\sample.exe$windir$$windir$\test\sample.exe

C:\Windows\test\sample.exe

Configuring Behavior Monitoring Rules andExceptions
Configure Behavior Monitoring policies to protect endpoints against
ransomware, exploit attacks, and emerging threats. Use the Event Monitoring
feature to assess or block behaviors commonly associated with malware
threats.
Note
By default, Behavior Monitoring is disabled on all versions of Windows Server
platforms.

8-15

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Procedure1.

In the Malware Behavior Blocking section:a.

Select Enable Malware Behavior Blocking and specify the types of
threats to block:• Known threats: Blocks behaviors associated with known
malware threats• Known and potential threats: Blocks behaviors associated withknown threats and takes action on behavior that is potentiallymaliciousb.

Select which Ransomware Protection features you want to enable toprotect against ransomware threats.
• Protect documents against unauthorized encryption or
modification: Stops potential ransomware threats fromencrypting or modifying the contents of documents• Automatically back up and restore files changed bysuspicious programs: Creates backup copies of files being
encrypted on endpoints to prevent any loss of data after
detecting a ransomware threat
Note
Automatic file backup requires at least 100 MB of disk
space on the agent endpoint and only backs up files thatare less than 10 MB in size.

• Block processes commonly associated with ransomware:
Blocks processes associated with known ransomware threats
before any encryption or modification of documents can occur• Enable program inspection to detect and block compromised
executable files: Program inspection monitors processes andperforms API hooking to determine if a program is behaving inan unexpected manner. Although this procedure increases the

8-16Behavior Monitoring Policy Settings

overall detection ratio of compromised executable files, it may
result in decreased system performance.
Tip
Program inspection provides increased security if you selectKnown and potential threats in the Threats to block dropdown.

For details, see Ransomware Protection on page 8-2.
c.

Under Anti-exploit Protection, enable Terminate programs thatexhibit abnormal behavior associated with exploit attacks toprotect against potentially exploited programs.
NoteAnti-exploit Protection requires that you select Enable program
inspection to detect and block compromised executable files.
For details, see Anti-Exploit Protection on page 8-5.
ImportantAnti-exploit Protection works in conjunction with Real-time Scan
(Quarantine malware variants detected in memory) to provide
enhanced protection against Fileless Attacks.
For more information, see Real-time Scan: Target Tab on page 9-14.

2.

In the Newly Encountered Programs section, enable Monitor newly
encountered programs downloaded through web or email application
channels and select whether to Prompt user before executing thedownloaded program or to have Apex One log the detections only.

3.

In the Event Monitoring section:a.

Select Enable Event Monitoring.

b.

Click Specify detailed settings to select the types of events tomonitor.
8-17

Trend Micro Apex Central™ as a Service Widget and Policy Management Guidec.

Choose the system events to monitor and select an action for eachof the selected events.
For information about monitored system events and actions, seeEvent Monitoring on page 8-6.

4.

Click the Exceptions tab to configure the exception lists.
a.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policy
Note
If your child policies Extend from parent, you can also
configure Child Policy Restrictions. Restrictions prevent thechild policy from adding specific objects to the list.

b.

Type the full program path in the available text field.
Note• Separate multiple entries with semicolons (;).
• Use the Import and Export buttons to share the list withdifferent policies.
• The Approved List supports the use of wildcard characters.
For more information, see Exception List Wildcard Support on
page 8-10.

8-18

c.

Click Add.

d.

To remove a blocked or approved program from the list, click thetrash bin icon ( ) next to the program.

Behavior Monitoring Policy Settings

Note
Apex One accepts a maximum combined total of 1024 approved
programs and blocked programs.

8-19

Chapter 9

Anti-malware Policy Settings
This section describes how to configure anti-malware scanning on Security
Agents.
Topics include:

9-1

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Scan Method Types
Security Agents can use one of two scan methods when scanning for security
risks. The scan methods are smart scan and conventional scan.
• Smart Scan
Security Agents that use smart scan are referred to as smart scan agentsin this document. Smart scan agents benefit from local scans and in-thecloud queries provided by File Reputation Services.
• Conventional Scan
Agents that do not use smart scan are called conventional scan agents.
A conventional scan agent stores all Security Agent components on theendpoint and scans all files locally.

Guidelines for Switching Scan Methods
The following table outlines some considerations you should be aware of
before switching the scan method that Security Agents use.
Table 9-1. Considerations When Switching to Smart Scan
Consideration

Details

Product license

Ensure that you have activated all required licenses for the newscan method.

Apex One server

Ensure that agents can connect to the Apex One server. Apex One
only notifies online agents to switch scan methods. Offline agents
get notified when they become online. Independent agents arenotified when they become online or, if the agent has scheduled
update privileges, when scheduled update runs.
Also verify that the Apex One server has the latest components
to ensure that Security Agents can download the correct patterns
from the server.

Number of Security
Agents to switch

9-2

Switching a relatively small number of Security Agents at a timeallows efficient use of the Apex One server and Smart Protection
Server resources. These servers can perform other critical tasks
while Security Agents change scan methods.

Anti-malware Policy Settings

Consideration
Timing

Details
When switching scan methods, Security Agents need to download
full versions of the required pattern files for the new scan method.
Consider switching during off-peak hours to minimize the impact
to network bandwidth and interruption to end user daily
operations. Trend Micro recommends disabling "Update Now" on
Security Agents during the conversion process.

IPv6 support
Important
Only available
for Security
Agents reportingto an onpremises Apex
One server.

Smart scan agents send scan queries to smart protection sources.
A pure IPv6 smart scan agent cannot send queries directly to pure
IPv4 sources, such as:• Smart Protection Server 2.0 (integrated or standalone)
Note
IPv6 support for Smart Protection Server starts inversion 2.5.
• Trend Micro Smart Protection Network
Similarly, a pure IPv4 smart scan agent cannot send queries topure IPv6 Smart Protection Servers.
A dual-stack proxy server that can convert IP addresses, such as
DeleGate, is required to allow smart scan agents to connect to thesources.

Smart Protection
Services

If you are switching Security Agents from conventional scan
to smart scan, ensure that you have set up Smart Protection
Services.

Important
Only available
for Security
Agents reportingto an onpremises Apex
One server.

9-3

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Manual Scan
Manual Scan is an on-demand scan and starts immediately after a user
runs the scan on the Security Agent console. The time it takes to complete
scanning depends on the number of files to scan and the Security Agent
endpoint's hardware resources.
Configure and apply Manual Scan settings to one or several agents anddomains, or to all agents that the server manages.

Configuring Manual Scan Settings
Configure Manual Scan settings using the following tabs:• Manual Scan: Target Tab on page 9-4• Manual Scan: Action Tab on page 9-7• Manual Scan: Scan Exclusion Tab on page 9-10

Manual Scan: Target Tab
Procedure1.

In the Files to Scan section, select from the following:• All scannable files: Includes all scannable files. Unscannable files
are password protected files, encrypted files, or files that exceed theuser-defined scanning restrictions.
Note
This option provides the maximum security possible. However,scanning every file requires a lot of time and resources and might
be redundant in some situations. Therefore, you might want to limit
the amount of files the agent includes in the scan.

• File types scanned by IntelliScan: Scans files based on true-file
type.
9-4

Anti-malware Policy Settings• Files with the following extensions (use commas to separate
entries): Manually specify the files to scan based on theirextensions. Separate multiple entries with commas.
Note
When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policy

2.

In the Scan Settings section, configure the required settings.
Setting

Description

Scan hidden
folders

Allows the Security Agent to detect and then scan hidden folders
on the endpoint

Scan network
drive

Scans directories physically located on other endpoints, butmapped to the local endpoint

9-5

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Setting
Scan compressed
files

Description
Scans the specified number of compression layers within anarchived file
Note
Scanning through more layers may detect malware
intentionally buried within a compressed archive,
however, the scan may affect system performance.
Select this option and configure the following settings:• Maximum layers: Scans the specified number ofcompression layers within an archived file
Note
Scanning through more layers may detect malware
intentionally buried within a compressed archive,
however, the scan may affect system performance.
• Do not scan files if the compressed file size exceeds
XX MB: Enables the Security Agent to check the sizesof individual files within a compressed archive and skips
scanning files if the individual file size exceeds the configured
threshold• In a compressed file, scan only the first XX files: Prevents
the Security Agent from scanning all files in archives that
contain more files than the configured threshold

9-6

Anti-malware Policy Settings

Setting
Scan OLE objects

Description
Scans the specified number of Object Linking and Embedding(OLE) layers in a file
Detect exploit code in OLE files: OLE Exploit Detection
heuristically identifies malware by checking Microsoft Office files
for exploit code.
Note
The specified number of layers is applicable to both the
Scan OLE objects and Detect exploit code in OLE files
options.

Scan boot area

3.

Scans the boot sector of the hard disk on the endpoint for virus/
malwareIn the CPU Usage section, select from the following:• High: No pausing between scans• Medium: Pause between file scans if CPU consumption is higher
than 50%, and do not pause if 50% or lower• Low: Pause between file scans if CPU consumption is higher than
20%, and do not pause if 20% or lower

Manual Scan: Action Tab
Procedure1.

In the Virus/Malware section, configure the required settings.
a.

Select the type of action that the Security Agent takes after detecting
a security threat.
• Use ActiveAction: Select to use a set of pre-configured scanactions for viruses/malware
For more information, see ActiveAction on page 9-45.
9-7

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide• Customize action for probable virus/malware: Selectand specify the action that the Security Agent takes on
probable malware threats• Use the same action for all virus/malware types: Specify theaction that the Security Agent takes on all malware threats• Use a specific action for each virus/malware type: Specify theaction that the Security Agent takes on specific security threats
For more information, see Custom Scan Actions on page 9-46.
b.

Select Back up files before cleaning to create an encrypted copyof the infected file on the endpoint in the <Agent installation
folder>\Backup folder.
Creating a backup copy of the file allows you to restore the original
version of the file if necessary.

c.

Specify the location of the quarantine directory.
• Quarantine to the Security Agent's managing server: The
Security Agent sends an encrypted copy of all quarantined files
to the managing Apex One server• Quarantine directory: The Security Agent sends an encrypted
copy of all quarantined files to the specified location
For more information, see Quarantine Directory on page 9-47.

d.

In the Damage Cleanup Services section, configure the following:• Cleanup type
• Standard cleanup: The Security Agent performs any of thefollowing actions during standard cleanup:• Detects and removes live Trojans• Kills processes that Trojans create• Repairs system files that Trojans modify• Deletes files and applications that Trojans drop

9-8Anti-malware Policy Settings• Advanced cleanup: In addition to the standard cleanup
actions, the Security Agent stops activities by rogue
security software (also known as FakeAV) and certain
rootkit variants.
• Run cleanup when probable virus/malware is detected:
Performs the configured cleanup type on probable malware
threats
Note
You can only select this option if the action on probable virus/
malware is not Pass or Deny Access.

2.

In the Spyware/Grayware section, select the action the Security Agent
takes after detecting spyware or grayware programs.
• Clean: Terminates all related processes and deletes associatedregistry values, files, cookies and shortcuts
Note
After cleaning spyware/grayware, Security Agents back up spyware/
grayware data, which you can restore if you consider the spyware/
grayware safe to access.

• Pass: Logs the detection but allows the program to execute3.

In the Advanced Malware Detection section, select an option andconfigure the required setting.
• Use ActiveAction: Select to use a set of pre-configured scan actions
on detected portable executable files. This is the recommended
option.
For more information, see ActiveAction on page 9-45.
• Use the same action for all portable executable files with threats:
Select to apply one of the following actions on detected portable
executable files.

9-9Trend Micro Apex Central™ as a Service Widget and Policy Management Guide• Quarantine: The system automatically quarantines thedetected portable executable files.
• Pass: The system generates a detection log but does not apply
any action on detected portable executable files.
Note
If a detected portable executable file is in the Scan Exclusion list, thesystem does not apply any action on the file.

Manual Scan: Scan Exclusion Tab
Procedure1.

Select Enable scan exclusion.

2.

In the Scan Exclusion List (Directories) section, configure the required
settings.
a.

Select Exclude directories where Trend Micro products are
installed to automatically exclude directories associated with otherTrend Micro products.
For more information, see Trend Micro Product Directory Exclusions
on page 9-53.

b.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policy
Note
If your child policies Extend from parent, you can also
configure Child Policy Restrictions. Restrictions prevent thechild policy from adding specific objects to the list.

9-10Anti-malware Policy Settingsc.

Type a directory path to exclude from scans and click the + button.
The Security Agent does not scan files located in the specified
directory (and sub-directories).
Note• You can specify a maximum of 256 directories to exclude fromscanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• Directory exclusions support the use of wildcard characters.
For more information, see Wildcard Exceptions on page 9-53.

3.

In the Scan Exclusion List (Files) section, configure the required
settings.
a.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policyb.

Type a file name or the file name with full directory path to exclude
from scans and click the + button.

9-11

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Note• You can specify a maximum of 256 files to exclude fromscanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• File exclusions support the use of wildcard characters.
For more information, see Wildcard Exceptions on page 9-53.

4.

In the Scan Exclusion List (File Extensions) section, configure therequired settings.
a.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policy

b.

9-12

Select or type a file extension to exclude from scans and click the
Add > button.

Anti-malware Policy Settings

Note• You can specify a maximum of 256 file extensions to exclude
from scanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• For Manual Scan, Scheduled Scan, and Scan Now, use aquestion mark (?) to replace a single character or an asterisk(*) to replace multiple characters as wildcard characters. For
example, if you do not want to scan all files with extensions
starting with D, such as DOC, DOT, or DAT, type D* or D??.

Real-time Scan
Real-time Scan is a persistent and ongoing scan. Each time a file is received,
opened, downloaded, copied, or modified, Real-time Scan scans the file forsecurity risks. If the Security Agent does not detect a security risk, users canproceed to access the file. If the Security Agent detects a security risk or aprobable virus/malware, a notification message displays indicating the nameof the infected file and the specific security risk.
Real-time Scan maintains a persistent scan cache which reloads each time
the Security Agent starts. The Security Agent tracks any changes to files orfolders that occurred since the Security Agent unloaded and removes thesefiles from the cache.

Configuring Real-time Scan Settings
Procedure1.

Select the following options:• Enable virus/malware scan
• Enable spyware/grayware scan
9-13

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Note
You must enable virus/malware scanning before you can enablespyware/grayware scanning. During a virus outbreak, the Security
Agent automatically enables Real-time Scan and you cannot disable
scanning until the outbreak ends. Real-time Scan helps prevent thevirus from modifying or deleting files and folders on endpoints.

2.

Configure the Target settings.
For more information, see Real-time Scan: Target Tab on page 9-14.

3.

Configure the Action settings.
For more information, see Real-time Scan: Action Tab on page 9-18.

4.

Configure the Scan Exclusion settings.
For more information, see Real-time Scan: Scan Exclusion Tab on page
9-21.

Real-time Scan: Target Tab
Procedure1.

In the User Activity on Files section, select which file operations trigger
scanning from the Scan files being drop-down.
• created/modified and retrieved: Scans all files created, modified,or opened on the endpoint• created/modified: Scans all files created or modified on theendpoint• retrieved: Scans all files opened on the endpoint2.

In the Files to Scan section, select from the following:• All scannable files: Includes all scannable files. Unscannable files
are password protected files, encrypted files, or files that exceed theuser-defined scanning restrictions.

9-14

Anti-malware Policy Settings

Note
This option provides the maximum security possible. However,scanning every file requires a lot of time and resources and might
be redundant in some situations. Therefore, you might want to limit
the amount of files the agent includes in the scan.

• File types scanned by IntelliScan: Scans files based on true-file
type.
• Files with the following extensions (use commas to separate
entries): Manually specify the files to scan based on theirextensions. Separate multiple entries with commas.
Note
When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policy

3.

In the Scan Settings section, configure the required settings.
Setting

Description

Scan floppy disks
during shutdown

Scans floppy disks during shutdown

Scan network
drive

Scans directories physically located on other endpoints, butmapped to the local endpoint

Scan the bootsector of the
USB storage device
after plugging in

Automatically scans only the boot sector of a USB storage device
every time the user plugs it in

9-15

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Setting

Description

Scan all files
in removablestorage devices
after plugging in

Automatically scans all files on a USB storage device every time
the user plugs it in

Quarantine
malware variants
detected inmemoryBehavior Monitoring scans the system memory for suspicious
processes and Real-time Scan maps the process and scans it
for malware threats. If a malware threat exists, Real-time scan
quarantines the process and/or file.
Note
Memory scanning works in conjunction with Anti-exploit
Protection in Behavior Monitoring to provide enhanced
protection against Fileless Attacks.
For more information, see Configuring Behavior
Monitoring Rules and Exceptions on page 8-15.

9-16

Anti-malware Policy Settings

Setting
Scan compressed
files

Description
Scans the specified number of compression layers within anarchived file
Note
Scanning through more layers may detect malware
intentionally buried within a compressed archive,
however, the scan may affect system performance.
Select this option and configure the following settings:• Maximum layers: Scans the specified number ofcompression layers within an archived file
Note
Scanning through more layers may detect malware
intentionally buried within a compressed archive,
however, the scan may affect system performance.
• Do not scan files if the compressed file size exceeds
XX MB: Enables the Security Agent to check the sizesof individual files within a compressed archive and skips
scanning files if the individual file size exceeds the configured
threshold• In a compressed file, scan only the first XX files: Prevents
the Security Agent from scanning all files in archives that
contain more files than the configured threshold

9-17

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Setting
Scan OLE objects

Description
Scans the specified number of Object Linking and Embedding(OLE) layers in a file
Detect exploit code in OLE files: OLE Exploit Detection
heuristically identifies malware by checking Microsoft Office files
for exploit code.
Note
The specified number of layers is applicable to both the
Scan OLE objects and Detect exploit code in OLE files
options.

Enable IntelliTrap

Detects malicious code, such as bots, in compressed files

Enable CVE exploit
scanning forfiles downloaded
through web andemail channels

Blocks processes that attempt to exploit known vulnerabilities
in commercially available products based on the Common
Vulnerabilities and Exposures (CVE) system

Real-time Scan: Action Tab
Procedure1.

In the Virus/Malware section, configure the required settings.
a.

Select the type of action that the Security Agent takes after detecting
a security threat.
• Use ActiveAction: Select to use a set of pre-configured scanactions for viruses/malware
For more information, see ActiveAction on page 9-45.
• Customize action for probable virus/malware: Selectand specify the action that the Security Agent takes on
probable malware threats

9-18

Anti-malware Policy Settings• Use the same action for all virus/malware types: Specify theaction that the Security Agent takes on all malware threats• Use a specific action for each virus/malware type: Specify theaction that the Security Agent takes on specific security threats
For more information, see Custom Scan Actions on page 9-46.
b.

Select the types of notification that display to end users.
• Display a notification when virus/malware is detected: Selectto display a notification informing the Security Agent userwhen a malware detection occurs• Display a notification when probable virus/malware is
detected: Select to display a notification informing the Security
Agent user when a probable malware detection occursc.

Select Back up files before cleaning to create an encrypted copyof the infected file on the endpoint in the <Agent installation
folder>\Backup folder.
Creating a backup copy of the file allows you to restore the original
version of the file if necessary.

d.

Specify the location of the quarantine directory.
• Quarantine to the Security Agent's managing server: The
Security Agent sends an encrypted copy of all quarantined files
to the managing Apex One server• Quarantine directory: The Security Agent sends an encrypted
copy of all quarantined files to the specified location
For more information, see Quarantine Directory on page 9-47.

e.

In the Damage Cleanup Services section, configure the following:• Run cleanup when probable virus/malware is detected:
Performs the configured cleanup type on probable malware
threats

9-19

Trend Micro Apex Central™ as a Service Widget and Policy Management GuideNote
You can only select this option if the action on probable virus/
malware is not Pass or Deny Access.

2.

In the Spyware/Grayware section, select the action the Security Agent
takes after detecting spyware or grayware programs.
• Clean: Terminates all related processes and deletes associatedregistry values, files, cookies and shortcuts
Note
After cleaning spyware/grayware, Security Agents back up spyware/
grayware data, which you can restore if you consider the spyware/
grayware safe to access.

• Deny access: Prevents the end user from opening or copying the
spyware or grayware components• Display a notification on endpoints when spyware/grayware is
detected: Select to display a notification informing the Security
Agent user when a spyware/grayware detection occurs
3.

In the Advanced Malware Detection section, select an option andconfigure the required setting.
• Use ActiveAction: Select to use a set of pre-configured scan actions
on detected portable executable files. This is the recommended
option.
For more information, see ActiveAction on page 9-45.
• Use the same action for all portable executable files with threats:
Select to apply one of the following actions on detected portable
executable files.
• Quarantine: The system automatically quarantines thedetected portable executable files.
• Pass: The system generates a detection log but does not apply
any action on detected portable executable files.

9-20

Anti-malware Policy Settings

Note
If a detected portable executable file is in the Scan Exclusion list, thesystem does not apply any action on the file.

Real-time Scan: Scan Exclusion Tab
Procedure1.

Select Enable scan exclusion.

2.

In the Scan Exclusion List (Directories) section, configure the required
settings.
a.

Select Exclude directories where Trend Micro products are
installed to automatically exclude directories associated with otherTrend Micro products.
For more information, see Trend Micro Product Directory Exclusions
on page 9-53.

b.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policy
Note
If your child policies Extend from parent, you can also
configure Child Policy Restrictions. Restrictions prevent thechild policy from adding specific objects to the list.

c.

Type a directory path to exclude from scans and click the + button.
The Security Agent does not scan files located in the specified
directory (and sub-directories).
9-21

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Note• You can specify a maximum of 256 directories to exclude fromscanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• Directory exclusions support the use of wildcard characters.
For more information, see Wildcard Exceptions on page 9-53.

3.

In the Scan Exclusion List (Files) section, configure the required
settings.
a.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policyb.

Type a file name or the file name with full directory path to exclude
from scans and click the + button.
Note• You can specify a maximum of 256 files to exclude fromscanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• File exclusions support the use of wildcard characters.
For more information, see Wildcard Exceptions on page 9-53.

4.

9-22

In the Scan Exclusion List (File Extensions) section, configure therequired settings.

Anti-malware Policy Settingsa.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policyb.

Select or type a file extension to exclude from scans and click the
Add > button.
Note• You can specify a maximum of 256 file extensions to exclude
from scanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• Real-time Scan does not support the use of wildcard charactersfor file extension exclusions.

Scan Now
Scan Now is initiated remotely by administrators through the web console
and can be targeted to one or several Security Agent endpoints.
Configure and apply Scan Now settings to one or several Security Agents anddomains, or to all Security Agents that the server manages.

Configuring Scan Now Settings
Procedure1.

Select the following options:• Enable virus/malware scan
9-23

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide• Enable spyware/grayware scan
Note
You must enable virus/malware scanning before you can enablespyware/grayware scanning.

2.

Configure the Target settings.
For more information, see Scan Now: Target Tab on page 9-24.

3.

Configure the Action settings.
For more information, see Scan Now: Action Tab on page 9-27.

4.

Configure the Scan Exclusion settings.
For more information, see Scan Now: Scan Exclusion Tab on page 9-30.

Scan Now: Target Tab
Procedure1.

In the Files to Scan section, select from the following:• All scannable files: Includes all scannable files. Unscannable files
are password protected files, encrypted files, or files that exceed theuser-defined scanning restrictions.
Note
This option provides the maximum security possible. However,scanning every file requires a lot of time and resources and might
be redundant in some situations. Therefore, you might want to limit
the amount of files the agent includes in the scan.

• File types scanned by IntelliScan: Scans files based on true-file
type.

9-24

Anti-malware Policy Settings• Files with the following extensions (use commas to separate
entries): Manually specify the files to scan based on theirextensions. Separate multiple entries with commas.
Note
When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policy

2.

In the Scan Settings section, configure the required settings.

9-25

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Setting
Scan compressed
files

Description
Scans the specified number of compression layers within anarchived file
Note
Scanning through more layers may detect malware
intentionally buried within a compressed archive,
however, the scan may affect system performance.
Select this option and configure the following settings:• Maximum layers: Scans the specified number ofcompression layers within an archived file
Note
Scanning through more layers may detect malware
intentionally buried within a compressed archive,
however, the scan may affect system performance.
• Do not scan files if the compressed file size exceeds
XX MB: Enables the Security Agent to check the sizesof individual files within a compressed archive and skips
scanning files if the individual file size exceeds the configured
threshold• In a compressed file, scan only the first XX files: Prevents
the Security Agent from scanning all files in archives that
contain more files than the configured threshold

9-26

Anti-malware Policy Settings

Setting
Scan OLE objects

Description
Scans the specified number of Object Linking and Embedding(OLE) layers in a file
Detect exploit code in OLE files: OLE Exploit Detection
heuristically identifies malware by checking Microsoft Office files
for exploit code.
Note
The specified number of layers is applicable to both the
Scan OLE objects and Detect exploit code in OLE files
options.

Scan boot area

3.

Scans the boot sector of the hard disk on the endpoint for virus/
malwareIn the CPU Usage section, select from the following:• High: No pausing between scans• Medium: Pause between file scans if CPU consumption is higher
than 50%, and do not pause if 50% or lower• Low: Pause between file scans if CPU consumption is higher than
20%, and do not pause if 20% or lower

Scan Now: Action Tab
Procedure1.

In the Virus/Malware section, configure the required settings.
a.

Select the type of action that the Security Agent takes after detecting
a security threat.
• Use ActiveAction: Select to use a set of pre-configured scanactions for viruses/malware
For more information, see ActiveAction on page 9-45.
9-27

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide• Customize action for probable virus/malware: Selectand specify the action that the Security Agent takes on
probable malware threats• Use the same action for all virus/malware types: Specify theaction that the Security Agent takes on all malware threats• Use a specific action for each virus/malware type: Specify theaction that the Security Agent takes on specific security threats
For more information, see Custom Scan Actions on page 9-46.
b.

Select Back up files before cleaning to create an encrypted copyof the infected file on the endpoint in the <Agent installation
folder>\Backup folder.
Creating a backup copy of the file allows you to restore the original
version of the file if necessary.

c.

Specify the location of the quarantine directory.
• Quarantine to the Security Agent's managing server: The
Security Agent sends an encrypted copy of all quarantined files
to the managing Apex One server• Quarantine directory: The Security Agent sends an encrypted
copy of all quarantined files to the specified location
For more information, see Quarantine Directory on page 9-47.

d.

In the Damage Cleanup Services section, configure the following:• Cleanup type
• Standard cleanup: The Security Agent performs any of thefollowing actions during standard cleanup:• Detects and removes live Trojans• Kills processes that Trojans create• Repairs system files that Trojans modify• Deletes files and applications that Trojans drop

9-28

Anti-malware Policy Settings• Advanced cleanup: In addition to the standard cleanup
actions, the Security Agent stops activities by rogue
security software (also known as FakeAV) and certain
rootkit variants.
• Run cleanup when probable virus/malware is detected:
Performs the configured cleanup type on probable malware
threats
Note
You can only select this option if the action on probable virus/
malware is not Pass or Deny Access.

2.

In the Spyware/Grayware section, select the action the Security Agent
takes after detecting spyware or grayware programs.
• Clean: Terminates all related processes and deletes associatedregistry values, files, cookies and shortcuts
Note
After cleaning spyware/grayware, Security Agents back up spyware/
grayware data, which you can restore if you consider the spyware/
grayware safe to access.

• Pass: Logs the detection but allows the program to execute3.

In the Advanced Malware Detection section, select an option andconfigure the required setting.
• Use ActiveAction: Select to use a set of pre-configured scan actions
on detected portable executable files. This is the recommended
option.
For more information, see ActiveAction on page 9-45.
• Use the same action for all portable executable files with threats:
Select to apply one of the following actions on detected portable
executable files.

9-29

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide• Quarantine: The system automatically quarantines thedetected portable executable files.
• Pass: The system generates a detection log but does not apply
any action on detected portable executable files.
Note
If a detected portable executable file is in the Scan Exclusion list, thesystem does not apply any action on the file.

Scan Now: Scan Exclusion Tab
Procedure1.

Select Enable scan exclusion.

2.

In the Scan Exclusion List (Directories) section, configure the required
settings.
a.

Select Exclude directories where Trend Micro products are
installed to automatically exclude directories associated with otherTrend Micro products.
For more information, see Trend Micro Product Directory Exclusions
on page 9-53.

b.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policy
Note
If your child policies Extend from parent, you can also
configure Child Policy Restrictions. Restrictions prevent thechild policy from adding specific objects to the list.

9-30

Anti-malware Policy Settingsc.

Type a directory path to exclude from scans and click the + button.
The Security Agent does not scan files located in the specified
directory (and sub-directories).
Note• You can specify a maximum of 256 directories to exclude fromscanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• Directory exclusions support the use of wildcard characters.
For more information, see Wildcard Exceptions on page 9-53.

3.

In the Scan Exclusion List (Files) section, configure the required
settings.
a.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policyb.

Type a file name or the file name with full directory path to exclude
from scans and click the + button.

9-31

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Note• You can specify a maximum of 256 files to exclude fromscanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• File exclusions support the use of wildcard characters.
For more information, see Wildcard Exceptions on page 9-53.

4.

In the Scan Exclusion List (File Extensions) section, configure therequired settings.
a.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policy

b.

9-32

Select or type a file extension to exclude from scans and click the
Add > button.

Anti-malware Policy Settings

Note• You can specify a maximum of 256 file extensions to exclude
from scanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• For Manual Scan, Scheduled Scan, and Scan Now, use aquestion mark (?) to replace a single character or an asterisk(*) to replace multiple characters as wildcard characters. For
example, if you do not want to scan all files with extensions
starting with D, such as DOC, DOT, or DAT, type D* or D??.

Scheduled Scan
Scheduled Scan runs automatically on the appointed date and time. Use
Scheduled Scan to automate routine scans on the agent and improve scanmanagement efficiency.
Configure and apply Scheduled Scan settings to one or several agents anddomains, or to all agents that the server manages.

Configuring Scheduled Scan Settings
Procedure1.

Select the following options:• Enable virus/malware scan
• Enable spyware/grayware scan
Note
You must enable virus/malware scanning before you can enablespyware/grayware scanning.

9-33

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

2.

Configure the Target settings.
For more information, see Scheduled Scan: Target Tab on page 9-34.

3.

Configure the Action settings.
For more information, see Scheduled Scan: Action Tab on page 9-39.

4.

Configure the Scan Exclusion settings.
For more information, see Scheduled Scan: Scan Exclusion Tab on page
9-42.

Scheduled Scan: Target Tab
Procedure1.

In the Schedule section, specify the Scheduled Scan frequency:• Daily: Scans every day at the specified time
• Weekly, every <day_of_week>: Scans once a week on the specified
day at the specified time
• Monthly, on day <number>: Scans once a month on the specified
day at the specified time
• Monthly, on the <ordinal> <day_of_week>: Scans once a month on
the specified weekday at the specified time
Important
If you select a day that does not exist within a given month (for example,
day “30” does not exist in February), the Scheduled Scan occurs on thelast day of that month.

9-34

Anti-malware Policy Settings

Note
When configuring a parent policy, specify how other users can configurechild policies.
• Inherit from parent: Child policies must use the settings configuredin the parent policy• Are customizable: Other administrators can configure child policies
to be different than the parent policy settings.

2.

In the Files to Scan section, select from the following:• All scannable files: Includes all scannable files. Unscannable files
are password protected files, encrypted files, or files that exceed theuser-defined scanning restrictions.
Note
This option provides the maximum security possible. However,scanning every file requires a lot of time and resources and might
be redundant in some situations. Therefore, you might want to limit
the amount of files the agent includes in the scan.

• File types scanned by IntelliScan: Scans files based on true-file
type.
• Files with the following extensions (use commas to separate
entries): Manually specify the files to scan based on theirextensions. Separate multiple entries with commas.

9-35

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Note
When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policy

3.

In the Scan Settings section, configure the required settings.
Setting
Scan OLE objects

Description
Scans the specified number of Object Linking and Embedding(OLE) layers in a file
Detect exploit code in OLE files: OLE Exploit Detection
heuristically identifies malware by checking Microsoft Office files
for exploit code.
Note
The specified number of layers is applicable to both the
Scan OLE objects and Detect exploit code in OLE files
options.

Remind users of
the Scheduled
Scan XX minutes
before it runs

Select this option to display a notification message on theendpoint before Scheduled Scan begins.
Note
You can disable the notification message on the Other
Settings tab of the Privileges and Other Settings
screen.

9-36

Anti-malware Policy Settings

Setting

Description

Postpone
Scheduled Scan for
up to XX hour(s)and XX minute(s)Set the maximum amount of time users with the Postpone
Scheduled Scan privilege can delay or pause a Scheduled Scan
for.
Note
You can grant the Postpone Scheduled Scan privilege on
the Privileges tab of the Privileges and Other Settings
screen.

Automatically stop
Scheduled Scan
when scanninglasts more thanXX hour(s) and XX
minute(s)Stops a long Scheduled Scan after reaching the configured time
duration.

Skip Scheduled
Scan whena wirelessendpoint's battery
life is less than
XX% and its
AC adapter is
unplugged

Prevents the Security Agent from starting a Scheduled Scan if thebattery life is low.

Resume aninterrupted
Scheduled Scan

Resumes a Scheduled Scan at the specified time if the userinterrupted the scan by turning off the endpoint.

Resume a missed
Scheduled Scan

Starts a Scheduled Scan at the specified time if the endpoint was
not running when the Scheduled Scan should have started.

9-37

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Setting
Scan compressed
files

Description
Scans the specified number of compression layers within anarchived file
Note
Scanning through more layers may detect malware
intentionally buried within a compressed archive,
however, the scan may affect system performance.
Select this option and configure the following settings:• Maximum layers: Scans the specified number ofcompression layers within an archived file
Note
Scanning through more layers may detect malware
intentionally buried within a compressed archive,
however, the scan may affect system performance.
• Do not scan files if the compressed file size exceeds
XX MB: Enables the Security Agent to check the sizesof individual files within a compressed archive and skips
scanning files if the individual file size exceeds the configured
threshold• In a compressed file, scan only the first XX files: Prevents
the Security Agent from scanning all files in archives that
contain more files than the configured threshold

Scan boot area

4.

Scans the boot sector of the hard disk on the endpoint for virus/
malwareIn the CPU Usage section, select from the following:• High: No pausing between scans• Medium: Pause between file scans if CPU consumption is higher
than 50%, and do not pause if 50% or lower

9-38

Anti-malware Policy Settings• Low: Pause between file scans if CPU consumption is higher than
20%, and do not pause if 20% or lower

Scheduled Scan: Action Tab
Procedure1.

In the Virus/Malware section, configure the required settings.
a.

Select the type of action that the Security Agent takes after detecting
a security threat.
• Use ActiveAction: Select to use a set of pre-configured scanactions for viruses/malware
For more information, see ActiveAction on page 9-45.
• Customize action for probable virus/malware: Selectand specify the action that the Security Agent takes on
probable malware threats• Use the same action for all virus/malware types: Specify theaction that the Security Agent takes on all malware threats• Use a specific action for each virus/malware type: Specify theaction that the Security Agent takes on specific security threats
For more information, see Custom Scan Actions on page 9-46.

b.

Select the types of notification that display to end users.
• Display a notification when virus/malware is detected: Selectto display a notification informing the Security Agent userwhen a malware detection occurs• Display a notification when probable virus/malware is
detected: Select to display a notification informing the Security
Agent user when a probable malware detection occursc.

Select Back up files before cleaning to create an encrypted copyof the infected file on the endpoint in the <Agent installation
folder>\Backup folder.
9-39

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Creating a backup copy of the file allows you to restore the original
version of the file if necessary.
d.

Specify the location of the quarantine directory.
• Quarantine to the Security Agent's managing server: The
Security Agent sends an encrypted copy of all quarantined files
to the managing Apex One server• Quarantine directory: The Security Agent sends an encrypted
copy of all quarantined files to the specified location
For more information, see Quarantine Directory on page 9-47.

e.

In the Damage Cleanup Services section, configure the following:• Cleanup type
• Standard cleanup: The Security Agent performs any of thefollowing actions during standard cleanup:• Detects and removes live Trojans• Kills processes that Trojans create• Repairs system files that Trojans modify• Deletes files and applications that Trojans drop
• Advanced cleanup: In addition to the standard cleanup
actions, the Security Agent stops activities by rogue
security software (also known as FakeAV) and certain
rootkit variants.
• Run cleanup when probable virus/malware is detected:
Performs the configured cleanup type on probable malware
threats
Note
You can only select this option if the action on probable virus/
malware is not Pass or Deny Access.

9-40

Anti-malware Policy Settings

2.

In the Spyware/Grayware section, select the action the Security Agent
takes after detecting spyware or grayware programs.
• Clean: Terminates all related processes and deletes associatedregistry values, files, cookies and shortcuts
Note
After cleaning spyware/grayware, Security Agents back up spyware/
grayware data, which you can restore if you consider the spyware/
grayware safe to access.

• Pass: Logs the detection but allows the program to execute• Display a notification on endpoints when spyware/grayware is
detected: Select to display a notification informing the Security
Agent user when a spyware/grayware detection occurs
3.

In the Advanced Malware Detection section, select an option andconfigure the required setting.
• Use ActiveAction: Select to use a set of pre-configured scan actions
on detected portable executable files. This is the recommended
option.
For more information, see ActiveAction on page 9-45.
• Use the same action for all portable executable files with threats:
Select to apply one of the following actions on detected portable
executable files.
• Quarantine: The system automatically quarantines thedetected portable executable files.
• Pass: The system generates a detection log but does not apply
any action on detected portable executable files.

9-41

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Note
If a detected portable executable file is in the Scan Exclusion list, thesystem does not apply any action on the file.

Scheduled Scan: Scan Exclusion Tab
Procedure1.

Select Enable scan exclusion.

2.

In the Scan Exclusion List (Directories) section, configure the required
settings.
a.

Select Exclude directories where Trend Micro products are
installed to automatically exclude directories associated with otherTrend Micro products.
For more information, see Trend Micro Product Directory Exclusions
on page 9-53.

b.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policy
Note
If your child policies Extend from parent, you can also
configure Child Policy Restrictions. Restrictions prevent thechild policy from adding specific objects to the list.

c.

Type a directory path to exclude from scans and click the + button.
The Security Agent does not scan files located in the specified
directory (and sub-directories).

9-42

Anti-malware Policy Settings

Note• You can specify a maximum of 256 directories to exclude fromscanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• Directory exclusions support the use of wildcard characters.
For more information, see Wildcard Exceptions on page 9-53.

3.

In the Scan Exclusion List (Files) section, configure the required
settings.
a.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policyb.

Type a file name or the file name with full directory path to exclude
from scans and click the + button.
Note• You can specify a maximum of 256 files to exclude fromscanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• File exclusions support the use of wildcard characters.
For more information, see Wildcard Exceptions on page 9-53.

4.

In the Scan Exclusion List (File Extensions) section, configure therequired settings.

9-43

Trend Micro Apex Central™ as a Service Widget and Policy Management Guidea.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policyb.

Select or type a file extension to exclude from scans and click the
Add > button.
Note• You can specify a maximum of 256 file extensions to exclude
from scanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• For Manual Scan, Scheduled Scan, and Scan Now, use aquestion mark (?) to replace a single character or an asterisk(*) to replace multiple characters as wildcard characters. For
example, if you do not want to scan all files with extensions
starting with D, such as DOC, DOT, or DAT, type D* or D??.

Scan Actions
You can configure Security Agents to use a set of predefined scan actions or
custom actions based on the detected malware type.
ImportantSome files are uncleanable.

For more information, see:

9-44

Anti-malware Policy Settings

ActiveAction
Different types of virus/malware require different scan actions. Customizing
scan actions requires knowledge about virus/malware and can be a tedioustask. The Security Agent uses ActiveAction to counter these issues.
ActiveAction is a set of pre-configured scan actions for viruses/malware.
If you are not familiar with scan actions or if you are not sure whichscan action is suitable for a certain type of virus/malware, Trend Microrecommends using ActiveAction.
Using ActiveAction provides the following benefits:• ActiveAction uses scan actions that are recommended by Trend Micro.
You do not have to spend time configuring the scan actions.
• Virus writers constantly change the way virus/malware attack endpoints.
ActiveAction settings are updated to protect against the latest threats andthe latest methods of virus/malware attacks.
The following table illustrates how ActiveAction handles each type of virus/
malware.
Table 9-2. Trend Micro Recommended Scan Actions Against Viruses and Malware
Real-time Scan

Manual Scan/Scheduled Scan

Virus/Malware
TypeFirst Action

Second Action

First Action

CVE exploit

Pass

N/A

N/A

N/A

Joke

Quarantine

N/A

Quarantine

N/A

Trojans

Quarantine

N/A

Quarantine

N/A

Virus

Clean

Quarantine

Clean

Quarantine

Test virus

Deny Access

N/A

Pass

N/A

PackerQuarantine

N/A

Quarantine

N/A

Others

Clean

Quarantine

Clean

Quarantine

SecondAction9-45

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Real-time Scan

Manual Scan/Scheduled Scan

Virus/Malware
TypeFirst Action

Second Action

First Action

Probable malware

Pass

N/A

Pass or userconfigured
actionSecondActionN/A

Note• For probable virus/malware, the default action is “Deny Access” during
Real-time Scan and “Pass” during Manual Scan and Scheduled Scan.
If these are not your preferred actions, you can change them to“Quarantine”, “Delete”, or “Rename”.
• Some files are uncleanable.
• ActiveAction is not available for spyware/grayware scan.

Custom Scan Actions
ActionDescription

DeleteDeletes the infected file.

Quarantine

Renames and then moves the infected file to a temporary quarantine
directory on the endpoint.
The Security Agent then sends quarantined files to the designated quarantine
directory, which is on the managing server by default.
The Security Agent encrypts quarantined files sent to this directory.
For more information, see Quarantine Directory on page 9-47.

9-46

Anti-malware Policy Settings

ActionClean

Description
Cleans the infected file before allowing full access to the file.
If the file is uncleanable, the Security Agent performs a second action, which
can be one of the following actions: “Quarantine”, “Delete”, “Rename”, and“Pass”.
This action can be performed on all types of security threats except probablevirus/malware.
Note
Some files are uncleanable. For details, see Uncleanable Files on page
9-49.

RenameChanges the infected file's extension to vir. Users cannot open the renamed
file initially, but can do so if they associate the file with a certain application.
The virus/malware may execute when opening the renamed infected file.

Pass

Performs no action on detected threats but records the detection in the logs.

Deny Access

When the Security Agent detects an attempt to open or execute an infected
file, it immediately blocks the operation.
Users can manually delete the infected file.

Quarantine Directory
If the action for an infected file is "Quarantine", the Security Agent encrypts
the file and moves it to a temporary quarantine folder located in <Agent
installation folder>\SUSPECT and then sends the file to the designatedquarantine directory.
Note
You can restore encrypted quarantined files in case you need to access themin the future.

9-47

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Accept the default quarantine directory, which is located on the Apex One
server computer. The directory is in URL format and contains the server's
host name or IP address.
• If the server is managing both IPv4 and IPv6 agents, use the host nameso that all Security Agents can send quarantined files to the server.
• If the server only has or is identified by its IPv4 address, only pure IPv4
and dual-stack Security Agents can send quarantined files to the server.
• If the server only has or is identified by its IPv6 address, only pure IPv6
and dual-stack Security Agents can send quarantined files to the server.
You can also specify an alternative quarantine directory by typing thelocation in URL, UNC path, or absolute file path format. Security
Agents should be able to connect to this alternative directory. For
example, the alternative directory should have an IPv6 address if it will
receive quarantined files from dual-stack and pure IPv6 Security Agents.
Trend Micro recommends designating a dual-stack alternative directory,
identifying the directory by its host name, and using UNC path when typing
the directory.
Refer to the following table for guidance on when to use URL, UNC path, orabsolute file path:
Table 9-3. Quarantine Directory
Quarantine
Directory

9-48

Accepted
FormatExampleA directory on the
managing server
computer

URL

http://<osceserver>

UNC path\\<osceserver>\ofcscan\Virus

A directory on
another Apex One
server computer(if you have other
Apex One servers
on the network)

URL

http://<osceserver2>

UNC path\\<osceserver2>\
ofcscan\Virus

Notes
This is the default directory.
Configure settings for this directory,
such as the size of the quarantine
folder.
Ensure that Security Agents canconnect to this directory. If you
specify an incorrect directory,
the Security Agent keeps thequarantined files on the SUSPECT
folder until a correct quarantine
directory is specified. In the server's

Anti-malware Policy Settings

Quarantine
Directory

Accepted
FormatAnother endpointon the network

UNC path\\<computer_name>\temp

A different
directory on the
Security Agent

Absolute
path

C:\temp

ExampleNotes
virus/malware logs, the scan result
is "Unable to send the quarantined
file to the designated quarantine
folder".
If you use UNC path, ensure thatthe quarantine directory folder isshared to the group "Everyone"
and that you assign read and write
permission to this group.

Uncleanable Files
The Virus Scan Engine is unable to clean the following files:
Table 9-4. Uncleanable File Solutions
Uncleanable File
Files infected with
Trojans

Explanation and Solution
Trojans are programs that perform unexpected or unauthorized,
usually malicious, actions such as displaying messages, erasing files,
or formatting disks. Trojans do not infect files, thus cleaning is notnecessary.
Solution: The Damage Cleanup Engine and Damage Cleanup Template
remove Trojans.

Files infected withworms

A worm is a self-contained program (or set of programs) able to spreadfunctional copies of itself or its segments to other endpoint systems.
The propagation usually takes place through network connections
or email attachments. Worms are uncleanable because the file is aself-contained program.
Solution: Trend Micro recommends deleting worms.

Write-protected
infected files

Solution: Remove the write-protection which allows for the cleaning of
the file.

Password-protected
files

Password-protected files include password-protected compressed
files or password-protected Microsoft Office files.
Solution: Remove the password protection which allows for thecleaning of the file.

9-49

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Uncleanable File
Backup files

Explanation and Solution
Files with the RB0~RB9 extensions are backup copies of infected files.
The cleaning process creates a backup of the infected file in case thevirus/malware damaged the file during the cleaning process.
Solution: If successfully cleaned, you do not need to keep the backup
copy of the infected file. If the endpoint functions normally, you candelete the backup file.

Infected files in the
Recycle Bin

The system may not allow the removal of infected files from the
Recycle Bin because the system is running.
1. Log on to the endpoint with Administrator privilege.
2. Close all running applications to prevent applications fromlocking the file, which would make Windows unable to deleteit.
3. Open the command prompt.
4. Type the following to delete the files:
del /s \$Recycle.Bin\*

5. Check if the files were removed.
Infected files in
Windows Temp
Folder or Internet
Explorer Temporary
Folder

The system may not allow the cleaning of infected files in the Windows
Temp folder or the Internet Explorer temporary folder because theendpoint uses them. The files to clean may be temporary files needed
for Windows operation.
1. Log on to the endpoint with Administrator privilege.
2. Close all running applications to prevent applications fromlocking the file, which would make Windows unable to deleteit.
3. If the infected file is in the Windows Temp folder:a. Open the command prompt.
b. Type the following to delete the files:
del /s \Windows\Temp\*

c. Restart the endpoint in normal mode.
4. If the infected file is in the Internet Explorer temporary folder:

9-50

Anti-malware Policy Settings

Uncleanable File

Explanation and Solution
a. Open a command prompt and go to the Internet Explorer
Temp folder.
• For Windows 7: %LocalAppData%\Microsoft\Windows\Temporary Internet Files• For Windows 8/8.1: %LocalAppData%\Microsoft\Windows\INetCache• For Windows 10: %LocalAppData%\Microsoft\Windows\INetCache\IE

b. Type the following to delete the files:
del /s .\*The last command deletes all files in the Internet Explorer
temporary folder.
c. Restart the endpoint in normal mode.
Files compressedusing anunsupported
compression format

Solution: Uncompress the files.

Locked files or files
that are currently
executing

Solution: Unlock the files or wait until the files have been executed.

Corrupted files

Solution: Delete the files.

Files Infected with Trojans
Trojans are programs that perform unexpected or unauthorized, usuallymalicious, actions such as displaying messages, erasing files, or formatting
disks. Trojans do not infect files, thus cleaning is not necessary.
Solution: The Security Agent uses the Damage Cleanup Engine and Damage
Cleanup Template to remove Trojans.

9-51

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Files Infected with Worms
A worm is a self-contained program (or set of programs) able to spreadfunctional copies of itself or its segments to other endpoint systems. The
propagation usually takes place through network connections or email
attachments. Worms are uncleanable because the file is a self-contained
program.
Solution: Trend Micro recommends deleting worms.

Write-protected Infected Files
Solution: Remove the write-protection to allow the Security Agent to clean
the file.

Password-protected Files
Includes password-protected compressed files or password-protected
Microsoft Office files.
Solution: Remove the password protection to allow the Security Agent toclean these files.

Backup Files
Files with the RB0~RB9 extensions are backup copies of infected files. The
Security Agent creates a backup of the infected file in case the virus/malware
damaged the file during the cleaning process.
Solution: If the Security Agent successfully cleans the infected file, you do
not need to keep the backup copy. If the endpoint functions normally, you
can delete the backup file.

Scan Exclusion Support
When excluding directories and file names from anti-malware scanning,refer to the following support information:

9-52

Anti-malware Policy Settings

Trend Micro Product Directory Exclusions
If you select Exclude directories where Trend Micro products are installedin the Scan Exclusion List (Directories) section, the Security Agent
automatically excludes following product directories:• <Server installation folder>• IM Security• InterScan eManager 3.5x
• InterScan Web Security Suite• InterScan Web Protect• InterScan FTP VirusWall• InterScan Web VirusWall• InterScan NSAPI Plug-in• InterScan E-mail VirusWall• ScanMail eManager™ 3.11, 5.1, 5.11, 5.12
• ScanMail for Lotus Notes™ eManager NT• ScanMail™ for Microsoft Exchange

Wildcard Exceptions
Scan exclusion lists for files and directories support the use of wildcard
characters. Use the "?" character to replace one character and "*" to replace
several characters.
Use wildcard characters cautiously. Using the wrong character might exclude
incorrect files or directories. For example, adding C:\* to the Scan Exclusion
List (Files) would exclude the entire C:\ drive.

9-53

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Table 9-5. Scan Exclusions Using Wildcard Characters
Value

Excluded

Not Excluded

c:\director*\fil\*.txtc:\directory\fil\doc.txt

c:\directory\file\

c:\directories\fil\files\document.txt

c:\directories\files\
c:\directory\file\doc.txt
c:\directories\files\documen
t.txt

9-54

c:\director?
\file\*.txt

c:\directory\file\doc.tx
tc:\directories\file\document.txt

c:\director?
\file\?.txt

c:\directory\file\1.txt

c:\directory\file\doc.txt

c:\*.txt

All .txt files in the C:\
directory

All other file types in the C:\
directory[]

Not supported

Not supported

c:\directories\file\document.txt

Chapter 10

Web Reputation Policy Settings
This section describes how to configure Web Reputation policies on Security
Agents.
Topics include:

10-1Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Web Reputation
Web reputation technology tracks the credibility of web domains byassigning a reputation score based on factors such as a website'sage, historical location changes, and indications of suspicious activities
discovered through malware behavior analysis. Trend Micro continually
analyzes websites and updates web reputation scores to prevent users fromaccessing potentially malicious content.
When a user attempts to access a website, the Security Agent queries a smart
protection source to ascertain the risk level of the content. The configured
Web Reputation policy for the Security Agent determines whether to allow
access to the website.
Web Reputation allows you to add websites that you consider safe or
dangerous to Approved or Blocked lists. The Security Agent does notquery web reputation scores for websites added to the lists but instead,
automatically allows or blocks access.

Configuring a Web Reputation Policy
Specify proxy server authentication credentials if you have set up a
proxy server to handle HTTP communication in your organization andauthentication is required before web access is allowed.
Procedure
1.

Click the External Agents tab to configure a policy for external agents or
the Internal Agents tab to configure a policy for internal agents.

2.

Under Enable Web Reputation on the following operating systems,
select the types of Windows platforms to protect (Windows desktop
platforms and Windows Server platforms).
Tip
Trend Micro recommends disabling Web Reputation for internal agents
if you already use a Trend Micro product with the web reputation
capability, such as InterScan Web Security Virtual Appliance.

10-2

Web Reputation Policy Settings

3.

Select Enable assessment mode.
Note
When in assessment mode, Security Agents allow access to all websites.
For any accessed website that violates the configured Security Level
setting, the Security Agent logs the event. Assessment mode allows you
to monitor website access and evaluate the safety of websites before
actively blocking users access. Based on your evaluation of the accesslogs, you can add trusted websites to the Approved URL List before
disabling assessment mode.

4.

Select Check HTTPS URLs.
Important
HTTPS URL scanning also supports the HTTP/2 protocol. Before Web
Reputation can check HTTPS or HTTP/2 URLs, you must configure someprerequisite settings for different browsers.
For more information, see HTTPS URL Scan Support on page 10-6.

5.

Select Scan common HTTP ports only to restrict web reputation
scanning to traffic through ports 80, 81, and 8080. By default, Web
Reputation scans all traffic through all ports.
Note
Not supported on Windows 7, 8, 8.1, 10, or Windows Server 2008 R2, 2012or later platforms.

6.

For internal Security Agents, select Send queries to Smart Protection
Servers if you want Security Agents to send web reputation queries to
Smart Protection Servers.
• If you enable this option:• Agents refer to the smart protection source list to determine
the Smart Protection Servers to which they send queries.
10-3

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide• Be sure that Smart Protection Servers are available. If all SmartProtection Servers are unavailable, agents do not send queries
to Smart Protection Network. The only remaining sources of
web reputation data for agents are the approved and blocked
URL lists.
• Agents do not block untested websites. Smart Protection
Servers do not store web reputation data for these websites.
• If you disable this option:• Agents send web reputation queries to the Smart Protection
Network. Endpoints must have an Internet connection to send
queries successfully.
• Agents can block untested websites if you select the Blockpages that have not been tested by Trend Micro option.
Note
You can only configure internal on-premises Security Agents to send web
reputation queries to local Smart Protection Servers.

7.

Select from the available web reputation security levels: High, Medium,or LowNote
The security levels determine whether Web Reputation allows or blocks
access to a URL. For example, if you set the security level to Low, Web
Reputation only blocks URLs that are known to be web threats. As you set
the security level higher, the web threat detection rate improves but thepossibility of false positives also increases.

8.

10-4

If you disabled the Send queries to Smart Protection Servers option,
you can select Block pages that have not been tested by Trend Micro.

Web Reputation Policy Settings

Note
While Trend Micro actively tests web pages for safety, users may
encounter untested pages when visiting new or less popular websites.
Blocking access to untested pages can improve safety but can also
prevent access to safe pages.

9.

Select Block pages containing malicious script to identify web browser
exploits and malicious scripts, and prevent the use of these threats fromcompromising the web browser.
Web Reputation utilizes both the Browser Exploit Prevention pattern
and the Script Analyzer pattern to identify and block web pages before
exposing the system.
Important• The Browser Exploit Prevention feature only supports HTTP traffic
analysis for Microsoft Edge Legacy, Microsoft Edge Chromium,
Mozilla Firefox, and Chrome browsers.
• The Browser Exploit Prevention feature requires that you enable theAdvanced Protection Service.

10. Configure the approved and blocked lists.
Note
The approved list takes precedence over the blocked list. When a URL
matches an entry in the approved list, agents always allow access to the
URL, even if it is in the blocked list.

a.

Select Enable approved/blocked list.

b.

Type a URL.
You can add a wildcard character (*) anywhere on the URL.
For example:
10-5Trend Micro Apex Central™ as a Service Widget and Policy Management Guide• Typing www.trendmicro.com/* means that Web Reputation
approves all pages in the Trend Micro website.
• Typing *.trendmicro.com/* means that Web Reputation
approves all pages on any sub-domain of trendmicro.com.
You can type URLs containing IP addresses. If a URL contains an
IPv6 address, enclose the address in parentheses.
c.

Click Add to Approved List or Add to Blocked List.
Important
Web Reputation does not perform any scanning on addresses located in
the Approved and Blocked lists.

11. To submit Web Reputation feedback, click the URL provided under
Reassess URL. The Trend Micro Web Reputation Query system opens
in a browser window.
12. Select whether to allow the Security Agent to send web reputation logs to
the server. Allow agents to send logs if you want to analyze URLs blockedby Web Reputation and take the appropriate action on URLs you think
are safe to access.

HTTPS URL Scan Support
HTTPS communication uses certificates to identify web servers. It encrypts
data to prevent theft and eavesdropping. Although more secure, accessing
websites using HTTPS still has risks. Compromised sites, even those withvalid certificates, can host malware and steal personal information. In
addition, certificates are relatively easy to obtain, making it easy to set up
malicious web servers that use HTTPS.
Enable checking of HTTPS URLs to reduce exposure to compromised andmalicious sites that use HTTPS. Web Reputation can monitor HTTPS traffic
on the following browsers:

10-6

Web Reputation Policy Settings

Table 10-1. Supported Browsers for HTTPS Traffic
Browser

VersionMozilla Firefox

3.5 or later

ChromeLatest version

Microsoft Edge

Prerequisites
None• Legacy• Chromium

10-7Chapter 11

Unknown Threat Protection
This section describes how you can configure Security Agents to detect andprotect against previously unidentified, targeted, or low prevalence threats.
Topics include:

11-1

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Predictive Machine Learning
Trend Micro Predictive Machine Learning uses advanced machine learningtechnology to correlate threat information and perform in-depth fileanalysis to detect emerging unknown security risks through digital DNA
fingerprinting, API mapping, and other file features. Predictive Machine
Learning also performs a behavioral analysis on unknown or low-prevalence
processes to determine if an emerging or unknown threat is attempting to
infect your network.
Predictive Machine Learning is a powerful tool that helps protect yourenvironment from unidentified threats and zero-day attacks.
Detection Type
File

Description
After detecting an unknown or low-prevalence file, the Security Agentscans the file using the Advanced Threat Scan Engine (ATSE) to extract
file features and sends the report to the Predictive Machine Learning
engine, hosted on the Trend Micro Smart Protection Network. Throughuse of malware modeling, Predictive Machine Learning compares
the sample to the malware model, assigns a probability score, anddetermines the probable malware type that the file contains.
If a functional Internet connection is unavailable, Predictive Machine
Learning automatically switches to the local model to provide
constant unknown threat protection against portable executable file
threats.
Depending on how you configure Predictive Machine Learning, theSecurity Agent can attempt to “Quarantine” the affected file to preventthe threat from continuing to spread across your network.

11-2

Unknown Threat Protection

Detection Type
Process

Description
After detecting an unknown or low-prevalence process, the Security
Agent monitors the process using the Contextual Intelligence Engine,and sends the behavioral report to the Predictive Machine Learning
engine. Through use of behavioral malware modeling, Predictive
Machine Learning compares the process behavior to the model,
assigns a probability score, and determines the probable malware
type the process is executing.
Process detection also monitors script execution. If the Contextual
Intelligence Engine detects the execution of a suspicious script,
Predictive Machine Learning takes the configured action.
Predictive Machine Learning performs script blocking on the following
types of scripts:• cscript• jar• powershell• vbs• wscript
Depending on how you configure Predictive Machine Learning, theSecurity Agent can “Terminate” the affected process or script andattempt to clean the file that executed the process or script.

Configuring Predictive Machine Learning Settings
Note
Predictive Machine Learning requires that you enable the following services:• Unauthorized Change Prevention• Advanced Protection Service

Procedure1.

Select Enable Predictive Machine Learning.

11-3

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

2.

Under Detection Settings, select the type of detections and related
action that Predictive Machine Learning takes.
Detection Type
File

Actions• Quarantine: Select to automatically quarantine files thatexhibit malware-related features based on the Predictive
Machine Learning analysis• Log only: Select to scan unknown files and log the Predictive
Machine Learning analysis for further in-house investigationof the threat

Process• Terminate: Select to automatically terminate processes orscripts that exhibit malware-related behaviors based on thePredictive Machine Learning analysis
Important
Predictive Machine Learning attempts to clean thefiles that executed the malicious processes orscripts. If the clean action is unsuccessful, Predictive
Machine Learning quarantines the affected files.
• Log only: Select to scan unknown processes or scripts andlog the Predictive Machine Learning analysis for further inhouse investigation of the threat3.

Under Exceptions, configure the global Predictive Machine Learning file
exceptions to prevent all agents from detecting a file as malicious.
a.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policy

11-4

Unknown Threat Protection

Note
If your child policies Extend from parent, you can also
configure Child Policy Restrictions. Restrictions prevent thechild policy from adding specific objects to the list.

b.

Click Add File Hash.
The Add File to Exception List screen appears.
Note
Use the Import and Export buttons to share the list with different
policies.

c.

Specify the file SHA-1 hash value to exclude from scanning.

d.

Optionally provide a note regarding the reason for the exception or
to describe the file name(s) associated with the hash value.

e.

Click Add.
Predictive Machine Learning adds the file hash to the Exceptions
list.

Configuring Sample Submission Settings
You can configure Security Agents to submit file objects that may containpreviously unidentified threats to a Virtual Analyzer for further analysis.
After assessing the objects, Virtual Analyzer adds any objects found tocontain unknown threats to the Virtual Analyzer Suspicious Objects lists anddistributes the lists to other Security Agents throughout the network.
Suspicious files include any of the following:• Programs not known to Trend Micro (downloaded through supported
web browsers or email channels)• Heuristic detections of processes (downloaded through supported webbrowsers or email channels)

11-5Trend Micro Apex Central™ as a Service Widget and Policy Management Guide• Low prevalence autorun programs on removable storage
Important
The size of the sample files that the Security Agents can submit changes basedon the type of Virtual Analyzer you use. For the Deep Discovery Analyzer
server, sample files can be up to 50 MB in size. For Deep Discovery Analyzer asa Service Add-on, sample files can be up to 60 MB in size.

Procedure1.

Select Enable suspicious file submission to Virtual Analyzer.

Configuring Suspicious Connection Settings
Security Agents can log and block all connections made between endpoints
and addresses in the Global C&C IP list. You can also log, but still allow
access to, IP addresses configured in the User-defined Blocked IP List.
Security Agents can also monitor connections that may be the result of abotnet or other malware threat. After detecting a malware threat, Security
Agents can attempt to clean the infection.
Procedure
1.

Enable the Detect network connections made to addresses in the
Global C&C IP list setting to monitor connections made to Trend Microconfirmed C&C servers and select to Log only or Block connections.
• To allow agents to connect to addresses in the User-defined Blocked
IP list, enable the Log and allow access to User-defined Blocked IP
list addresses setting.
Note
You must enable network connection logging before Security Agents canallow access to addresses in the User-defined Blocked IP list.

11-6

Unknown Threat Protection

2.

Enable the Detect connections using malware network fingerprinting
setting and select to Log only or Block connections.
• To allow Security Agents to attempt to clean connections made to
C&C servers, enable the Clean suspicious connections when a C&C
callback is detected setting. Security Agents use GeneriClean toclean the malware threat and terminate the connection to the C&C
server.
Note
You must enable Log connections using malware network
fingerprinting before Security Agents can attempt to clean theconnections made to C&C servers detected by packet structure matching.

11-7

Chapter 12

Device Control Policy Settings
This section describes how to configure Device Control policies on Security
Agents.
Topics include:

12-1

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Device Control
Device Control regulates access to external storage devices and network
resources connected to computers. Device Control helps prevent data loss
and leakage and, combined with file scanning, helps guard against security
risks.
You can configure Device Control policies for internal and external agents.
Administrators typically configure a stricter policy for external agents.
Trend Micro Apex Central provides both endpoint-based and user-based
Device Control policy configuration.

Configuring Device Control Settings
Procedure1.

Select Enable Device Control.
• If you are on the External Agents tab, you can apply settings tointernal agents by selecting Apply all settings to internal agents.
• If you are on the Internal Agents tab, you can apply settings toexternal agents by selecting Apply all settings to external agents.

2.

Add or edit a Device Control rule:• For user-based rules:• To create a rule based on Active Directory user or groupaccounts, click Add.
• To edit a rule based on Active Directory user or group accounts,
click the link in the User Accounts column.
ImportantUser-based Device Control rules are only available after integrating
Active Directory with Trend Micro Apex Central.

• To edit the default endpoint-based rule:12-2

Device Control Policy Settings• Click the All users (default) link in the User Accounts column.
Note
You cannot delete the default endpoint-based rule.

The Device Control Rule screen appears.
3.

In the User Accounts section, type and select the display name(s) of the
Active Directory user(s) or group account(s) to which the rule applies.
Note
You cannot specify user or group accounts when editing the default All
users (default) endpoint-based rule.

4.

In the Storage Devices section:a.

Select a permission for each storage device.
Important• Only Security Agents with Data Protection enabled can take the“Block” action. If you deploy a policy to Security Agents that do
not have Data Protection enabled, Apex One applies the action
configured in the drop-down box.
• Apex One automatically applies the access permission
configured for any USB device in the Allowed USB List even
if you do not enable Data Protection.

For details about permissions, see Permissions for Devices on page
12-5.
If you selected to restrict access to any storage device, the Allowed
Programs button appears. For USB storage devices, if you selected
Block (Data Protection), the Allowed USB Devices button appears.
b.

(Optional) Click Allowed Programs to configure a list of programs
that Device Control does not restrict access on any device type.
12-3

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

The Allowed Programs screen appears.
1. Type the full path or the trusted Digital Signature Provider
information of programs that Device Control allows users toaccess.
Note• When specifying a Digital Signature Provider, Device
Control only allows programs signed by the publisher to
Execute.
For more information, see Specifying a Digital Signature
Provider on page 12-8.
• When specifying the full path of a program, the Device
Control Allowed Programs list supports the use of
wildcard characters.
For more information, see Wildcard Support for the Device
Control Allowed Programs List on page 12-7.

2. Click Add.
The the full path of the program or the trusted Digital Signature
Provider information appears in the list.
3. Select whether to allow the program to Execute or Read/Write.
4. Click OK.
c.

(Optional) Click Allowed USB Devices to configure a list of USB
devices that Device Control does not block.
The Allowed USB Devices screen appears.
1. Type the device vendor, model, and serial ID in the list.
2. To add more devices, click the plus (+) icon.
3. In the Permissions drop-down, specify the access level Device
Control permits to users accessing the specified USB devices.

12-4

Device Control Policy Settings

4. Click OK.
d.

Select Block the AutoRun function on USB storage devices
to prevent programs saved on USB devices from executing
automatically.

e.

Select Display a notification message on the endpoint when Apex
One detects unauthorized device access to inform end users that
Device Control restricted access to a device.

5.

For Security Agents with the Data Protection feature installed, select toAllow or Block access to the devices listed under Mobile Devices and
Non-Storage Devices.

6.

Click OK.
Note
Device Control automatically assigns all user-based rules a higher
priority than the default endpoint-based rule (All users (default)).

7.

(Optional) Manage the Device Control rule list.
• Priority: Click the arrows to change the priority of user-based rules.
• Copy: Select a rule, click Copy, and modify the rule contents.
• Delete: Select a rule and click Delete to permanently remove therule from the list.

Permissions for Devices
Device Control permissions for storage devices are used when you:
• Allow access to USB storage devices, CD/DVD, floppy disks, and network
drives. You can grant full access to these devices or limit the level ofaccess.
• Configure the list of approved USB storage devices. Device Control
allows you to block access to all USB storage devices, except those thathave been added to the list of approved devices. You can grant fullaccess to the approved devices or limit the level of access.
12-5

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

The following table lists the permissions for storage devices.
Table 12-1. Device Control Permissions for Storage Devices
Permissions
Full access

Files on the Device

Incoming Files

Permitted operations: Copy, Move,
Open, Save, Delete, Execute

Permitted operations: Save, Move,
Copy
This means that a file can be saved,
moved, and copied to the device.

ModifyPermitted operations: Copy, Move,
Open, Save, Delete

Permitted operations: Save, Move,
Copy

Prohibited operations: Execute
Read and execute

Permitted operations: Copy,
Open, Execute

Prohibited operations: Save, Move,
Copy

Prohibited operations: Save,
Move, Delete
Read

Permitted operations: Copy, Open
Prohibited operations: Save,
Move, Delete, Execute

List device content
only

Prohibited operations: All
operations

Prohibited operations: Save, Move,
Copy

Prohibited operations: Save, Move,
Copy

The device and the files it
contains are visible to the user (forexample, from Windows Explorer).
Block(available after
installing Data
Protection)

Prohibited operations: All
operations

Prohibited operations: Save, Move,
Copy

The device and the files it contains
are not visible to the user (forexample, from Windows Explorer).

File-based scanning complements, and may override, the device
permissions. For example, if the permission allows a file to be opened but
the Security Agent detects that the file is infected with malware, a specificscan action is performed on the file to eliminate the malware. If the scan

12-6

Device Control Policy Settings

action is Clean, the file opens after it is cleaned. However, if the scan action
is Delete, the file is deleted.
The following table lists the permissions for mobile and non-storage devices
managed by Data Protection.
Table 12-2. Device Control Permissions for Mobile and Non-storage Devices
Permissions
Allow

Files on the Device

Incoming Files

Permitted operations: Copy, Move,
Open, Save, Delete, Execute

Permitted operations: Save, Move,
Copy
This means that a file can be saved,
moved, and copied to the device.

Block

Prohibited operations: All
operations

Prohibited operations: Save, Move,
Copy

The device and the files it contains
are not visible to the user (forexample, from Windows Explorer).

Tip
Device Control for Data Protection supports all 64-bit platforms. For
Unauthorized Change Prevention monitoring on systems that the Security
Agent does not support, set the device permission to Block to limit access tothese devices.

Wildcard Support for the Device Control Allowed Programs List
A program path and name should have a maximum of 259 characters andmust only contain alphanumeric characters (A-Z, a-z, 0-9). It is not possible
to specify only the program name.
You can use wildcards in place of drive letters and program names. Use aquestion mark (?) to represent single-character data, such as a drive letter.
Use an asterisk (*) to represent multi-character data, such as a program
name.

12-7

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Note
Wildcards cannot be used to represent folder names. The exact name of afolder must be specified.

Wildcards are used correctly in the following examples:
Table 12-3. Correct Usage of Wildcards
ExampleMatched Data?:\Password.exe

The "Password.exe" file located directly under any drive

C:\Program Files\Microsoft\*.exe

Any file in C:\Program Files that has a file extension

C:\Program Files\*.*Any file in C:\Program Files that has a file extension

C:\Program Files\a?c.exe

Any .exe file in C:\Program Files that has 3 charactersstarting with the letter "a" and ending with the letter "c"C:\*

Any file located directly under the C:\ drive, with orwithout file extensions

Wildcards are used incorrectly in the following examples:
Table 12-4. Incorrect Usage of Wildcards
ReasonExample??:\Buffalo\Password.exe?? represents two characters and drive letters only have asingle alphabetic character.

*:\Buffalo\Password.exe* represents multi-character data and drive letters only
have a single alphabetic character.

C:\*\Password.exe

Wildcards cannot be used to represent folder names. The
exact name of a folder must be specified.

C:\?\Password.exe

Specifying a Digital Signature Provider
Specify a Digital Signature Provider if you trust programs issued by theprovider. For example, type Microsoft Corporation or Trend Micro, Inc.
You can obtain the Digital Signature Provider by checking the properties
12-8

Device Control Policy Settingsof a program (for example, by right-clicking the program and selecting
Properties).

12-9

Chapter 13

Scan Exclusion Lists
This section describes how to configure scan exclusion lists that apply tomultiple scan features.
Topics include:

13-1

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Spyware/Grayware Approved List
The Security Agent provides a list of "approved" spyware/grayware, whichcontains files or applications that you do not want treated as spyware orgrayware. When a particular spyware/grayware is detected during scanning,
the Security Agent checks the approved list and performs no action if it finds
a match in the approved list.
Apply the approved list to one or several Security Agents and domains, orto all Security Agents that the server manages. The approved list applies toall scan types, which means that the same approved list will be used during
Manual Scan, Real-time Scan, Scheduled Scan, and Scan Now.

Managing the Spyware/Grayware Approved List
Procedure
1.

On the Spyware/Grayware names table, select a spyware/grayware
name. To select multiple names, hold the CTRL key while selecting.
• You can also type a keyword in the Search field and click Search.
The table refreshes with names that match the keyword.

2.

Click Add.
The names move to the Approved List table.

3.

To remove names from the approved list, select the names and click
Remove. To select multiple names, hold the CTRL key while selecting.

Rule Exceptions
You can configure the Rule Exceptions list in Security Agents policies to
exclude detections based on rule IDs from the following scan features:• Anti-malware scans• Behavior Monitoring• Predictive Machine Learning
13-2

Scan Exclusion Lists• Suspicious Connection
Configure rule exceptions in Security Agents policies to enhance policy
management and improve scan performance.

Configuring Rule Exceptions
Add rule IDs to the Rule Exceptions list to exclude scan detections based onrule IDs.
Procedure
1.

When configuring a parent policy, specify how other users can configurechild policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additional settings
to the settings inherited from the parent policy
Note
If your child policies Extend from parent, you can also configureChild Policy Restrictions. Restrictions prevent the child policy
from adding specific objects to the list.

2.

Type a valid rule ID.
You can find rule IDs on the Log Query screen.

3.

Click Add.
The system displays a new entry in the table.

4.

To remove an entry from the list, click the Delete icon.

Trusted Program List
You can configure Security Agents to skip scanning of trusted processes
during Application Control, Behavior Monitoring, Device Control, Endpoint
13-3

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Sensor, and Real-time Scans. After adding a program to the Trusted Programs
List, the Security Agent does not subject the program or any processes
initiated by the program to Real-time Scan. Add trusted programs to theTrusted Program List to improve the performance of scanning on endpoints.
After adding a program to the Trusted Programs List, the Security Agent
automatically excludes the program from the following scans:• Application Control (configurable only on the Trend Micro Apex Central
console)• Behavior Monitoring• Device Control• Endpoint Sensor (configurable only on the Trend Micro Apex Central
console)• Real-time Scan: file checking and process scanning

Configuring the Trusted Programs List
The Trusted Programs List excludes programs and all child processes calledby the program from Application Control, Behavior Monitoring, Device
Control, Endpoint Sensor, and Real-time Scan.
Procedure
1.

When configuring a parent policy, specify how other users can configurechild policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additional settings
to the settings inherited from the parent policy
Note
If your child policies Extend from parent, you can also configureChild Policy Restrictions. Restrictions prevent the child policy
from adding specific objects to the list.

13-4

Scan Exclusion Lists

2.

Type the full program path of the program to exclude from the list.

3.

Click Add to Trusted Program List.

4.

To remove a program from the list, click the Delete icon.

13-5Chapter 14

Endpoint Sensor Policy Settings
This section discusses how to configure Endpoint Sensor policies on Security
Agents.
Topics include:

14-1

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Endpoint Sensor
Endpoint Sensor is a powerful monitoring and investigation tool used to
identify the presence, location, and entry point of threats. Through the useof detailed system event recording and historical analysis, you can perform
Historical Investigations to discover hidden threats throughout your networkand locate all affected endpoints. Generate Root Cause Analysis reports tounderstand the nature and activity of the malware since the threat entered
the endpoint.
You can also perform Live Investigations through the use of shared IOC files
and YARA rules. Live Investigations conduct in-depth searches of endpoints
to locate previously unidentified threats and possible Advanced PersistentThreat attacks.

Configuring Endpoint Sensor Settings
Important• The Endpoint Sensor feature requires special licensing and additional
system requirements. Ensure that you have the correct license before
deploying Endpoint Sensor policies to endpoints. For more information
on how to obtain licenses, contact your support provider.

Procedure1.

Select Enable Endpoint Sensor.
• Enable Attack Discovery to detect known attack indicators on
endpoints
Note
Attack Discovery uses Trend Micro threat intelligence based on
Indicators of Attack (IoA) behaviors. After detecting a known IoA,
Attack Discovery logs the detection.

14-2

Chapter 15

Vulnerability Protection Policy Settings
This section discusses how to configure Vulnerability Protection policies on
Security Agents.
Topics include:

15-1

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Vulnerability Protection
Integration with Vulnerability Protection protects Apex One users byautomating the application of virtual patches before official patches become
available. Trend Micro provides protected endpoints with recommended
Intrusion Prevention rules based on your network performance and security
priorities.

Configuring Vulnerability Protection Settings
Procedure1.

Select Enable Vulnerability Protection.

2.

Configure intrusion prevention settings:a.

Click the Intrusion Prevention Rules tab.

b.

Select one of the following scanning profiles:• Recommended: Ensures protection against known
vulnerability issues, provides more relevant data, and reduces
performance impact on endpoints• Aggressive: Applies additional Intrusion Prevention Rules for
suspicious network activities to the Recommended scanningprofileImportantAggressive scanning may generate a large number ofnonessential logs and impact endpoint performance. Trend
Micro strongly advises using the Recommended profile.

c.

(Optional) Select a view to filter the list of Intrusion Prevention
Rules by status.
View
All

15-2

Description
Displays all Intrusion Prevention Rules

Vulnerability Protection Policy Settings

d.

View

Description

Default (Enabled)

Displays only the Intrusion Prevention Rules that the selectedscanning profile enables by default

Default (Disabled)

Displays only the Intrusion Prevention Rules that the selectedscanning profile disables by default

User-defined(Enabled)

Displays only the Intrusion Prevention Rules enabled by theuser

User-defined(Disabled)

Displays only the Intrusion Prevention Rules disabled by theuser

Modify the status of a rule by selecting from the Status drop-down
control.
• Default (Enabled): The selected scanning profile enables thecorresponding rule by default. Select to apply the rule status
defined by the scanning profile.
• Default (Disabled): The selected scanning profile disables thecorresponding rule by default. Select to apply the rule status
defined by the scanning profile.
• User-defined (Enabled): Select to enable the rule.
• User-defined (Disabled): Select to disable the rule.

3.

Configure network engine settings:a.

Click the Network Engine Settings tab.

b.

Select the Network Engine Detection Mode*.
Note
You can also use the selected Network Engine Detection Mode toconfigure the Advanced Logging Policy.

• Inline: Live packet streams pass directly through the
Vulnerability Protection network engine. All rules are applied

15-3

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

to the network traffic before the packets proceed up the
protocol stack.
• Tap (Detect-only): Live packet streams are replicated anddiverted from the main stream.
c.

Configure the following settings:
Setting

15-4

Description

ESTABLISHED Timeout

How long to stay in the ESTABLISHED state before
closing the connection

LAST_ACK Timeout

How long to stay in the LAST-ACK state before closing
the connection

Cold Start Timeout

The amount of time to allow non-SYN packets that
could belong to a connection that was established
before the stateful mechanism was started

UDP Timeout

The maximum duration of a UDP connection

Maximum TCP
Connections

The maximum number of simultaneous TCP
connections

Maximum UDP
Connections

The maximum number of simultaneous UDP
connections

Ignore Status Code

Select up to 3 types of events to ignoreVulnerability Protection Policy Settings

Setting
Advanced Logging Policy

Description
Select from the following settings:• Bypass: No filtering of events. Overrides the
Ignore Status Code settings (above) and otheradvanced settings, but does not override logging
settings defined on the Apex One server• Network Engine Detection Mode*: Uses Tap
Mode if Tap (Detect-only) is selected for the
Network Engine Detection Mode, or Normal
if Inline is selected for the Network Engine
Detection Mode
• Normal: All events are logged except dropped
retransmits• Backwards Compatibility Mode: For support use
only• Verbose Mode: Same as Normal but including
dropped retransmits• Stateful and Normalization Suppression:
Ignores dropped retransmit, out of connection,
invalid flags, invalid sequence, invalid ack,
unsolicited udp, unsolicited ICMP, out of allowed
policy• Stateful, Normalization, and Frag Suppression:
Ignores everything that Stateful andNormalization Suppression ignores as well as
events related to fragmentation• Stateful, Frag, and Verifier Suppression:
Ignores everything Stateful, Normalization, andFrag Suppression ignores as well as verifierrelated events• Tap Mode: Ignores dropped retransmit, outof connection, invalid flags, invalid sequence,
invalid ack, max ack retransmit, packet on closed
connection
For a more comprehensive list of which events are
ignored for Stateful and Normalization Suppression,
Stateful, Normalization, and Frag Suppression,
Stateful, Frag, and Verifier Suppression, and Tap
15-5

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Setting

Description
Mode, see Advanced Logging Policy Modes on page
15-6.

4.

Click Save to apply settings.

Advanced Logging Policy Modes
The following table lists the types of Events that are ignored in four of themore complex Advanced Logging Policy modes.
ModeStateful and Normalization
Suppression

Ignored Events
Out Of Connection
Invalid Flags
Invalid Sequence
Invalid ACK
Unsolicited UDP
Unsolicited ICMPOut Of Allowed Policy
Dropped Retransmit

Stateful, Normalization, andFrag Suppression

Out Of Connection
Invalid Flags
Invalid Sequence
Invalid ACK
Unsolicited UDP
Unsolicited ICMPOut Of Allowed Policy
CE Flags

15-6

Vulnerability Protection Policy Settings

Mode

Ignored Events
Invalid IP
Invalid IP Datagram Length
Fragmented
Invalid Fragment Offset
First Fragment Too Small
Fragment Out Of Bounds
Fragment Offset Too Small
IPv6 Packet
Max Incoming Connections
Max Outgoing Connections
Max SYN Sent
License Expired
IP Version Unknown
Invalid Packet Info
Maximum ACK Retransmit
Packet on Closed Connection
Dropped Retransmit

Stateful, Frag, and Verifier
Suppression

Out Of Connection
Invalid Flags
Invalid Sequence
Invalid ACK
Unsolicited UDP
Unsolicited ICMP

15-7

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Mode

Ignored Events
Out Of Allowed Policy
CE Flags
Invalid IP
Invalid IP Datagram Length
Fragmented
Invalid Fragment Offset
First Fragment Too Small
Fragment Out Of Bounds
Fragment Offset Too Small
IPv6 Packet
Max Incoming Connections
Max Outgoing Connections
Max SYN Sent
License Expired
IP Version Unknown
Invalid Packet Info
Invalid Data Offset
No IP Header
Unreadable Ethernet Header
Undefined
Same Source and Destination IP
Invalid TCP Header Length
Unreadable Protocol Header

15-8Vulnerability Protection Policy Settings

Mode

Ignored Events
Unreadable IPv4 Header
Unknown IP Version
Maximum ACK Retransmit
Packet on Closed Connection
Dropped Retransmit

Tap Mode

Out Of Connection
Invalid Flags
Invalid Sequence
Invalid ACK
Maximum ACK Retransmit
Packet on Closed Connection
Dropped Retransmit

15-9Part V
Apex One Server Policies

Chapter 16

Apex One Server Policy Settings
This section describes how you can manage Apex One server policy settings.

16-1

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Global Agent Settings
Configure and apply global agent settings to agents that report to the Apex
One server.

Security Settings
Procedure1.

Select Global Agent Settings.

2.

Click the Security Settings tab.

3.

Configure settings as required.
SectionSettings

Scan Settings(general)• Exclude Microsoft Exchange server folders and files fromscans: Prevents the Security Agent installed on the Microsoft
Exchange server from scanning the following Exchange server
folders:• The following folders in \Exchsrvr\Mailroot\vsi 1:
Queue, PickUp, and BadMail• .\Exchsrvr\mdbdata, including these files: priv1.stm,
priv1.edb, pub1.stm, and pub1.edb• .\Exchsrvr\Storage GroupFor Microsoft Exchange 2007 or later folders, you need tomanually add the folders to the scan exclusion list. For scan
exclusion details, see the following website:
http://technet.microsoft.com/en-us/library/bb332342.aspx• Enable deferred scanning on file operations: Allows users
to copy files and then scans the files after the copy processcompletes to improve the performance of the copy and scan
processes

16-2

Apex One Server Policy Settings

SectionSettings
ImportantDeferred scanning requires that the Virus Scan Engine(VSAPI) be version 9.713 or later.
• Enable Early Launch Anti-Malware protection on endpoints:
Allows the Security Agent to load and start scanning before otherthird-party software drivers during start up (only supported on
Windows 8, Windows Server 2012 or later versions)
Note
After scanning all third-party software drivers, theSecurity Agent reports the driver classification
information to the system kernel. Administrators candefine actions based on the driver classifications inGroup Policy in Windows and view scan results using
Event Viewer on endpoints.

Scan Settings
for Large
Compressed
Files

In the Real-time Scan and Manual Scan/Scheduled Scan/Scan Now
sections, configure the following settings:• Do not scan files if the compressed file size exceeds XX MB:
Enables the Security Agent to check the sizes of individual files
within a compressed archive and skips scanning files if theindividual file size exceeds the configured threshold• In a compressed file, scan only the first XX files: Prevents the
Security Agent from scanning all files in archives that containmore files than the configured threshold
Note
If you configure Scan Settings for Large Compressed Files and
Scheduled Scan Settings in an Apex One Security Agent policy
and Apex One Server policy, settings in the Apex One Security
Agent policy take effect.

16-3

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Section
Virus/Malware
Scan Settings
Only

Settings
Clean/Delete infected files within compressed files: The Security
Agent attempts to perform the “Clean” or “Delete” action oncompressed files within certain archive types that contain malware
threats
Note
The Security Agent only attempts to “Clean” or “Delete”
malware threats within compressed archives if you haveconfigured the “Clean” or “Delete” action for the type of
malware detected.

Spyware/GraywareScan Settings
Only

Scan for cookies: The Security Agent scans all cookies for spyware/
graywareScheduled
Scan Settings• Remind users of the Scheduled Scan XX minutes before it
runs: Displays a notification message on the endpoint before
Scheduled Scan begins• Count cookie into spyware log: The Security Agent creates logs
for cookies detected as spyware/grayware

Note
You can disable the notification message on the Other
Settings tab of the Privileges and Other Settings
screen.
• Postpone Scheduled Scan for up to XX hour(s) and XX
minute(s): Sets the maximum amount of time users with the
Postpone Scheduled Scan privilege can delay or pause a
Scheduled Scan for
Note
You can grant the Postpone Scheduled Scan privilege on
the Privileges tab of the Privileges and Other Settings
screen.

16-4

Apex One Server Policy Settings

SectionSettings• Automatically stop Scheduled Scan when scanning lasts morethan XX hour(s) and XX minute(s): Stops a long Scheduled Scan
after reaching the configured time duration• Skip Scheduled Scan when a wireless endpoint's battery life
is less than XX% and its AC adapter is unplugged: Prevents the
Security Agent from starting a Scheduled Scan if the battery life islow
Resume Scheduled Scan
• Resume an interrupted Scheduled Scan: Resumes a Scheduled
Scan at the specified time if the user interrupted the scan byturning off the endpoint• Resume a missed Scheduled Scan: Starts a Scheduled Scan at
the specified time if the endpoint was not running when the
Scheduled Scan should have started
Note
If you configure Scan Settings for Large Compressed Files and
Scheduled Scan Settings in an Apex One Security Agent policy
and Apex One Server policy, settings in the Apex One Security
Agent policy take effect.

FirewallSettings• Send firewall logs to the server every: Sets the frequency that
Security Agents with the Allow Security Agents to send firewall
logs to the Apex One server privilege send Firewall logs to theserverNote
You can grant the Allow Security Agents to send
firewall logs to the Apex One server privilege on thePrivileges tab of the Privileges and Other Settings
screen.
• Update the Apex One firewall driver only after a system
restart: Prevents the Security Agent from attempting to update
the Common Firewall Driver during normal operations

16-5

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

SectionSettings• Send firewall log count information to the Apex One server
hourly to determine the possibility of a firewall outbreak:Enables the Security Agent to send Firewall detection counts to
the Apex Central hourly

Behavior
Monitoring
Settings

Automatically take action if the user does not respond within: XX
second(s): Sets the maximum amount of time that users have before
Behavior Monitoring allows a program to execute
Note
You must enable Event Monitoring and set the action for theparticular event to Ask when necessary before the Security
Agent displays the prompt.

4.

Click Save.

System Settings
Procedure

16-6

1.

Select Global Agent Settings.

2.

Click the System tab.

3.

Configure settings as required.
SectionSettings

Certified Safe
Software Service
Settings

Enable the Certified Safe Software Service for Behavior
Monitoring, Firewall, and antivirus scans: Queries Trend Microdata centers to verify the safety of a program detected by Malware
Behavior Blocking, Event Monitoring, Firewall, or antivirus scans
to reduce the likelihood of false positives

Apex One Server Policy Settings

SectionSettings

Smart Protection
Service ProxyUse configured Smart Protection Sources for service queries:
Security Agents use the configured Smart Protection Service Proxy
settings when querying Smart Protection sources for the following
features:• Predictive Machine Learning• Behavior Monitoring
Note
If the integrated Smart Protection Server is unavailable,
Security Agents connect to the Trend Micro SmartProtection Network when performing queries.

Updates• Download only the pattern files from the ActiveUpdate
server when performing updates: Limit Security Agentsto download only the pattern files from the Trend Micro
ActiveUpdate server to reduce the bandwidth consumed
during updates and speed up the update process.
• Reserve __ MB of disk space for updates: Specify theamount of agent disk space for hot fixes, pattern files, scanengines, and program updates. Apex Central reserves 60MB
of disk space by default.

16-7

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

SectionSettings

Services Restart

Automatically restart any Security Agent service if the service
terminates unexpectedly: Restart Security Agent services that
stopped responding unexpectedly
Configure the following:• Restart the service after __ minutes: Specify the amountof time (in number of minutes) that must elapse before Apex
Central restarts a service.
• If the first attempt to restart the service is unsuccessful,
retry __ times: Specify the maximum retry attempts forrestarting a service. Manually restart a service if it remains
stopped after the maximum retry attempts.
• Reset the unsuccessful restart count after_ hour(s): If a
service remains stopped after exhausting the maximum retryattempts, Apex Central waits a certain number of hours toreset the failure count. If a service remains stopped after thenumber of hours elapses, Apex Central restarts the service.

Root Certificate
ImportFor file integrity checking, you can enable Security Agents toautomatically import root certificates on endpoints based on theselected Windows versions.
Note• It is recommended you enable this feature
for protected endpoints in an isolated network
environment.
• For the list of locations from which Security Agentsobtain the root certificates, see Root Certificate
Locations on page 16-9.
• For information on intermediate and root certificate
locations, see the Knowledge Base article.

4.

16-8

Click Save.

Apex One Server Policy Settings

Root Certificate Locations
The following lists the locations from which Security Agents obtain the root
certificates.
• DigiCert Assured ID Root CA (thumbprint:
0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43)• DigiCert High Assurance EV Root CA (thumbprint:
5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25)• VeriSign Class 3 Public Primary Certification Authority - G5 (thumbprint:
4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5)• VeriSign Universal Root Certification Authority (thumbprint:
3679CA35668772304D30A5FB873B0FA77BB70D54)• DigiCert Trusted Root G4 (thumbprint:
ddfb16cd4931c973a2037d3fc83a4d7d775d05e4)• USERTrust RSA Certification Authority (thumbprint:
2b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e)• Microsoft Identity Verification Root Certificate Authority
2020(thumbprint: F40042E2E5F7E8EF8189FED15519AECE42C3BFA2)• thawte Primary Root CA(thumbprint:
91c6d6ee3e8ac86384e548c299295c756c817b81)• GlobalSign(thumbprint: d69b561148f01c77c54578c10926df5b856976ad)• Microsoft Root Certificate Authority 2010 (thumbprint:
3B1EFD3A66EA28B16697394703A72CA340A05BD5)• Microsoft Root Certificate Authority 2011 (thumbprint:
8F43288AD272F3103B6FB1428485EA3014C0BCFE)• Thawte Timestamping CA (thumbprint:
BE36A4562FB2EE05DBB3D32323ADF445084ED656)• Microsoft Root Authority (thumbprint:
a43489159a520f0d93d032ccaf37e7fe20a8b419)

16-9

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Network Settings
Procedure1.

Select Global Agent Settings.

2.

Click the Network tab.

3.

Configure settings as required.
SectionPreferred IP
Addresses

Settings
This setting is only available on dual-stack Apex One servers and isapplied only by dual-stack Security Agents.
• IPv4 only: Security Agents use their IPv4 address.
• IPv4 first, then IPv6: Security Agents use their IPv4 address
first. If the Security Agent cannot register using its IPv4
address, it uses its IPv6 address. If registration is unsuccessful
using both IP addresses, the agent retries using the IP
address priority for this selection.
• IPv6 first, then IPv4: Security Agents use their IPv6 address
first. If the Security Agent cannot register using its IPv6
address, it uses its IPv4 address. If registration is unsuccessful
using both IP addresses, the Security Agent retries using theIP address priority for this selection.

Virus/Malware
Log Bandwidth
Settings

Enable the Security Agent to create a single virus/malware
log entry for recurring detections of the same virus/malware
within an hour: Consolidates virus log entries when detecting
multiple infections from the same virus/malware over a shortperiod of time
The Security Agent may detect a single virus/malware multiple
times, quickly filling the virus/malware logs and consuming
network bandwidth when sending log information to theserver. Enabling this feature helps reduce both the number ofvirus/malware log entries made and the amount of network
bandwidth Security Agents consume when reporting malware log
information to the server.

Unreachable
Network

16-10

Configure the server polling settings:

Apex One Server Policy Settings

SectionSettings• If the Apex One server has both an IPv4 and IPv6 address, you
can type an IPv4 address range and IPv6 prefix and length.
For example:
Type an IPv4 address range if the server is pure IPv4, or an
IPv6 prefix and length if the server is pure IPv6.
When any Security Agent IP address matches an IP addressin the range, the Security Agent applies the heartbeat andserver polling settings and the server treats the Security
Agent as part of the unreachable network.
Note
Security Agents with an IPv4 address can connect toa pure IPv4 or dual-stack Apex One server.
Security Agents with an IPv6 address can connect toa pure IPv6 or dual-stack Apex One server.
Dual-stack Security Agents can connect to dualstack, pure IPv4, or pure IPv6 Apex One server.
• Agents poll the server for updated components andsettings every __ minute(s): Specify the server polling
frequency. Type a value between 1 and 129600 minutes.
Tip
Trend Micro recommends that the server polling
frequency be at least three times the heartbeat
sending frequency.
Configure the heartbeat settings:
a. Select Allow agents to send heartbeat to the server.
b. Select All agents or Only agents in the unreachable
network.

16-11

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

SectionSettings
c. In Agents send heartbeat every __ minute(s), specify how
often Security Agents send heartbeat. Type a value between 1
and 129600 minutes.
d. In An agent is offline if there is no heartbeat after __minute(s), specify how much time without a heartbeat must
elapse before the Apex One server treats the Security Agentas offline. Type a value between 1 and 129600 minutes.

Server Polling
Interval

Polling interval: XX minute(s): Configures the Security Agents
to automatically attempt to connect with the Apex Central at aregular interval to receive updated settings or components and toreport the Security Agent status
Note
The Apex Central server classifies all Security Agentsthat did not successfully poll the server at the specified
interval as being “Unreachable”.

4.

Click Save.

Agent Control Settings
Procedure1.

Select Global Agent Settings.

2.

Click the Agent Control tab.

3.

Configure settings as required.

16-12

SectionSettings

General Settings

Add Manual Scan to the Windows shortcut menu on endpoints:
Displays the Scan menu item to the Security Agents shortcut
menuApex One Server Policy Settings

Section
Alert Settings

Settings• Show the alert icon on the Windows taskbar if the virus
pattern file is not updated after XX day(s): Displays an alert
icon on the Windows taskbar to remind users to update an
outdated Virus Pattern after the specified number of days
• Display a notification message if the endpoint needs torestart to load a kernel mode driver: Displays a notificationon the endpoint indicating that a restart is required to finish
installing a hotfix or upgrade package that contains a newkernel mode driver

Agent Language
Configuration

You can configure all Security Agents to display using the Apex
Central server language settings or the locally logged on user
language settings.
• Local language settings on the endpoint: The Security
Agent displays using the language settings of the logged on
user.
Note
If the Security Agent does not support the logged onuser language settings, the agent applies the Apex
Central server language. If the endpoint does notsupport the Apex Central server language, English
displays.
• Apex One server language: The Security Agent displays
using the Apex Central server language.
Note
If the endpoint does not support the Apex Central
server language, English displays.

4.

Click Save.

16-13

Part VI
Apex One Data Loss Prevention
Policies

Chapter 17

Apex One Data Loss Prevention Policy
Settings
This section describes how to configure Data Loss Prevention policies for
Security Agents.
Topics include:

17-1

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Data Loss Prevention (DLP)
Traditional security solutions are focused on preventing external security
threats from reaching the network. In today’s security environment, thisis only half the story. Data breaches are now commonplace, exposing anorganization’s confidential and sensitive data – referred to as digital assets– to outside unauthorized parties. A data breach may occur as a resultof internal employee mistakes or carelessness, data outsourcing, stolen or
misplaced computing devices, or malicious attacks.
Data breaches can:• Damage brand reputation• Erode customer trust in the organization• Result in unnecessary costs to cover for remediation and to pay fines forviolating compliance regulations• Lead to lost business opportunities and revenue when intellectual
property is stolen
With the prevalence and damaging effects of data breaches, organizations
now see digital asset protection as a critical component of their security
infrastructure.
Data Loss Prevention safeguards an organization’s sensitive data against
accidental or deliberate leakage. Data Loss Prevention allows you to:• Identify the sensitive information that requires protection using data
identifiers• Create policies that limit or prevent the transmission of digital assets
through common transmission channels, such as email and external
devices• Enforce compliance to established privacy standards
Before you can monitor sensitive information for potential loss, you must beable to answer the following questions:• What data needs protection from unauthorized users?

17-2

Apex One Data Loss Prevention Policy Settings• Where does the sensitive data reside?
• How is the sensitive data transmitted?
• What users are authorized to access or transmit the sensitive data?
• What action should be taken if a security violation occurs?
This important audit typically involves multiple departments and personnel
familiar with the sensitive information in your organization.
If you already defined your sensitive information and security policies, you
can begin to define data identifiers and company policies.

Configuring a Data Loss Prevention Policy
Procedure
1.

Click the External Agents tab to configure a policy for external agents or
the Internal Agents tab to configure a policy for internal agents.
Note
Configure agent location settings if you have not done so. Agents use
these location settings to determine the correct Data Loss Prevention
policy to apply.

2.

Select Enable Data Loss Prevention.

3.

Choose one of the following:• If you are on the External Agents tab, you can apply all Data Loss
Prevention settings to internal agents by selecting Apply all settings
to internal agents.
• If you are on the Internal Agents tab, you can apply all Data
Loss Prevention settings to external agents by selecting Apply all
settings to external agents.

4.

Manage the rules that Data Loss Prevention applies to the policy un theRules tab.
17-3

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Task
Add a new rule

Description
Click Add to create a rule that applies to the policy.
For more information, see Configuring Data Loss Prevention Rules on
page 17-4.

Copy existing
rule settings

Select an existing rule and click Copy to open the Data Loss
Prevention Policy Settings screen. Modify the rule settings as
required.

Delete existingrules

Select an existing rule and click Delete to remove the rule from the list.

Modify existing
rules

Click the Rule name of an existing rule to modify settings.

Enable/Disable
existing rules

Click the button under the Enable column to enable or disable a rule
for the policy.

Note
A policy can contain a maximum of 40 rules.

5.

Click the Exceptions tab and configure any necessary exception settings.
For more information, see Data Loss Prevention Exceptions on page 17-12.

Configuring Data Loss Prevention Rules
Note
Data Loss Prevention processes rules and templates by priority. If a rule is set
to “Pass”, Data Loss Prevention processes the next rule in the list. If a rule isset to “Block” or “User Justification”, Data Loss Prevention blocks or accepts
the user action and does not process that rule/template further.

Procedure1.
17-4

Select Enable this rule.

Apex One Data Loss Prevention Policy Settings

2.

Specify a name for the rule.
Configure the template settings:

3.

Click the Template tab.

4.

Select templates from the Available templates list and then click Add.
When selecting templates:• Select multiple entries by clicking the template names whichhighlights the name.
• Use the search feature if you have a specific template in mind. You
can type the full or partial name of the template.
Note
Each rule can contain a maximum of 200 templates.

Configure the channel settings:
5.

Click the Channel tab.

6.

Select the channels for the rule.
For details about channels, see Network Channels on page 17-6 and
System and Application Channels on page 17-9.

7.

If you selected any of the network channels, select the transmission
scope:• All transmissions• Only transmissions outside the Local Area Network
See Transmission Scope and Targets for Network Channels on page 17-6
for details on transmission scope, how targets work depending on thetransmission scope, and how to define targets correctly.

8.

If you selected Email clients:a.

Click Exceptions.

b.

Specify monitored and non-monitored internal email domains.
17-5

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

For details on monitored and non-monitored email domains, see
Email Clients on page 17-7.
9.

If you selected Removable storage:a.

Click Exceptions.

b.

Add non-monitored removable storage devices, identifying them by
their vendors. The device model and serial ID are optional.
The approved list for USB devices supports the use of the asterisk(*) wildcard. Replace any field with the asterisk (*) to include all
devices that satisfy the other fields.
For example, [vendor]-[model]-* places all USB devices from thespecified vendor and the specified model type, regardless of serial
ID, to the approved list.

c.

To add more devices, click the plus (+) icon.

Configure the action settings:
10. Click the Action tab.
11. Select a primary action and any additional actions. For details about
actions, see Data Loss Prevention Actions on page 17-10.
12. After configuring the Template, Channel, and Action settings, click
Save.

Transmission Scope and Targets for Network Channels
Transmission scope and targets define data transmissions on network
channels that Data Loss Prevention must monitor. For transmissions thatshould be monitored, Data Loss Prevention checks for the presence of data
identifiers before allowing or blocking the transmission. For transmissions
that should not be monitored, Data Loss Prevention does not check for thepresence of data identifiers and immediately allows the transmission.

Network Channels
Data Loss Prevention can monitor data transmission through the following
network channels:
17-6

Apex One Data Loss Prevention Policy Settings• Email clients• FTP• HTTP and HTTPS• IM applications• SMB protocol• WebmailTo determine data transmissions to monitor, Data Loss Prevention checks thetransmission scope, which you need to configure. Depending on the scopethat you selected, Data Loss Prevention will monitor all data transmissions or
only transmissions outside the Local Area Network (LAN).

Email Clients
Data Loss Prevention monitors email transmitted through various email
clients. Data Loss Prevention checks the email subject, body, andattachments for data identifiers. For a list of supported email clients, see
the Data Protection Lists document at:
http://docs.trendmicro.com/en-us/enterprise/data-protection-referencedocuments.aspx
Monitoring occurs when a user attempts to send the email. If the email
contains data identifiers, Data Loss Prevention will either allow or block theemail.
You can define non-monitored internal email domains and monitored
subdomains.
• Non-monitored email domains: Data Loss Prevention immediately
allows the transmission of emails sent to non-monitored domains.

17-7

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Note
Data transmissions to non-monitored email domains and to monitored
email subdomains where "Monitor" is the action are similar in that thetransmission is allowed. The only difference is that for non-monitored
email domains, Data Loss Prevention does not log the transmission,
whereas for monitored email subdomains, the transmission is always
logged.

• Monitored email subdomains: When Data Loss Prevention detects
email transmitted to a monitored subdomain, it checks the action for thepolicy. Depending on the action, the transmission is allowed or blocked.
Note
If you select email clients as a monitored channel, an email must matcha policy for it to be monitored. In contrast, an email sent to monitored
email subdomains is automatically monitored, even if it does not match a
policy.

Specify domains using any of the following formats, separating multiple
domains with commas:• X400 format, such as /O=Trend/OU=USA, /O=Trend/OU=China• Email domains, such as example.com
For email messages sent through the SMTP protocol, Data Loss Prevention
checks if the target SMTP server is on the following lists:
1. Monitored targets
2. Non-monitored targets
3. Non-monitored email domains
4. Monitored email subdomains
This means that if an email is sent to an SMTP server on the monitored
targets list, the email is monitored. If the SMTP server is not on themonitored targets list, Data Loss Prevention checks the other lists.
17-8

Apex One Data Loss Prevention Policy Settings

For emails sent through other protocols, Data Loss Prevention only checks
the following lists:
1. Non-monitored email domains
2. Monitored email subdomains

System and Application Channels
Data Loss Prevention can monitor the following system and application
channels:• Cloud storage services• Data recorders (CD/DVD)• Peer-to-peer applications• PGP Encryption• Printer• Removable storage• Synchronization software (ActiveSync)• Windows clipboard

Device List Tool
Run the Device List Tool locally on each endpoint to query external devices
connected to the endpoint. The tool scans an endpoint for external devices
and then displays device information in a browser window. You can then use
the information when configuring device settings for Data Loss Prevention
and Device Control.

Running the Device List Tool
Procedure
1.

Locate the Device List Tool.
• On the target endpoint that has the Security Agent installed, go to
C:\Windows\System32\dgagent\listDeviceInfo.exe.
17-9Trend Micro Apex Central™ as a Service Widget and Policy Management Guide• Obtain listDeviceInfo.zip from the Support portal and extract
the package on the target endpoint.
https://success.trendmicro.com/en-US/solution/KA-0008546
2.

On the endpoint, run listDeviceInfo.exe.

3.

View device information in the browser window that displays. Data Loss
Prevention and Device Control use the following information:• Vendor (required)• Model (optional)• Serial ID (optional)

Data Loss Prevention Actions
When Data Loss Prevention detects the transmission of data identifiers, it
checks the DLP policy for the detected data identifiers and performs theaction configured for the policy.
The following table lists the Data Loss Prevention actions.
Table 17-1. Data Loss Prevention Actions
ActionDescription

Actions
Pass

Data Loss Prevention allows and logs the transmission.

Block

Data Loss Prevention blocks and logs the transmission.

Additional Actions
Notify the agent user

Data Loss Prevention displays a notification message toinform the user of the data transmission and whether it was
passed or blocked.

Record data

Regardless of the primary action, Data Loss Prevention
records the sensitive information to <Security Agent
installation folder>\DLPLite\Forensic. Select this17-10

Apex One Data Loss Prevention Policy Settings

ActionDescription
action to evaluate sensitive information that is being flagged
by Data Loss Prevention.
Recorded sensitive information may consume too much harddisk space. Therefore, Trend Micro highly recommends thatyou choose this option only for highly sensitive information.

Encrypt supported channels
using the specified key/
password (only available
if Endpoint Encryption is
installed)
Note
This option is
only available for
Removable storage
and Cloud storage
service channels andwhen selecting the
Pass action.
Important
The File Encryption
feature in Endpoint
Encryption isdeprecated and may
not be available
for new installation
instances.

If Trend Micro Endpoint Encryption is installed alongside
theSecurity Agents, Data Loss Prevention can automaticallyencrypt files before allowing a user to pass them to anotherlocation. If Endpoint Encryption is not installed, Data Loss
Prevention performs the Block action on files.
Choose one of the following encryption keys or a fixed
password:• User key: Also known as a Local Key, this key is uniqueto each user and limits access to the encrypted file to theuser that created the file.
• Shared key: This key refers to the Group Key
or Enterprise Key and the Endpoint Encryption
administrator configures the type using PolicyServer
MMC.
• Fixed password: Users manually provide a fixed
password using an on-screen prompt. Endpoint
Encryption creates a self-extracting package that users
can access on any endpoint after providing thedecryption password.

17-11

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

ActionDescription
Important• The target endpoint must have Endpoint
Encryption installed and the user must log in to
Endpoint Encryption in order to encrypt data.
• Encrypted files located on USB devices are
subject to Data Loss Prevention scanning whenusers attempt to decrypt the files. Decrypting
files containing sensitive data on a USB device
triggers the USB encryption protocol resulting
in the system requiring that the sensitive data
be encrypted (again). To prevent Data Loss
Prevention from attempting to "re-encrypt" thedata, move the encrypted files to a local drive
before attempting to access the data.
• Data Loss Prevention blocks attempts to upload
files to cloud storage when using a web client.
Encrypt the files manually before uploading
using a web client.

User justification
Note
This option is
only available after
selecting the Blockaction.

Data Loss Prevention prompts the user before performing the“Block” action. User can select to override the “Block” action
by providing an explanation as to why the sensitive data issafe to pass. The available justification reasons are:• This is part of an established business process.
• My manager approved the data transfer.
• The data in this file is not confidential.
• Other: Users provide an alternate explanation in the text
field provided.

Data Loss Prevention Exceptions
DLP exceptions apply to the entire policy, including all rules definedwithin the policy. Data Loss Prevention applies the exception settings to all

17-12

Apex One Data Loss Prevention Policy Settingstransmissions before scanning for digital assets. If a transmission matches
one of the exception rules, Data Loss Prevention immediately allows or scans
the transmission depending on the exception type.

Defining Non-monitored and Monitored Targets
Define the non-monitored and monitored targets based on the transmission
scope configured on the Channel tab. For details on how to define nonmonitored and monitored targets for All transmissions, see Transmission
Scope: All Transmissions on page 17-14. For details on how to define nonmonitored and monitored targets for Only transmissions outside the Local
Area Network, see Transmission Scope: Only Transmissions Outside the Local
Area Network on page 17-15.
Follow these guidelines when defining monitored and non-monitored
targets:
1. Define each target by:• IP address• Host name
• FQDN• Network address and subnet mask, such as 10.1.1.1/32
Note
For the subnet mask, Data Loss Prevention only supports a classlessinter-domain routing (CIDR) type port. That means that you can only
type a number like 32 instead of 255.255.255.0.

2. To target specific channels, include the default or company-defined port
numbers for those channels. For example, port 21 is typically for FTP
traffic, port 80 for HTTP, and port 443 for HTTPS. Use a colon to separate
the target from the port numbers.
3. You can also include port ranges. To include all ports, ignore the port
range.
Examples of targets with port numbers and port ranges:
17-13Trend Micro Apex Central™ as a Service Widget and Policy Management Guide• 10.1.1.1:80• host:5-20• host.domain.com:20• 10.1.1.1/32:20
4. Separate targets with commas.

Transmission Scope: All Transmissions
Data Loss Prevention monitors data transmitted outside the host computer.
Note
Trend Micro recommends choosing this scope for external agents.

If you do not want to monitor data transmissions to certain targets outside
the host computer, define the following:• Non-monitored targets: Data Loss Prevention does not monitor datatransmitted to these targets.
Note
Data transmissions to non-monitored targets and to monitored targets
where "Monitor" is the action are similar in that the transmission isallowed. The only difference is that for non-monitored targets, Data Loss
Prevention does not log the transmission, whereas for monitored targets,the transmission is always logged.

• Monitored targets: These are specific targets within the non-monitored
targets that should be monitored. Monitored targets are:
• Optional if you defined non-monitored targets.
• Not configurable if you did not define non-monitored targets.
For example:

17-14

Apex One Data Loss Prevention Policy Settings

The following IP addresses are assigned to your company's Legal
Department:• 10.201.168.1 to 10.201.168.25
You are creating a policy that monitors the transmission of Employment
Certificates to all employees except the Legal Department's full time staff. To
do this, you would select All transmissions as the transmission scope andthen:OptionOption 1

Steps
1. Add 10.201.168.1-10.201.168.25 to the non-monitored targets.
2. Add the IP addresses of the Legal Department's part-time staff
to the monitored targets. Assume that there are 3 IP addresses,
10.201.168.21-10.201.168.23.

Option 2

Add the IP addresses of the Legal Department's full time staff to the nonmonitored targets:• 10.201.168.1-10.201.168.20• 10.201.168.24-10.201.168.25

For guidelines on defining monitored and non-monitored targets, see
Defining Non-monitored and Monitored Targets on page 17-13.

Transmission Scope: Only Transmissions Outside the Local Area
Network
Data Loss Prevention monitors data transmitted to any target outside theLocal Area Network (LAN).
Note
Trend Micro recommends choosing this scope for internal agents.

"Network" refers to the company or local network. This includes the current
network (IP address of the endpoint and netmask) and the following
standard private IP addresses:

17-15

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide• Class A: 10.0.0.0 to 10.255.255.255• Class B: 172.16.0.0 to 172.31.255.255• Class C: 192.168.0.0 to 192.168.255.255
If you select this transmission scope, you can define the following:• Non-monitored targets: Define targets outside the LAN that you
consider safe and therefore should not be monitored.
Note
Data transmissions to non-monitored targets and to monitored targets
where "Monitor" is the action are similar in that the transmission isallowed. The only difference is that for non-monitored targets, Data Loss
Prevention does not log the transmission, whereas for monitored targets,the transmission is always logged.

• Monitored targets: Define targets within the LAN that you want tomonitor.
For guidelines on defining monitored and non-monitored targets, see
Defining Non-monitored and Monitored Targets on page 17-13.

Decompression Rules
Files contained in compressed files can be scanned for digital assets. To
determine the files to scan, Data Loss Prevention subjects a compressed fileto the following rules:• Size of a decompressed file exceeds: __ MB (1-10240 MB)• Compression layers exceed: __ (1-20)• Number of files to scan exceeds: __ (1-2000)

17-16

Chapter 18

Apex One Data Discovery Dashboard
Widgets
This section contains help topics for the Apex One Data Discovery dashboard
widgets supported in Apex Central as a Service.
Topics include:

18-1

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Top Sensitive File Policy Detections Widget
This widget displays information about Data Discovery policy violation
detections and the sensitive files that triggered the rules.
Note
By default, the widget displays data from all the managed products that a user
account has privileges to view.

Use the Range drop-down to select the time period for the data that displays.
• To specify a custom time range or time interval, click the settings icon
( > ) and select Customized for the Range.
Use the Rule drop-down to specify the rule that triggered the detection.
• To specify the number of rules that display, click the settings icon () and select from the Rules to display drop-down.
• To aggregate the remaining data, click the settings icon (select Display the remaining data as "Others".

>

>

) and

You can choose to display the data in a table, bar chart, pie chart, or line
chart by clicking the display icons ().
The default view displays the following information in a table.
Column Name

Description

Rule Name

Displays the rules triggered by sensitive files.

Detections

Displays the number of times the rule is triggered
Click the Detections column name to sort the table by the number ofdetections.
Click the number to view detailed information about the detection(when the detection occurs, the sensitive files detected).

Percentage

18-2

Displays the number of times that the rule is triggered as a percentageof the total number of detections

Apex One Data Discovery Dashboard Widgets

Click a number in the Detections column or click a chart section to view
detailed information.
Data

Description

Received

The time and date Apex Central received the data

Generated

The time and date the detection occurred

Rule

The rule that is triggered

Endpoint

The endpoint that triggered the rule

DomainThe domain that triggered the rule

User

The user that triggered the rule

User Domain

The domain that the user belongs toFile Path

The file path for the sensitive fileFile

The name of the sensitive file

Template

The template that the rule belongs to

ActionThe action taken on the sensitive file

Top Endpoints with Sensitive Files Widget
This widget displays information about endpoints with sensitive files thattriggered Data Discovery policy violation detections.
Note
By default, the widget displays data from all the managed products that a user
account has privileges to view.

Use the Range drop-down to select the time period for the data that displays.
• To specify a custom time range or time interval, click the settings icon
( > ) and select Customized for the Range.
Use the Rule drop-down to specify the rule that triggered the detection.
18-3

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide• To specify the number of templates that display, click the settings icon
( > ) and select from the Endpoints to display drop-down.
• To aggregate the remaining data, click the settings icon (select Display the remaining data as "Others".

>

) and

You can choose to display the data in a table, bar chart, or pie chart byclicking the display icons ().
The default view displays the following information in a table.
Column Name

Description

Endpoints

Displays the endpoint with sensitive files that triggered the rule

Detections

Displays the number of times the rule is triggered
Click the Detections column name to sort the table by the number ofdetections.

Percentage

Displays the number of times that the rule is triggered as a percentageof the total number of detections

Click a number in the Detections column or click a chart section to view
detailed information.
Description

Data

18-4

Received

The time and date Apex Central received the data

Generated

The time and date the detection occurred

Rule

The rule that is triggered

Endpoint

The endpoint that triggered the rule

DomainThe domain that triggered the rule

User

The user that triggered the rule

User Domain

The domain that the user belongs toFile Path

The file path for the sensitive fileApex One Data Discovery Dashboard Widgets

Data

Description

File

The name of the sensitive file

Template

The template that the rule belongs to

ActionThe action taken on the sensitive file

Top Data Discovery Template Matches Widget
This widget displays information about the top Data Discovery template
policy violations over time.
Note
By default, the widget displays data from all the managed products that a user
account has privileges to view.

Use the Range drop-down to select the time period for the data that displays.
• To specify a custom time range or time interval, click the settings icon
( > ) and select Customized for the Range.
Use the Rule drop-down to specify the rule that triggered the detection.
• To specify the number of templates that display, click the settings icon
( > ) and select from the Templates to display drop-down.
• To aggregate the remaining data, click the settings icon (select Display the remaining data as "Others".

>

) and

You can choose to display the data in a table, bar chart, or pie chart by).
clicking the display icons (The default view displays the following information in a table.
Column Name
Templates

Description
Displays the template triggered by sensitive files

18-5

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Column Name
Detections

Description
Displays the number of times that the template is triggered
Click the Detections column name to sort the table by the number ofdetections.

Percentage

Displays the number of times that the template is triggered as apercentage of the total number of detections

Click a number in the Detections column or click a chart section to view
detailed information.
Data

Description

Received

The time and date Apex Central received the data

Generated

The time and date the detection occurred

Rule

The rule that is triggered

Endpoint

The endpoint that triggered the rule

DomainThe domain that triggered the rule

User

The user that triggered the rule

User Domain

The domain that the user belongs toFile Path

The file path for the sensitive fileFile

The name of the sensitive file

Template

The template that the rule belongs to

ActionThe action taken on the sensitive file

Top Sensitive Files Widget
This widget displays information about the top sensitive files that triggered
Data Discovery policy violations over time.

18-6

Apex One Data Discovery Dashboard Widgets

Note
By default, the widget displays data from all the managed products that a user
account has privileges to view.

Use the Range drop-down to select the time period for the data that displays.
• To specify a custom time range or time interval, click the settings icon
( > ) and select Customized for the Range.
Use the Rule drop-down to specify the rule that triggered the detection.
• To specify the number of detections that display, click the settings icon
( > ) and select from the Sensitive files to display drop-down.
• To aggregate the remaining data, click the settings icon (select Display the remaining data as "Others".

>

) and

You can choose to display the data in a table, bar chart, or pie chart byclicking the display icons ().
The default view displays the following information in a table.
Column Name

Description

File

Displays the sensitive files potentially leaked

Detections

Displays the number of times that the sensitive file has beenpotentially leaked
Click the Detections column name to sort the table by the number ofdetections.

Percentage

Displays the number of times that the sensitive file has beenpotentially leaked as a percentage of the total number of detections

Click a number in the Detections column or click a chart section to view
detailed information.
Data
Received

Description
The time and date Apex Central received the data

18-7

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Data

18-8

Description

Generated

The time and date the detection occurred

Rule

The rule that is triggered

Endpoint

The endpoint that triggered the rule

DomainThe domain that triggered the rule

User

The user that triggered the rule

User Domain

The domain that the user belongs toFile Path

The file path for the sensitive fileFile

The name of the sensitive file

Template

The template that the rule belongs to

ActionThe action taken on the sensitive fileChapter 19

Apex One Data Discovery Policy Settings
This section discusses how to configure Apex One Data Discovery policy
settings in Apex Central.
Topics include:

19-1

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Creating Data Discovery Policies
Data Discovery searches databases, endpoints, and document management
systems for the presence of sensitive information. Data Discovery widgets
display data loss prevention compliance with an enterprise's policy. Using
Data Discovery policies and widgets allows administrators to perform
remediation actions on their network.
Note
Performing a full scan of an endpoint drive or directory can cause significant
system slowdown for end users.

Procedure1.

Select Enable Data Discovery.

2.

Click Add.
The Data Discovery Policy Settings screen appears.

3.

Select Enable this rule.

4.

Specify a name for the rule.

5.

Configure the target folder settings:a.

Click the Target Folder tab.
Note
The root folder cannot be a Windows shared folder or removabledevice (USB device or DVD).

b.

19-2

In the File Path section, specify the scan location for files.

Apex One Data Discovery Policy Settings

Note
Data Discovery does not scan autoexec.bat files located in thefollowing directories:• \Documents and Settings\*\Application Data\• \Documents and Settings\*\Local Settings\• \Documents and Settings\*\Cookies\• \Program Files\• \Windows\• \Winnt\• \Users\*\AppData\• \ProgramData\c.

In the File Type Exceptions section, specify scanning exceptions.
• Scan: Specify specific files or file types to scan.
• Do not scan: Specify specific files, file types, or folders that
Data Discovery will not scan.

19-3

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Note• Data Discovery supports the following wildcard characters:• *: Substitute for any and all characters before or after the *• ?: Substitute for a single character or a single double-bytecharacter• Separate multiple entries with pipes ( | ) and use the following
format:• For files: *.<file extension> (for example: *.exe|*.doc)• For folders: Specify a file path (for example: *\Test\*|C:\MyDocs\)

Configure the template settings:
6.

Configure the template settings:a.

Click the Template tab.

b.

Select templates from the Available templates list and then click
Add.
When selecting templates:• Select multiple entries by clicking the template names whichhighlights the name.
• Use the search feature if you have a specific template in mind.
You can type the full or partial name of the template.
Note• Each rule can contain a maximum of 500 templates.
• your preferred template is not found in the Available templates
list, go to Policies > Policy Resources > DLP Templates andcreate a new template.

19-4

Apex One Data Discovery Policy Settings

7.

Configure the action settings:a.

Click the Action tab.

b.

Select Monitor to record detections for analysis.

c.

(Optional) Select Encrypt to encrypt sensitive files using one of thefollowing methods:• User key• Group key• Encryption password: The encryption password is a global
password for all Apex One servers. Click Create encryption
password to configure a password.
Important
The File Encryption feature in Endpoint Encryption is deprecatedand may not be available for new installation instances.

8.

9.

Configure the schedule for the scan:a.

Click the Schedule tab.

b.

Specify the frequency of the scan.

c.

Specify the time that the scan starts.

Click Save to apply settings.

19-5

Part VII
Apex One (Mac) Widgets andPolicies

Chapter 20

Apex One (Mac) Dashboard Widgets
This section contains help topics for the Apex One (Mac) dashboard widgets
supported in Apex Central as a Service.
Topics include:

20-1Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Key Performance Indicators Widget
Use this widget on the Trend Micro Apex Central Dashboard screen todisplay Apex One (Mac) key performance indicators (KPIs) based on selected
criteria.
For information on how to add a widget to the Dashboard screen, see theTrend Micro Apex Central or Control Manager documentation.
Tip
By default, the widget marks events as “Important” (and “Critical” () at 15 occurrences) at 30 occurrences. Optionally, mark events as Important or

Critical by customizing event thresholds.

Configuring Key Performance Indicators
In Trend Micro Apex Central or Control Manager, access the Apex One(Mac) Key Performance Indicators widget on the Dashboard to perform thefollowing indicator-related tasks.
Table 20-1. KPI Widget Indicator Tasks
Task
Add a new indicator

Steps
1. Click Add Indicator. The Add Indicator screen
appears.
2. Select an option from the Name drop-down list andoptionally customize settings.
3. Click Save.

Edit an indicator

1. Click the indicator in the list. The Edit Indicator
screen appears.
2. Customize settings.
3. Click Save.

20-2

Apex One (Mac) Dashboard Widgets

Task
Delete an indicator

Steps
1. Click the indicator in the list. The Edit Indicator
screen appears.
2. Click Delete.
3. Click OK.

Configure event threshold settings

1. On the Add Indicator or Edit Indicator screen,
select Enable alerts at the following thresholds.
2. Type the minimum number of event occurrences foreach event type.
3. Click Save.
Note
The important or critical icon displays in the
Occurrences column if both of the following aretrue:• The number of event occurrences thatmatch this indicator is equal to or morethan the threshold.
• Enable alerts at the following threshold isselected.

Configuring Widget Settings
On the Trend Micro Apex Central or Control Manager Dashboard screen,
select Widget Settings from the menu on the top-right of the widget toperform the following tasks.
Table 20-2. KPI Widget Settings
Task
Edit widget title

Steps
Type the widget title in the text field.

20-3Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Task
Configure daily update time

Steps
From the drop-down list, select the hour to generate thewidget data every day.
Tip
To manually refresh the widget data, click therefresh (20-4) icon.

Chapter 21

Apex One (Mac) Policy Settings
This section discusses how to configure Trend Micro Apex One (Mac) policy
settings in Apex Central.
Topics include:

21-1

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Scan Method Types
Apex One (Mac) Security Agents can use one of two scan methods
when scanning for security risks. The scan methods are smart scan andconventional scan.
• Smart Scan
Security Agents that use smart scan are referred to as “smart scan
agents” in this document. Smart scan agents benefit from local scans
and in-the-cloud queries provided by File Reputation Services.
This is the default scan method type.
• Conventional Scan
Agents that do not use smart scan are called “conventional scan agents”.
A conventional scan agent stores all Apex One (Mac) components on theagent endpoint and scans all files locally.

Scan Methods Compared
The following table provides a comparison between the two scan methods:
Table 21-1. Conventional Scan and Smart Scan Compared
Basis ofComparison
Scanning behavior

Conventional Scan

Smart Scan

The conventional scan agent
performs scanning on thelocal endpoint.

• The smart scan agent performs
scanning on the local endpoint.
• If the Security Agent cannot
determine the risk of the fileduring the scan, the Security
Agent verifies the risk by sendinga scan query to a smart protection
source.
• The Security Agent "caches" thescan query result to improve thescan performance.

21-2

Apex One (Mac) Policy Settings

Basis ofComparison

Conventional Scan

Smart Scan

Components in use
and updated

All components available on
the update source, except
the Mac Heuristic Pattern andSmart Scan Agent Pattern.

All components available on the
update source, except the Virus Pattern
and Spyware Active-monitoring
Pattern.

Typical updatesourceApex One (Mac) server

Apex One (Mac) server

Switching from Smart Scan to Conventional Scan
The following table provides other considerations when switching agents toconventional scan.
Table 21-2. Considerations When Switching to Conventional Scan
Consideration

Details

Number of Security Agentsto switch

Switching a relatively small number of Security Agents at a timeallows efficient use of the Apex One (Mac) server and SmartProtection Server resources. These servers can perform othercritical tasks while Security Agents change their scan methods.

TimingWhen switching back to conventional scan, Security Agents will
likely download the full version of the Virus Pattern and Spywareactive Monitoring Pattern from the Apex One (Mac) server. These
pattern files are only used by conventional scan agents.
Consider switching during off-peak hours to ensure the download
process finishes within a short amount of time. Also consider
switching when no Security Agent is scheduled to update fromthe server.

21-3

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Consideration
Agent tree settings

Details
Scan method is a granular setting that can be set on theroot, domain, or individual agent level. When switching toconventional scan, you can:• Create a new group and assign conventional scan as its scanmethod. Any Security Agent you move to this group willuse conventional scan. When you move the Security Agent,
enable the setting Apply settings of new group to selectedagent(s).
• Select a group and configure it to use conventional scan.
Smart scan agents belonging to the group will switch toconventional scan.
• Select one or several smart scan agents from a group andthen switch them to conventional scan.
Note
Any changes to the group's scan method overrides thescan method you have configured for individual Security
Agents.

Switching from Conventional Scan to Smart Scan
If you are switching Security Agents from conventional scan to smart scan,
ensure that you have set up Smart Protection Services on the Apex One
server. For details, see the Apex One documentation.
The following table provides other considerations when switching Security
Agent to smart scan.

21-4

Apex One (Mac) Policy Settings

Table 21-3. Considerations When Switching to Smart Scan
Consideration
Product license

Details
To use smart scan, ensure that you have activated the licenses forthe following services on the Apex One server and that the licenses
are not expired:• Antivirus• Web Reputation and Anti-spyware

Apex One (Mac) server

Ensure that Security Agents can connect to the Apex One (Mac)server. Only online Security Agents will be notified to switch tosmart scan. Offline Security Agents get notified when they become
online. Roaming Security Agents are notified when they become
online or, if the Security Agent has scheduled update privileges,
when scheduled update runs.

Number of Security
Agents to switch

Switching a relatively small number of Security Agents at a timeallows efficient use of Apex One (Mac) server resources. The Apex
One (Mac) server can perform other critical tasks while Security
Agents change their scan methods.

TimingWhen switching to smart scan for the first time, Security Agentsneed to download the full version of the Mac Heuristic Pattern andSmart Scan Agent Pattern from the Apex One (Mac) server. The
Smart Scan Pattern is only used by smart scan agents.
Consider switching during off-peak hours to ensure the download
process finishes within a short amount of time. Also consider
switching when no Security Agent is scheduled to update from theserver.

21-5

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Consideration
Agent tree settings

Details
Scan method is a granular setting that can be set on the root,group, or individual agent level. When switching to smart scan,
you can:• Create a new group and assign smart scan as its scan method.
Any Security Agent you move to this group will use smart
scan. When you move the Security Agent, enable the setting
Apply settings of new group to selected agent(s).
• Select a group and configure it to use smart scan.
Conventional scan agents belonging to the group will switch
to smart scan.
• Select one or several conventional scan agents from a groupand then switch them to smart scan.
Note
Any changes to the group's scan method overrides thescan method you have configured for individual Security
Agents.

IPv6 support

Smart scan agents send scan queries to smart protection sources.
A pure IPv6 smart scan agent cannot send queries directly to pure
IPv4 sources, such as:• Smart Protection Server 3.0 (integrated or standalone)• Trend Micro Smart Protection Network
Similarly, a pure IPv4 smart scan agent cannot send queries topure IPv6 Smart Protection Servers.
A dual-stack proxy server that can convert IP addresses, such as
DeleGate, is required to allow smart scan agents to connect to thesources.

Scan Types
Apex One (Mac) provides the following scan types to protect endpoints fromsecurity risks:

21-6

Apex One (Mac) Policy Settings

Scan Type
Real-time Scan

Description
Automatically scans a file on the endpoint as it is received, opened,
downloaded, copied, or modified
See Real-time Scan on page 21-7.

Manual Scan

A user-initiated scan that scans a file or a set of files requested by the user
See Manual Scan on page 21-12.

Scheduled Scan

Automatically scans files on the endpoint based on the scheduleconfigured by the administrator
See Scheduled Scan on page 21-17.

Scan Now

An administrator-initiated scan that scans files on one or several target
endpoints

Real-time Scan
Real-time Scan is a persistent and ongoing scan. Each time a file is received,
opened, downloaded, copied, or modified, Real-time Scan scans the file forsecurity risks. If Apex One (Mac) does not detect a security risk, the fileremains in its location and users can proceed to access the file. If Apex One(Mac) detects a security risk, it displays a notification message, showing thename of the infected file and the specific security risk.
Configure and apply Real-time Scan settings to one or several agents andgroups, or to all Security Agents that the server manages.

Configuring Real-time Scan Settings
Procedure1.

Select the check box to enable Real-time Scan.

2.

Click the Target tab to configure file activities and scan settings.
For more information, see Real-time Scan: Target Tab on page 21-8.

3.

Click the Action tab to configure the scan actions Apex One (Mac)performs on detected security threats.
21-7

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

For more information, see Real-time Scan: Action Tab on page 21-8.

Real-time Scan: Target Tab
Procedure
1.

Under User Activity on Files, choose activities on files that will trigger
Real-time Scan. Select from the following options:• Scan files being created/modified: Scan new files introduced into
the endpoint (for example, after downloading a file) or files being
modified• Scan files being retrieved/executed: Scan files as they are opened• Scan files being created/modified and retrieved/executed• Scan files being created/modified/executed
For example, if the third option is selected, a new file downloaded to theendpoint will be scanned and stays in its current location if no security
risk is detected. The same file will be scanned when a user opens the fileand, if the user modified the file, before the modifications are saved.

2.

Under Scan Settings, select one or more from the following options:• Scan compressed files: Scan individual files within an archive fileFor more information, see Supported Compressed File Types on page21-9.
• Scan network drive: Scan directories physically located on otherendpoints, but mapped to the local endpoint

Real-time Scan: Action Tab
On the Actions tab, configure the scan actions Apex One (Mac) performs on
detected security threats.

21-8

Apex One (Mac) Policy Settings

Procedure
1.

Under Action, specify the scan actions.
OptionUse ActiveAction

Description
ActiveAction is a set of pre-configured scan actions
for different types of security risks. If you are unsure
which scan action is suitable for a certain typeof security risk, Trend Micro recommends using
ActiveAction.
ActiveAction settings are constantly updated in thepattern files to protect endpoints against the latest
security risks and the latest methods of attacks.

Use the same action for all
security risk types

Select this option if you want the sameaction performed on all types of security risks,
except probable virus/malware. For Probable Virus/
Malware, the action is always "Pass".
If you choose "Clean" as the first action, selecta second action that Apex One (Mac) performs if
cleaning is unsuccessful. If the first action is not"Clean", no second action is configurable.
For details about scan actions, see Scan Actions on
page 21-10.

2.

Select Display a notification message on the agent endpoint whenvirus/malware is detected to display a notification message when Apex
One (Mac) detects a security risk during Real-time Scan.

Supported Compressed File Types
Apex One (Mac) supports the following compression types.
Type

Extension.zip

Archive created by Pkzip.rar

Archive created by RAR

21-9

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Extension

Type

.tar

Archive created by Tar.arj

ARJ Compressed archive.hqx

BINHEX.gz; .gzip

Gnu ZIP.Z

LZW/Compressed 16bits.bin

MacBinary.cab

Microsoft Cabinet file

Microsoft Compressed/MSCOMP.eml; .mht

MIME

.td0

Teledisk format.bz2

Unix BZ2 Bzip compressed file.uu

UUEncode.ace

WinAceScan Actions
Specify the action Apex One (Mac) performs when a particular scan typedetects a security risk.
The action Apex One (Mac) performs depends on the scan type that detected
the security risk. For example, when Apex One (Mac) detects a security risk
during Manual Scan (scan type), it cleans (action) the infected file.
The following are the actions Apex One (Mac) can perform against security
risks:
Scan Action
Delete21-10

Details
Apex One (Mac) removes the infected file from the endpoint.

Apex One (Mac) Policy Settings

Scan Action
Quarantine

Details
Apex One (Mac) renames and then moves the infected file to the quarantine
directory on the endpoint located in <Agent installation folder>/common/lib/vsapi/quarantine.
Once in the quarantine directory, Apex One (Mac) can perform anotheraction on the quarantined file, depending on the action specified by theuser. Apex One (Mac) can delete, clean, or restore the file. Restoring afile means moving it back to its original location without performing any
action. Users may restore the file if it is actually harmless. Cleaning afile means removing the security risk from the quarantined file and thenmoving it to its original location if cleaning is successful.

CleanApex One (Mac) removes the security risk from an infected file before
allowing users to access it.
If the file is uncleanable, Apex One (Mac) performs a second action, which
can be one of the following actions: Quarantine, Delete, and Pass. To
configure the second action, navigate to Agent Management > Settings >{Scan Type} and click the Action tab.

Pass

Apex One (Mac) performs no action on the infected file but records thedetected security risk in the logs. The file stays where it is located.
Apex One (Mac) always performs "Pass" on files infected with the Probable
Virus/Malware type to mitigate a False Positive. If further analysis confirmsthat probable virus/malware is indeed a security risk, a new pattern will be
released to allow Apex One (Mac) to perform the appropriate scan action. If
actually harmless, probable virus/malware will no longer be detected.
For example: Apex One (Mac) detects "x_probable_virus" on a file named"123.pdf" and performs no action at the time of detection. Trend Microthen confirms that "x_probable_virus" is a Trojan horse program andreleases a new Virus Pattern version. After loading the new pattern, Apex
One (Mac) will detect "x_probable_virus" as a Trojan program and, if theaction against such programs is "Delete", will delete "123.pdf".
NoteThis action is not available for Real-time Scan.

21-11

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Scan Action
Deny access

Details
When Apex One (Mac) detects an attempt to open or execute an infected
file, it immediately blocks the operation.
Users can manually delete the infected file.

Manual Scan
Manual Scan is an on-demand scan and starts immediately after a user
runs the scan on the agent console. The time it takes to complete scanningdepends on the number of files to scan and the endpoint's hardware
resources.
Configure and apply Manual Scan settings to one or several Security Agentsand groups, or to all Security Agents that the server manages.

Configuring Manual Scan Settings
Procedure
1.

Click the Target tab to configure the general scan and CPU usage
settings.
For more information, see Manual Scan: Target Tab on page 21-12.

2.

Click the Action tab to configure the scan actions Apex One (Mac)performs on detected security threats.
For more information, see Manual Scan: Action Tab on page 21-14.

Manual Scan: Target Tab
Procedure1.

In the Files to Scan section, select from the following:• All scannable files: Includes all scannable files. Unscannable files
are password protected files, encrypted files, or files that exceed theuser-defined scanning restrictions.

21-12

Apex One (Mac) Policy Settings

Note
Scanning every file requires a lot of time and resources and might
be redundant in some situations. Therefore, you might want to limit
the amount of files the Security Agent includes in the scan.

• Scan only Mach-O files: Only scan Mach-O files on endpoints. Apex
One (Mac) Security Agents do not scan other file types for malware.
Note
If you select this option, you must enable the smart scan feature toensure protection against the latest malware attacks targeting OS X
and macOS platforms.

2.

Under Scan Settings, select one or more from the following options:• Scan compressed files: Scan individual files within an archive fileFor more information, see Supported Compressed File Types on page21-9.
• Scan network drive: Scan directories physically located on otherendpoints, but mapped to the local endpoint• Scan Time Machine: Only scan files on Time Machine drives
Note
After enabling the Scan Time Machine option for Manual and
Scheduled Scan, Apex One (Mac) can only detect malware threats
but not take any action (clean, quarantine, or delete) due to apermission limitation in Mac OS. Configured scan actions display
as unsuccessful in the product logs.

3.

In the CPU Usage section, configure the required settings.
• High: No pausing between scans

21-13

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide• Low: Pause between file scans if CPU consumption is higher than
20%, and do not pause if 20% or lower

Manual Scan: Action Tab
On the Actions tab, configure the scan actions Apex One (Mac) performs on
detected security threats.
OptionUse ActiveAction

Description
ActiveAction is a set of pre-configured scan actions fordifferent types of security risks. If you are unsure whichscan action is suitable for a certain type of security risk,
Trend Micro recommends using ActiveAction.
ActiveAction settings are constantly updated in thepattern files to protect endpoints against the latest
security risks and the latest methods of attacks.

Use the same action for all
security risk types

Select this option if you want the same action
performed on all types of security risks, except
probable virus/malware. For Probable Virus/Malware,
the action is always "Pass".
If you choose "Clean" as the first action, select a second
action that Apex One (Mac) performs if cleaning is
unsuccessful. If the first action is not "Clean", no second
action is configurable.
For details about scan actions, see Scan Actions on page
21-10.

Supported Compressed File Types
Apex One (Mac) supports the following compression types.
Type

Extension.zip

Archive created by Pkzip.rar

Archive created by RAR.tar

Archive created by Tar

21-14

Apex One (Mac) Policy Settings

Extension

Type

.arj

ARJ Compressed archive.hqx

BINHEX.gz; .gzip

Gnu ZIP.Z

LZW/Compressed 16bits.bin

MacBinary.cab

Microsoft Cabinet file

Microsoft Compressed/MSCOMP.eml; .mht

MIME

.td0

Teledisk format.bz2

Unix BZ2 Bzip compressed file.uu

UUEncode.ace

WinAceScan Actions
Specify the action Apex One (Mac) performs when a particular scan typedetects a security risk.
The action Apex One (Mac) performs depends on the scan type that detected
the security risk. For example, when Apex One (Mac) detects a security risk
during Manual Scan (scan type), it cleans (action) the infected file.
The following are the actions Apex One (Mac) can perform against security
risks:
Scan Action
DeleteDetails
Apex One (Mac) removes the infected file from the endpoint.

21-15

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Scan Action
Quarantine

Details
Apex One (Mac) renames and then moves the infected file to the quarantine
directory on the endpoint located in <Agent installation folder>/common/lib/vsapi/quarantine.
Once in the quarantine directory, Apex One (Mac) can perform anotheraction on the quarantined file, depending on the action specified by theuser. Apex One (Mac) can delete, clean, or restore the file. Restoring afile means moving it back to its original location without performing any
action. Users may restore the file if it is actually harmless. Cleaning afile means removing the security risk from the quarantined file and thenmoving it to its original location if cleaning is successful.

CleanApex One (Mac) removes the security risk from an infected file before
allowing users to access it.
If the file is uncleanable, Apex One (Mac) performs a second action, which
can be one of the following actions: Quarantine, Delete, and Pass. To
configure the second action, navigate to Agent Management > Settings >{Scan Type} and click the Action tab.

Pass

Apex One (Mac) performs no action on the infected file but records thedetected security risk in the logs. The file stays where it is located.
Apex One (Mac) always performs "Pass" on files infected with the Probable
Virus/Malware type to mitigate a False Positive. If further analysis confirmsthat probable virus/malware is indeed a security risk, a new pattern will be
released to allow Apex One (Mac) to perform the appropriate scan action. If
actually harmless, probable virus/malware will no longer be detected.
For example: Apex One (Mac) detects "x_probable_virus" on a file named"123.pdf" and performs no action at the time of detection. Trend Microthen confirms that "x_probable_virus" is a Trojan horse program andreleases a new Virus Pattern version. After loading the new pattern, Apex
One (Mac) will detect "x_probable_virus" as a Trojan program and, if theaction against such programs is "Delete", will delete "123.pdf".
NoteThis action is not available for Real-time Scan.

21-16

Apex One (Mac) Policy Settings

Scan Action
Deny access

Details
When Apex One (Mac) detects an attempt to open or execute an infected
file, it immediately blocks the operation.
Users can manually delete the infected file.

Scheduled Scan
Scheduled Scan runs automatically on the appointed date and time. Use
Scheduled Scan to automate routine scans on the Security Agent andimprove scan management efficiency.
Configure and apply Scheduled Scan settings to one or several Security
Agents and groups, or to all Security Agents that the server manages.

Configuring Scheduled Scan Settings
Procedure1.

Select the check box to enable Scheduled Scan.

2.

Click the Target tab to configure the general scan and CPU usage
settings, and the scan schedule.
For more information, see Scheduled Scan: Target Tab on page 21-17.

3.

Click the Action tab to configure the scan actions Apex One (Mac)performs on detected security threats.
For more information, see Scheduled Scan: Action Tab on page 21-19.

Scheduled Scan: Target Tab
Procedure
1.

Under Schedule, configure how often (daily, weekly, or monthly) andwhat time Scheduled Scan will run.
21-17

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

For monthly Scheduled Scans, if you selected the 29th, 30th, or 31st day
and a month does not have this day, Apex One (Mac) runs Scheduled
Scan on the last day of the month.
2.

In the Files to Scan section, select from the following:• All scannable files: Includes all scannable files. Unscannable files
are password protected files, encrypted files, or files that exceed theuser-defined scanning restrictions.
Note
Scanning every file requires a lot of time and resources and might
be redundant in some situations. Therefore, you might want to limit
the amount of files the Security Agent includes in the scan.

• File types scanned by IntelliScan: Only scan files known topotentially harbor malicious code, including files disguised by aharmless extension name.
• Specify path or full path : Manually specify the files or directories
to scan. For example, /Shared/Files/mytext.txt or /Shared/
Files.
3.

Under Scan Settings, select one or more from the following options:• Scan compressed files: Scan individual files within an archive fileFor more information, see Supported Compressed File Types on page21-9.
• Scan Time Machine: Only scan files on Time Machine drives
Note
After enabling the Scan Time Machine option for Manual and
Scheduled Scan, Apex One (Mac) can only detect malware threats
but not take any action (clean, quarantine, or delete) due to apermission limitation in Mac OS. Configured scan actions display
as unsuccessful in the product logs.

21-18

Apex One (Mac) Policy Settings

4.

In the CPU Usage section, configure the required settings.
• High: No pausing between scans• Low: Pause between file scans if CPU consumption is higher than
20%, and do not pause if 20% or lower

Scheduled Scan: Action Tab
On the Actions tab, configure the scan actions Apex One (Mac) performs on
detected security threats.
Procedure
1.

Under Action, specify the scan actions.
OptionUse ActiveAction

Description
ActiveAction is a set of pre-configured scan actions
for different types of security risks. If you are unsure
which scan action is suitable for a certain typeof security risk, Trend Micro recommends using
ActiveAction.
ActiveAction settings are constantly updated in thepattern files to protect endpoints against the latest
security risks and the latest methods of attacks.

Use the same action for all
security risk types

Select this option if you want the sameaction performed on all types of security risks,
except probable virus/malware. For Probable Virus/
Malware, the action is always "Pass".
If you choose "Clean" as the first action, selecta second action that Apex One (Mac) performs if
cleaning is unsuccessful. If the first action is not"Clean", no second action is configurable.
For details about scan actions, see Scan Actions on
page 21-10.

2.

Under Scheduled Scan Privileges, specify whether users can postpone
or skip a scheduled scan.
21-19

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Privilege
Postpone Scheduled
Scan

Description
Users with the "Postpone Scheduled Scan" privilege canperform the following actions:• Postpone Scheduled Scan before it runs and thenspecify the postpone duration. Scheduled Scan can only
be postponed once.
• If Scheduled Scan is in progress, users can stop scanningand restart it later. Users then specify the amountof time that should elapse before scanning restarts.
When scanning restarts, all previously scanned files arescanned again. Scheduled Scan can be stopped and thenrestarted only once.
Configure the number of hours and minutes, whichcorresponds to:• The maximum postpone duration• The maximum amount of time that should elapse before
scanning restarts

Skip and Stop Scheduled
ScanThis privilege allows users to perform the following actions:• Skip Scheduled Scan before it runs
• Stop Scheduled Scan when it is in progress

3.

Under Scheduled Scan Settings, specify the notification and battery
power settings.
Setting

Description

Display a notification
before Scheduled Scan
runs

When you enable this option, a notification message displayson the endpoint several minutes before Scheduled Scan runs.
Users are notified of the scan schedule (date and time)
and their Scheduled Scan privileges, such as postponing,skipping, or stopping Scheduled Scan.
Configure the timing for displaying the notification message,
in number of minutes.

21-20

Apex One (Mac) Policy Settings

Setting

Description

Automatically stop
Scheduled Scan when
scanning lasts more than__ hours and __ minutes

The Security Agent stops scanning when the specified
amount of time is exceeded and scanning is not yet complete.
The Security Agent immediately notifies users of any security
risk detected during scanning.

Skip Scheduled Scan
When a WirelessEndpoint's Battery Life isLess Than __ % and its
AC Adapter is Unplugged

Apex One (Mac) skips a Scheduled Scan if it detects thata wireless endpoint's battery life is running low and its AC
adapter is not connected to any power source. If battery life
is low but the AC adapter is connected to a power source,scanning proceeds. If a scan is in progress when the battery
life is low, the scan is not terminated.

Supported Compressed File Types
Apex One (Mac) supports the following compression types.
Extension

Type

.zip

Archive created by Pkzip.rar

Archive created by RAR.tar

Archive created by Tar.arj

ARJ Compressed archive.hqx

BINHEX.gz; .gzip

Gnu ZIP.Z

LZW/Compressed 16bits.bin

MacBinary.cab

Microsoft Cabinet file

Microsoft Compressed/MSCOMP.eml; .mht

MIME

.td0

Teledisk format

21-21

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Extension

Type

.bz2

Unix BZ2 Bzip compressed file.uu

UUEncode.ace

WinAceScan Actions
Specify the action Apex One (Mac) performs when a particular scan typedetects a security risk.
The action Apex One (Mac) performs depends on the scan type that detected
the security risk. For example, when Apex One (Mac) detects a security risk
during Manual Scan (scan type), it cleans (action) the infected file.
The following are the actions Apex One (Mac) can perform against security
risks:
Scan Action

Details

DeleteApex One (Mac) removes the infected file from the endpoint.

Quarantine

Apex One (Mac) renames and then moves the infected file to the quarantine
directory on the endpoint located in <Agent installation folder>/common/lib/vsapi/quarantine.
Once in the quarantine directory, Apex One (Mac) can perform anotheraction on the quarantined file, depending on the action specified by theuser. Apex One (Mac) can delete, clean, or restore the file. Restoring afile means moving it back to its original location without performing any
action. Users may restore the file if it is actually harmless. Cleaning afile means removing the security risk from the quarantined file and thenmoving it to its original location if cleaning is successful.

CleanApex One (Mac) removes the security risk from an infected file before
allowing users to access it.
If the file is uncleanable, Apex One (Mac) performs a second action, which
can be one of the following actions: Quarantine, Delete, and Pass. To
configure the second action, navigate to Agent Management > Settings >{Scan Type} and click the Action tab.

21-22

Apex One (Mac) Policy Settings

Scan Action
Pass

Details
Apex One (Mac) performs no action on the infected file but records thedetected security risk in the logs. The file stays where it is located.
Apex One (Mac) always performs "Pass" on files infected with the Probable
Virus/Malware type to mitigate a False Positive. If further analysis confirmsthat probable virus/malware is indeed a security risk, a new pattern will be
released to allow Apex One (Mac) to perform the appropriate scan action. If
actually harmless, probable virus/malware will no longer be detected.
For example: Apex One (Mac) detects "x_probable_virus" on a file named"123.pdf" and performs no action at the time of detection. Trend Microthen confirms that "x_probable_virus" is a Trojan horse program andreleases a new Virus Pattern version. After loading the new pattern, Apex
One (Mac) will detect "x_probable_virus" as a Trojan program and, if theaction against such programs is "Delete", will delete "123.pdf".
NoteThis action is not available for Real-time Scan.

Deny access

When Apex One (Mac) detects an attempt to open or execute an infected
file, it immediately blocks the operation.
Users can manually delete the infected file.

Cache Settings for Scans
Each time scanning runs, the agent checks the modified files cache to see if afile has been modified since the last agent startup.
• If a file has been modified, the agent scans the file and adds it to thescanned files cache.
• If a file has not been modified, the agent checks if the file is in thescanned files cache.
• If the file is in the scanned files cache, the agent skips scanning thefile.
• If the file is not in the scanned files cache, the agent checks theapproved files cache.

21-23

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Note
The approved files cache contains files that Apex One (Mac) deems
trustworthy. Trustworthy files have been scanned by successive
versions of the pattern and declared threat-free each time, or threatfree files that have remained unmodified for an extended period oftime.

• If the file is in the approved files cache, the agent skips
scanning the file.
• If the file is not in the approved files cache, the agent scans thefile and adds it to the scanned files cache.
All or some of the caches are cleared whenever the scan engine or pattern isupdated.
If scans are run frequently and many files hit the caches, the scanning time
reduces significantly.
If scans are seldom run, disable the caches so that files can be checked forthreats with each scan.

Scan Exclusions
Configure scan exclusions to increase the scanning performance and skip
scanning files that are known to be harmless. When a particular scan typeruns, Apex One (Mac) checks the scan exclusion list to determine which files
on the endpoint will be excluded from scanning.
Scan Exclusion
List
Files

Details
Apex One (Mac) will not scan a file if:• The file is located under the directory path specified in the scan
exclusion list
• The file matches the full file path (directory path and file name)specified in the scan exclusion list

21-24

Apex One (Mac) Policy Settings

Scan Exclusion
List
File extensions

Details
Apex One (Mac) will not scan a file if its file extension matches any ofthe extensions included in this exclusion list.

Configuring Scan Exclusion Lists
For details about Scan Exclusion Lists, see Scan Exclusions on page 21-24.
Procedure1.

Select the check box to enable scan exclusion.

2.

To configure the Scan Exclusion List (Files):a.

Type a full file path or directory path and click Add.
Reminders:• It is not possible to type only a file name.
• You can specify a maximum of 64 paths. See the following tablefor examples.
Path

Details

Full file pathExcludes a
specific file on theendpoint

Examples• Example 1:/file.log• Example 2:/System/file.log

21-25

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Path

Details

Directory pathExcludes all files
located on a
specific folder andall its subfolders

Examples• Example 1:/System/

Examples of files excluded fromscans:• /System/file.log• /System/Library/file.log

Examples of files that will bescanned:• /Applications/file.log• Example 2:/System/Library

Examples of files excluded fromscans:• /System/Library/file.log• /System/Library/
Filters/file.log

Examples of files that will bescanned:• /System/file.log• Use the asterisk wildcard (*) in place of folder names.
See the following table for examples.

21-26

Apex One (Mac) Policy Settings

Path
Full file path

Wildcard Usage Examples/Users/Mac/*/file.log

Examples of files excluded from scans:• /Users/Mac/Desktop/file.log• /Users/Mac/Movies/file.log
Examples of files that will be scanned:• /Users/file.log• /Users/Mac/file.log
Directory path

• Example 1:/Users/Mac/*

Examples of files excluded from scans:• /Users/Mac/doc.html• /Users/Mac/Documents/doc.html• /Users/Mac/Documents/Pics/pic.jpg
Examples of files that will be scanned:• /Users/doc.html• Example 2:/*/Components

Examples of files excluded from scans:• /Users/Components/file.log• /System/Components/file.log
Examples of files that will be scanned:• /file.log• /Users/file.log• /System/Files/file.log• Partial matching of folder names is not supported. For
example, it is not possible to type /Users/*user/temp to

21-27

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

exclude files on folder names ending in “user”, such as“end_user” or “new_user”.
b.
3.

To delete a path, select it and click Remove.

To configure the Scan Exclusion List (File Extensions):a.

Type a file extension without a period (.) and click Add. For
example, type pdf. You can specify a maximum of 64 fileextensions.

b.

To delete a file extension, select it and click Remove.

Update Settings
To ensure that Security Agents stay protected from the latest security
risks, update agent components regularly. Also update Security Agentswith severely out-of-date components and whenever there is an outbreak.
Components become severely out-of-date when the Security Agent is unable
to update from the Apex One (Mac) server or the ActiveUpdate server for an
extended period of time.
Agent Update Methods
There are several ways to update Security Agents.
Description

Update Method
Administrator-initiatedmanual update

Initiate an update from the following web console screens:• Agent Management screen.
• Summary screen.

21-28

Apex One (Mac) Policy Settings

Update Method
Automatic update

Description• After the server finishes an update, it immediately notifies
Security Agents to update.
• Updates can run according to the schedule that you
configured. You can configure a schedule that applies to one
or several Security Agents and domains, or to all the Security
Agents that the server manages.
For details, see Configuring Agent Update Settings on page
21-30.

User-initiated manual
updateUsers launch the update from their endpoints.

Agent Update Source
By default, Security Agents download components from the Apex One (Mac)server. In addition to components, Security Agents also receive updated
configuration files when updating from the Apex One (Mac) server. Security
Agents need the configuration files to apply new settings. Each time you
modify Apex One (Mac) settings on the web console, the configuration files
change.
Before updating the Security Agents, check if the Apex One (Mac) server has
the latest components.
Configure one, several, or all Security Agents to download from the Trend
Micro ActiveUpdate server if the Apex One (Mac) server is unavailable.
For details, see Configuring Agent Update Settings on page 21-30.
Note
If an agent only has an IPv6 address, read the IPv6 limitations for agent
updates in Pure IPv6 Agent Limitations on page 21-30.

Agent Update Notes and Reminders• Security Agents can use proxy settings during an update. Proxy settings
are configured on the agent console.
21-29

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide• During an update, the Security Agent icon on the menu bar of theendpoint indicates that the product is updating. If an upgrade to the
Security Agent program is available, Security Agents update and thenupgrade to the latest program version or build. Users cannot run any
task from the console until the update is complete.
• Access the Summary screen to check if all Security Agents have been
updated.

Pure IPv6 Agent Limitations
The following table lists the limitations when Security Agents only have an
IPv6 address.
Table 21-4. Pure IPv6 Agent Limitations
Limitation

Item
Parent serverPure IPv6 agents cannot be managed by a pure IPv4 server.

UpdatesA pure IPv6 agent cannot update from pure IPv4 update sources,
such as:• Trend Micro ActiveUpdate Server• A pure IPv4 Apex One (Mac) server

Web Reputation queries

A pure IPv6 agent cannot send Web Reputation queries to Trend
Micro Smart Protection Network.

Proxy connection

A pure IPv6 agent cannot connect through a pure IPv4 proxy
server.

Agent deployment

Apple Remote Desktop is unable to deploy the agent to pure IPv6
endpoints because these endpoints always appear as offline.

Most of these limitations can be overcome by setting up a dual-stack proxy
server that can convert between IPv4 and IPv6 addresses (such as DeleGate).
Position the proxy server between the agents and the entities to which they
connect.

Configuring Agent Update Settings
For a detailed explanation of agent updates, see Update Settings on page 21-28.
21-30

Apex One (Mac) Policy Settings

Procedure1.

Select Agents download updates from the Trend Micro ActiveUpdate
server when unable to connect to the Apex One (Mac) server to allow
agents to download updates from the Trend Micro ActiveUpdate server.
Note
If a Security Agent only has an IPv6 address, read the IPv6 limitations foragent updates in Pure IPv6 Agent Limitations on page 21-30.

2.

Select Agents can update the components but not upgrade the agent
program or install hot fixes to allow component updates to proceed but
prevents agent upgrade.

3.

To set up scheduled updates, complete the following steps:a.

Select Enable scheduled update.

b.

Configure the schedule.

c.

If you select Daily or Weekly, specify the time of the update and thetime period the Apex One (Mac) server will notify Security Agentsto update components. For example, if the start time is 12pm andthe time period is 2 hours, the server randomly notifies all online
Security Agents to update components from 12pm until 2pm. Thissetting prevents all online Security Agents from simultaneously
connecting to the server at the specified start time, significantly
reducing the amount of traffic directed to the server.

Web Reputation
Web reputation technology tracks the credibility of web domains byassigning a reputation score based on factors such as a website'sage, historical location changes, and indications of suspicious activities
discovered through malware behavior analysis. It will then continue to scansites and block users from accessing infected ones.
Security Agents send queries to smart protection sources to determine
the reputation of websites that users are attempting to access. A website’s
21-31

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

reputation is correlated with the specific web reputation policy enforced on
the endpoint. Depending on the policy in use, the Security Agents will either
block or allow access to the website.
Note
This feature supports the latest Safari™, Mozilla™ Firefox™, and Google
Chrome™ browsers.

Configuring Web Reputation Settings
Web Reputation settings include policies that dictate whether Apex One(Mac) will block or allow access to a website. To determine the appropriate
policy to use, Apex One (Mac) checks the location of the Security Agent. The
location of a Security Agent is "internal" if the Security Agent can connect to
the Apex One (Mac) server. Otherwise, the location for the Security Agent is"external".
Procedure1.

To configure a policy for external Security Agents:a.

Click the External Agents tab.

b.

Select Enable Web Reputation policy.
When the policy is enabled, external Security Agents send web
reputation queries to the Smart Protection Network.
Note
If an agent only has an IPv6 address, read the IPv6 limitations for
Web Reputation queries in Pure IPv6 Agent Limitations on page 21-30.

c.

21-32

Select from the available web reputation security levels: High,
Medium or Low

Apex One (Mac) Policy Settings

Note
The security levels determine whether Apex One (Mac) will allow or
block access to a URL. For example, if you set the security level toLow, Apex One (Mac) only blocks URLs that are known to be web
threats. As you set the security level higher, the web threat detection
rate improves but the possibility of false positives also increases.

d.

2.

To submit web reputation feedback, click the URL provided. The
Trend Micro Web Reputation Query system opens in a browser
window.

To configure a policy for internal Security Agents:a.

Click the Internal Agents tab.

b.

Select Enable Web Reputation policy.
When the policy is enabled, internal Security Agents send web
reputation queries to:• Smart Protection Servers if the Send queries to SmartProtection Servers option is enabled.
• Smart Protection Network if the Send queries to SmartProtection Servers option is disabled.
Note
If an agent only has an IPv6 address, read the IPv6 limitations for
Web Reputation queries in Pure IPv6 Agent Limitations on page 21-30.

c.

Select Send queries to Smart Protection Servers if you wantinternal Security Agents to send web reputation queries to SmartProtection Servers.
• If you enable this option, Security Agents refer to the same
smart protection source list used by Apex One Security Agentsto determine the Smart Protection Servers to which they send
queries.

21-33

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide• If you disable this option, Security Agents send web reputation
queries to Smart Protection Network. Endpoints must haveInternet connection to send queries successfully.
d.

Select from the available web reputation security levels: High,
Medium or Low
Note
The security levels determine whether Apex One (Mac) will allow or
block access to a URL. For example, if you set the security level toLow, Apex One (Mac) only blocks URLs that are known to be web
threats. As you set the security level higher, the web threat detection
rate improves but the possibility of false positives also increases.
Security Agents do not block untested websites, regardless of the
security level.

e.

To submit web reputation feedback, click the URL provided. The
Trend Micro Web Reputation Query system opens in a browser
window.

f.

Select whether to allow the Security Agents to send web reputation
logs to the server. Allow Security Agents to send logs if you wantto analyze URLs being blocked by Apex One (Mac) and take theappropriate action on URLs you think are safe to access.

Configuring the Approved and Blocked URL Lists
Add websites that you consider safe or dangerous to the approved or blocked
list. When Apex One (Mac) detects access to any of these websites, it
automatically allows or blocks the access and no longer sends a query tosmart protection sources.
Procedure
1.

Access the Apex One (Mac) web console.

2.

Navigate to Agents > Global Agent Settings > Web Reputation
Approved/Blocked URL List.

21-34

Apex One (Mac) Policy Settings

3.

Specify a URL in the text box. You can add a wildcard character (*)
anywhere on the URL.
Examples:• www.trendmicro.com/* means all pages on the
www.trendmicro.com domain.
• *.trendmicro.com/* means all pages on any sub-domain oftrendmicro.com.
You can type URLs containing IP addresses. If a URL contains an IPv6
address, enclose the address in square brackets.

4.

Click Add to Approved List or Add to Blocked List.

5.

To delete an entry, select an option from the View drop-down list andclick the icon next to a URL.

6.

Click Deploy.

Device Control
Device Control regulates access to external storage devices and network
resources connected to endpoints. Device Control helps prevent data loss
and leakage and, combined with file scanning, helps guard against security
risks.
You can configure Device Control policies for internal and external agents.
Administrators typically configure a stricter policy for external agents.
Policies are granular settings in the agent tree. You can enforce specificpolicies to agent groups or individual Security Agents. You can also enforce asingle policy to all Security Agents.

Configuring Device Control Settings
Procedure
1.

Click the External Agents tab to configure settings for external agents or
the Internal Agents tab to configure settings for internal agents.
21-35

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

2.

Select Enable Device Control.

3.

Under Devices, select a permission for each storage device.
For details about permissions, see Permissions for Storage Devices on page
21-36.

4.

(Optional) If the permission for USB storage devices is Block, you
can configure a list of approved devices under USB Storage Device
Approved List. Users can access these devices and you can control thelevel of access using permissions.
a.

Type the device vendor.

b.

Type the device model and serial ID.

c.

Select the permission for the device.
For details about permissions, see Permissions for Storage Devices on
page 21-36.
Note
USB storage devices on the approved list must have a higher
permission level than the permission setting for USB storage
devices in the Devices section.

5.

Under Notification, select the Display a notification message on theagent endpoint when a new device is detected option to display anotification when a new storage device is connected to the endpoint.
The notification indicates the access permission for the new storage
device.

6.

Click Deploy.

Permissions for Storage Devices
Device Control permissions for storage devices are used when you:
• Allow access to USB storage devices, CD/DVD, SD cards, network drives,and Thunderbolt SATA storage devices. You can grant full access to thesedevices or limit the level of access.
21-36

Apex One (Mac) Policy Settings• Configure the list of approved USB storage devices. Device Control
allows you to block access to all USB storage devices, except those thathave been added to the list of approved devices. You can grant fullaccess to the approved devices or limit the level of access.
The following table lists the permissions for storage devices.
Table 21-5. Device Control Permissions for Storage Devices
Permissions
Full access

Files on the Device

Incoming Files

Permitted operations: Copy, Move,
Open, Save, Delete, Execute

Permitted operations: Save, Move,
Copy
This means that a file can be saved,
moved, and copied to the device.

Read only

Permitted operations: Copy, Open
Prohibited operations: Save,
Move, Delete, Execute

Block

Prohibited operations: All
operations

Prohibited operations: Save, Move,
Copy

Prohibited operations: Save, Move,
Copy

The device and the files it contains
are not visible to the user (forexample, from Finder).

Note
The read-only permission is not available for network drives.

Endpoint Sensor
Endpoint Sensor is a powerful monitoring and investigation tool used to
identify the presence, location, and entry point of threats. Through the useof detailed system event recording and historical analysis, you can perform
Historical Investigations to discover hidden threats throughout your networkand locate all affected endpoints. Generate Root Cause Analysis reports tounderstand the nature and activity of the malware since the threat entered
the endpoint.

21-37

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Configuring Endpoint Sensor Settings
Important
The Endpoint Sensor feature requires special licensing and additional system
requirements. Ensure that you have the correct license before deploying
Endpoint Sensor policies to endpoints. For more information on how to obtainlicenses, contact your support provider.

Procedure1.

Select Enable Endpoint Sensor.

Trusted Program List
You can configure Security Agents to skip scanning of trusted processes
during Real-time Scan and event recording. After adding a program to theTrusted Program List, the Security Agent does not subject the programor any processes initiated by the program to Real-time Scan and event
recording. Add trusted programs to the Trusted Program List to improve theperformance of scanning on endpoints.
Note
You can add files to the Trusted Program List if the following requirements aremet:• The file is not located in the system directory.
• The file has a valid digital signature.

After adding a program to the Trusted Program List, the Security Agent
automatically excludes the program from the following:• Real-time Scan file checking• Real-time Scan process scanning
21-38

Apex One (Mac) Policy Settings• Event recording

Configuring the Trusted Program List
The Trusted Program List excludes programs and all child processes calledby the program from Real-time Scan.
Procedure
1.

Type the full program path of the program to exclude from the list.

2.

Click + Add.

3.

To remove a program from the list, click the Delete icon.

Predictive Machine Learning Settings
Trend Micro Predictive Machine Learning uses advanced machine learningtechnology to correlate threat information and perform in-depth fileanalysis to detect emerging unknown security risks through digital DNA
fingerprinting, API mapping, and other file features. Predictive Machine
Learning also performs a behavioral analysis on unknown or low-prevalence
processes to determine if an emerging or unknown threat is attempting to
infect your network.
Predictive Machine Learning is a powerful tool that helps protect yourenvironment from unidentified threats and zero-day attacks.
To enable this feature, select Enable Predictive Machine Learning.

Privileges and Other Settings
Configure Security Agents to protect critical Security Agent files and folders.

21-39

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

SectionDescription

Security Agent Selfprotection

Select Protect files used by the Security Agent to prevent otherprograms and even the user from modifying or deleting files that the
Security Agent uses.
For the list of files and folders this feature protects, see Protected
Security Agent Files on page 21-40.

Uninstallation

The Security Agent uninstallation privilege allows users to uninstall
the Security Agent program on local endpoints.
• Does not require a password• Requires a password: Type the required password andconfirmation password
Note• If you select Requires a password and do not specify
a password, Trend Micro Apex Central applies the
password of the account used to provision the console.
• Passwords must meet the following complexity
requirements:• Length of 8 to 32 characters• At least one of each: uppercase (A-Z), lowercase (az), numeric (0-9), and special character• Cannot contain the user name• Cannot contain non-printable ASCII characters

Protected Security Agent Files
When you enable the Security Agent self-protection feature, Apex One (Mac)locks the following files and folders to prevent other programs and even theuser from modifying or deleting Security Agent files:• /Library/Application Support/TrendMicro/common

21-40

Apex One (Mac) Policy Settings• /Library/Application Support/TrendMicro/Kext• /Library/Application Support/TrendMicro/TmccMac• /Library/Application Support/TrendMicro/TmccUpdate• /Library/Application Support/TrendMicro/Plug-in• /Library/Application Support/TrendMicro/Tools• /Library/LaunchDaemons/com.trendmicro.icore.*• /Library/LaunchDaemons/com.trendmicro.tmsm.plugin.plist• /Library/LaunchDaemons/com.trendmicro.tmsm.launcher.plist• /Application/TrendMicroSecurity.app
Note
Apex One (Mac) allows files to be added in the /Library/Application
Support/TrendMicro/Tools folder, files cannot be deleted from the folder.

21-41

IndexA

actions
Data Loss Prevention, 17-10
ActiveAction, 9-45
approved list, 13-2
approved programs list, 8-9

criteria, 3-19, 3-20
importing, 3-21
customized keywords, 3-26
criteria, 3-26, 3-27
importing, 3-29
customized templates, 3-31
creating, 3-32
importing, 3-33

BD

Behavior Monitoring
action on system events, 8-8
exception list, 8-9
blocked programs list, 8-9
browsing targets, 2-10

dashboardtabs, 1-2
adding, 1-2
deleting, 1-3
renaming, 1-2
slide show, 1-2
summary, 1-6
widgets, 1-2
adding, 1-4
modifying product scope, 1-5
moving, 1-4
Data Discovery, 19-2
creating policies, 19-2
data identifiers, 3-16
expressions, 3-16
file attributes, 3-16
keywords, 3-16
Data Loss Prevention, 3-16, 17-2
actions, 17-10
data identifiers, 3-16
decompression rules, 17-16
expressions, 3-17–3-21
file attributes, 3-22, 3-23
keywords, 3-24–3-27, 3-29

action on monitored system events,
8-8

C
cache settings for scans, 6-12
compliance tab, 1-32
components
on the Update Agent, 6-16
compressed files
decompression rules, 17-16
condition statements, 3-31
conventional scan, 21-2, 21-3
switching to smart scan, 21-3
copying policy settings, 2-13
creating policies, 2-2, 2-18
copying settings, 2-13
settings, 2-3
criteria
customized expressions, 3-19, 3-20
keywords, 3-26, 3-27
customized expressions, 3-18–3-21

IN-1

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

network channels, 17-6, 17-7,
17-13–17-15

system and application channels,
17-9

templates, 3-29–3-33
Data Loss Prevention (DLP), 3-15
Data Protection, 17-2
decompression rules, 17-16
deleting policies, 2-19
deployed targets, 2-24
device control, 12-2, 12-5, 12-7, 12-8, 21-35,
21-36

Digital Signature Provider, 12-8
permissions, 12-5, 12-7, 21-36
program path and name, 12-7
requirements, 12-2
storage devices, 12-5, 21-36
wildcards, 12-8
Device List Tool, 17-9
digital signature cache, 6-12
Digital Signature Pattern, 6-12
Digital Signature Provider, 12-8
specifying, 12-8
DLP, 3-15
documentation, 2
draft policies, 2-3
DSP, 12-8
E
editing policies, 2-16
EDR, 1-15
email domains, 17-7
endpoint detection and response, 1-15
Event Monitoring, 8-6
exception list, 8-9
Behavior Monitoring, 8-9
IN-2

expressions, 3-16, 3-17
customized, 3-18, 3-21
criteria, 3-19, 3-20
predefined, 3-17
F
file attributes, 3-16, 3-22, 3-23
creating, 3-23
importing, 3-23
wildcards, 3-23
filter by criteria, 2-3
filtered policies
reordering, 2-24
I
IPv6 support
limitations, 21-30
K
keywords, 3-16, 3-24
customized, 3-26, 3-27, 3-29
predefined, 3-24, 3-25
L
logical operators, 3-31
logs
virus/malware logs, 16-10
M
mail scan, 6-15
Malware Behavior Blocking, 8-2
Manual Scan, 9-4
monitored email subdomains, 17-8
monitored system events, 8-6
monitored targets, 17-14, 17-16

IndexN
network channels, 17-6, 17-7, 17-13–17-15
email clients, 17-7
monitored targets, 17-13
non-monitored targets, 17-13transmission scope
all transmissions, 17-14
external transmissions, 17-15
transmission scope and targets,
17-6

non-monitored email domains, 17-7
non-monitored targets, 17-14, 17-16
O
offline targets, 2-24
on-demand scan cache, 6-13
P
PCRE, 3-18
pending targets, 2-24
Perle Compatible Regular
Expressions, 3-18
permissions
program path and name, 12-7
storage devices, 12-5, 21-36
policies
creating, 2-2, 2-18
Data Discovery, 19-2
deleting, 2-19
editing, 2-16
reordering, 2-24
policy list, 2-7, 2-21
policy management, 2-1, 2-2changing owners, 2-20
copying policy settings, 2-13
creating policies, 2-2, 2-18

deleting policies, 2-19
deployed targets, 2-24
DLP, 3-15
draft policies, 2-3
editing policies, 2-16
offline targets, 2-24
owner, 2-23
pending targets, 2-24
policy list, 2-7, 2-21
policy priority, 2-9, 2-21
reordering policies, 2-24
settings, 2-3
specified policies, 2-3
targets, 2-23
targets with issues, 2-24
understanding, 2-2
policy priority, 2-21
policy settings
copying, 2-13
policy targets, 2-23
policy types
draft, 2-3
policy priority, 2-21
reordering policies, 2-24
specified, 2-3predefined expressions, 3-17
viewing, 3-17
predefined keywords
distance, 3-25
number of keywords, 3-25
predefined templates, 3-30
privileges
mail scan privileges, 6-15
unload privilege, 6-8
product scopewidgets, 1-5
IN-3

Trend Micro Apex Central™ as a Service Widget and Policy Management Guide

Q

T

quarantine directory, 9-47

tabs, 1-2
compliance, 1-32
summary, 1-6
Threat Investigation, 1-15
Threat Statistics, 1-37
widgets, 1-2
targets, 2-23
browsing, 2-10
deployed, 2-24
filter by criteria, 2-3
offline, 2-24
pending, 2-24
with issues, 2-24
targets with issues, 2-24
templates, 3-29–3-33
condition statements, 3-31
customized, 3-31–3-33
logical operators, 3-31
predefined, 3-30
terminology, 4
Threat Investigation tab, 1-15
Threat Statistics tab, 1-37

R
Real-time Scan, 9-13
reordering policies, 2-24
S
scan cache, 6-12
scan exclusions, 9-53
scan methods
conventional scan, 9-2
smart scan, 9-2
switching scan methods, 9-2
Scan Now, 9-23
scan types, 21-6
Scheduled Scan, 9-33
Security Agent
reserved disk space, 16-7
selecting targets
filter by criteria, 2-3
smart scan, 21-2, 21-3
switching from conventionalscan, 21-3
specified policies, 2-3priority, 2-9
specify targets
browsing, 2-10
spyware/grayware scan
approved list, 13-2
storage devices
permissions, 12-5, 21-36
summary tab, 1-6
system and application channels, 17-9
IN-4

Uuninstallation
using the uninstallation program,
6-9, 21-40

Update Agent, 6-16
updates
Update Agent, 6-16
W
web reputation, 21-31
Web Reputation, 10-2
widgets, 1-2

Indexwildcards, 3-23
device control, 12-8
file attributes, 3-23

IN-5

Item Code: APEM09819/230828