Trend Micro Apex Central

TM

Patch 8
Widget and Policy Management Guide
Centralized Security Management for Endpoints

Trend Micro Incorporated reserves the right to make changes to thisdocument and to the product described herein without notice. Before
installing and using the product, review the readme files, release notes,
and/or the latest version of the applicable documentation, which areavailable from the Trend Micro website at:
http://docs.trendmicro.com/en-us/enterprise/apex-central.aspx
Trend Micro, the Trend Micro t-ball logo, Trend Micro Apex Central, Trend
Micro Apex One, Control Manager, and OfficeScan are trademarks orregistered trademarks of Trend Micro Incorporated. All other product orcompany names may be trademarks or registered trademarks of theirowners.
Copyright © 2023. Trend Micro Incorporated. All rights reserved.
Document Part No.: APEM89863/231117
Release Date: December 2023
Protected by U.S. Patent No.: 5,623,600; 5,889,943; 5,951,698; 6,119,165

This documentation introduces the main features of the product and/or
provides installation instructions for a production environment. Readthrough the documentation before installing or using the product.
Detailed information about how to use specific features within the productmay be available at the Trend Micro Online Help Center and/or the Trend
Micro Knowledge Base.
Trend Micro always seeks to improve its documentation. If you havequestions, comments, or suggestions about this or any Trend Microdocument, please contact us at docs@trendmicro.com.
Evaluate this documentation on the following site:
https://www.trendmicro.com/download/documentation/rating.asp

Table of Contents
Preface
Preface ................................................................................. 1
Documentation ..................................................................... 2
Audience .............................................................................. 2
Document Conventions ......................................................... 3
Terminology ......................................................................... 4

Part I: Introduction
Chapter 1: The Dashboard
About the Dashboard .......................................................... 1-2
Tabs and Widgets ................................................................ 1-2
Working with Tabs ........................................................ 1-2
Working with Widgets ................................................... 1-4
Security Posture Tab ........................................................... 1-6
Compliance Indicators .................................................. 1-7
Critical Threats ............................................................. 1-8
Resolved Events ............................................................ 1-9
Security Posture Chart .................................................. 1-9
Security Posture Details Pane ...................................... 1-10
Summary Tab ................................................................... 1-13
Critical Threats Widget ................................................ 1-14
Users with Threats Widget ........................................... 1-17
Endpoints with Threats Widget .................................... 1-18
Apex Central Top Threats Widget ................................. 1-19
Product Component Status Widget ............................... 1-20
Product Connection Status Widget ............................... 1-22
Ransomware Prevention Widget .................................. 1-23iTrend Micro Apex Central™ Widget and Policy Management Guide

Data Loss Prevention Tab .................................................. 1-24
DLP Incident Trends by User Widget ............................ 1-24
DLP Incidents by Severity and Status Widget ................. 1-25
DLP Incidents by User Widget ...................................... 1-26
DLP Incidents by Channel Widget ................................ 1-27
DLP Template Matches Widget ..................................... 1-28
Top DLP Incident Sources Widget ................................. 1-29
DLP Violated Policy Widget .......................................... 1-29
Compliance Tab ................................................................ 1-29
Product Application Compliance Widget ....................... 1-30
Product Component Status Widget ............................... 1-31
Product Connection Status Widget ............................... 1-33
Agent Connection Status Widget .................................. 1-34
Threat Statistics Tab .......................................................... 1-35
Apex Central Top Threats Widget ................................. 1-35
Apex Central Threat Statistics Widget ........................... 1-36
Threat Detection Results Widget .................................. 1-38
Policy Violation Detections Widget ............................... 1-40
C&C Callback Events Widget ........................................ 1-40

Chapter 2: Policy Management
Policy Management ............................................................ 2-2
Creating a New Policy ................................................... 2-2
Filtering by Criteria ................................................ 2-5
Assigning Endpoints to Filtered Policies ............. 2-7
Specifying Policy Targets ......................................... 2-9
Working with Parent Policy Settings ....................... 2-10
Copying Policy Settings ............................................... 2-13
Inheriting Policy Settings ............................................ 2-14
Modifying a Policy ...................................................... 2-16
Importing and Exporting Policies ................................. 2-18
Deleting a Policy ......................................................... 2-19
Changing the Policy Owner ......................................... 2-20
Understanding the Policy List ...................................... 2-21
Reordering the Policy List ........................................... 2-24
ii

Table of Contents

Policy Status ..................................................................... 2-25

Chapter 3: Policy Resources
Application Control Criteria ................................................ 3-2
Defining Allowed Application Criteria ............................ 3-4
Defining Blocked Application Criteria ............................ 3-6
Application Match Methods ........................................... 3-8
Application Reputation List ..................................... 3-8
File Paths ............................................................... 3-9
File Path Example Usage .................................. 3-11
Certificates ........................................................... 3-13
Hash Values .......................................................... 3-14
Data Loss Prevention ......................................................... 3-15
Data Identifier Types ................................................... 3-16
Expressions .......................................................... 3-17
Predefined Expressions ................................... 3-17
Viewing Settings for Predefined Expressions ....
3-17
Customized Expressions .................................. 3-18
Criteria for Customized Expressions .......... 3-18
Creating a Customized Expression ............. 3-20
Importing Customized Expressions ............ 3-21
File Attributes ....................................................... 3-21
Creating a File Attribute List ............................ 3-22
Importing a File Attribute List ......................... 3-23
Keywords ............................................................. 3-23
Predefined Keyword Lists ................................ 3-24
How Keyword Lists Work ................................. 3-24
Number of Keywords Condition ................. 3-24
Distance Condition ................................... 3-25
Customized Keyword Lists ............................... 3-25
Customized Keyword List Criteria .............. 3-26
Creating a Keyword List ............................. 3-27
Importing a Keyword List .......................... 3-29
Data Loss Prevention Templates ................................... 3-29
Predefined DLP Templates ..................................... 3-30
iii

Trend Micro Apex Central™ Widget and Policy Management Guide

Customized DLP Templates ................................... 3-30
Condition Statements and Logical Operators .... 3-30
Creating a Template ........................................ 3-31
Importing Templates ....................................... 3-33
Intrusion Prevention Rules ................................................ 3-33
Intrusion Prevention Rule Properties ........................... 3-35
Device Control Allowed Devices ......................................... 3-37

Part II: Apex Central Widgets
Chapter 4: Apex Central Dashboard Widgets
Apex Central Top File-based Threats Widgets ....................... 4-2
Endpoint Protection Verification Widget .............................. 4-2
Hosts with C&C Callback Attempts Widget ........................... 4-4
Policy Status ....................................................................... 4-4
Quick Launch ..................................................................... 4-5
Unique Compromised Hosts Over Time Widget .................... 4-6

Part III: Apex One Widgets
Chapter 5: Apex One Dashboard Widgets
Attack Discovery Detections Widget ..................................... 5-2
Quick Investigation Widget .................................................. 5-2
Top Blocked Applications .................................................... 5-3
Top Endpoints Affected by IPS Events Widget ....................... 5-3
Top IPS Attack Sources ........................................................ 5-3
Top IPS Events .................................................................... 5-4
Top Violated Application Control Criteria ............................. 5-4

Part IV: Apex One Server Policy Settingsiv

Table of Contents

Chapter 6: Apex One Server Policy Settings
Configuring Endpoint Sensor Server Settings ....................... 6-2

Part V: Apex One Security Agent Policies
Chapter 7: Security Agent Program Settings
Additional Service Settings .................................................. 7-2
Configuring Additional Security Agent Services .............. 7-3
Privileges and Other Settings ............................................... 7-4
Configuring Agent Privileges ......................................... 7-4
Configuring Other Agent Settings .................................. 7-9
Security Agent Self-protection ............................... 7-12
Protect Security Agent Services ........................ 7-13
Protect Files in the Security Agent Installation
Folder ............................................................ 7-13
Protect Security Agent Registry Keys ................ 7-14
Protect Security Agent Processes ...................... 7-14
Cache Settings for Scans ........................................ 7-15
Digital Signature Cache ................................... 7-15
On-demand Scan Cache ................................... 7-16
POP3 Mail Scan ..................................................... 7-18
Update Agents .................................................................. 7-19
Assigning Security Agents as Update Agents ................. 7-19

Chapter 8: Application Control Policy Settings
Application Control ............................................................ 8-2
Configuring Application Control Settings (Agent) ............ 8-2

Chapter 9: Behavior Monitoring Policy Settings
Behavior Monitoring ........................................................... 9-2
Malware Behavior Blocking ........................................... 9-2
Ransomware Protection .......................................... 9-2
Anti-Exploit Protection ............................................ 9-5v

Trend Micro Apex Central™ Widget and Policy Management Guide

Newly Encountered Program Protection ......................... 9-5
Event Monitoring .......................................................... 9-6
Behavior Monitoring Exception List ............................... 9-9
Exception List Wildcard Support ............................. 9-9
Exception List Environment Variable Support ......... 9-14
Configuring Behavior Monitoring Rules and Exceptions ...... 9-15

Chapter 10: Anti-malware Policy Settings
Scan Method Types ........................................................... 10-2
Guidelines for Switching Scan Methods ........................ 10-2
Manual Scan ..................................................................... 10-4
Configuring Manual Scan Settings ................................ 10-4
Manual Scan: Target Tab ....................................... 10-4
Manual Scan: Action Tab ....................................... 10-6
Manual Scan: Scan Exclusion Tab ........................... 10-9
Real-time Scan ................................................................ 10-12
Configuring Real-time Scan Settings ........................... 10-12
Real-time Scan: Target Tab ................................... 10-13
Real-time Scan: Action Tab .................................. 10-16
Real-time Scan: Scan Exclusion Tab ...................... 10-19
Scan Now ........................................................................ 10-21
Configuring Scan Now Settings .................................. 10-21
Scan Now: Target Tab .......................................... 10-22
Scan Now: Action Tab .......................................... 10-24
Scan Now: Scan Exclusion Tab ............................. 10-27
Scheduled Scan ............................................................... 10-29
Configuring Scheduled Scan Settings .......................... 10-30
Scheduled Scan: Target Tab .................................. 10-30
Scheduled Scan: Action Tab ................................. 10-33
Scheduled Scan: Scan Exclusion Tab ..................... 10-36
Scan Actions ................................................................... 10-38
ActiveAction ............................................................. 10-39
Custom Scan Actions ................................................. 10-40
Quarantine Directory ........................................... 10-41
viTable of Contents

Uncleanable Files ...................................................... 10-43
Files Infected with Trojans ................................... 10-45
Files Infected with Worms ................................... 10-46
Write-protected Infected Files .............................. 10-46
Password-protected Files ..................................... 10-46
Backup Files ....................................................... 10-46
Scan Exclusion Support ................................................... 10-47
Trend Micro Product Directory Exclusions .................. 10-47
Wildcard Exceptions .................................................. 10-47

Chapter 11: Web Reputation Policy Settings
Web Reputation ................................................................ 11-2
Configuring a Web Reputation Policy ................................. 11-2
HTTPS URL Scan Support ............................................ 11-6

Chapter 12: Unknown Threat Protection
Predictive Machine Learning ............................................. 12-2
Configuring Predictive Machine Learning Settings ........ 12-3
Configuring Sample Submission Settings ............................ 12-5
Configuring Suspicious Connection Settings ....................... 12-6

Chapter 13: Device Control Policy Settings
Device Control .................................................................. 13-2
Configuring Device Control Settings ................................... 13-2
Permissions for Devices .............................................. 13-5
Wildcard Support for the Device Control Allowed Programs
List ............................................................................ 13-7
Specifying a Digital Signature Provider ......................... 13-8

Chapter 14: Scan Exclusion Lists
Spyware/Grayware Approved List ...................................... 14-2
Managing the Spyware/Grayware Approved List ........... 14-2
vii

Trend Micro Apex Central™ Widget and Policy Management Guide

Trusted Program List ......................................................... 14-2
Configuring the Trusted Programs List ......................... 14-3

Chapter 15: Endpoint Sensor Policy Settings
Endpoint Sensor ............................................................... 15-2
Configuring Endpoint Sensor Settings ................................ 15-2

Chapter 16: Vulnerability Protection Policy Settings
Vulnerability Protection .................................................... 16-2
Configuring Vulnerability Protection Settings ..................... 16-2
Advanced Logging Policy Modes .................................. 16-6

Part VI: Apex One Data Loss Prevention Policies
Chapter 17: Apex One Data Discovery Dashboard Widgets
Top Sensitive File Policy Detections Widget ........................ 17-2
Top Endpoints with Sensitive Files Widget .......................... 17-3
Top Data Discovery Template Matches Widget .................... 17-5
Top Sensitive Files Widget ................................................. 17-6

Chapter 18: Apex One Data Discovery Policy Settings
Creating Data Discovery Policies ........................................ 18-2

Chapter 19: Apex One Data Loss Prevention Policy Settings
Data Loss Prevention (DLP) ............................................... 19-2
Configuring a Data Loss Prevention Policy .......................... 19-3
Configuring Data Loss Prevention Rules ....................... 19-4
Transmission Scope and Targets for Network Channels............................................................................. 19-6
Network Channels ................................................ 19-6
Email Clients .................................................. 19-7
viii

Table of Contents

System and Application Channels .......................... 19-9
Device List Tool .................................................... 19-9
Running the Device List Tool ........................... 19-9
Data Loss Prevention Actions ............................... 19-10
Data Loss Prevention Exceptions ................................ 19-12
Defining Non-monitored and Monitored Targets ... 19-13
Transmission Scope: All Transmissions .......... 19-14
Transmission Scope: Only Transmissions Outside
the Local Area Network ................................. 19-15
Decompression Rules .......................................... 19-16

Part VII: Apex One (Mac) Widgets and Policies
Chapter 20: Apex One (Mac) Dashboard Widgets
Key Performance Indicators Widget ................................... 20-2
Configuring Key Performance Indicators ...................... 20-2
Configuring Widget Settings ........................................ 20-3

Chapter 21: Apex One (Mac) Policy Settings
Cache Settings for Scans .................................................... 21-2
Device Control .................................................................. 21-3
Configuring Device Control Settings ............................. 21-3
Permissions for Storage Devices .................................. 21-4
Endpoint Sensor ............................................................... 21-5
Configuring Endpoint Sensor Settings .......................... 21-5
Predictive Machine Learning Settings ................................ 21-6
Privileges and Other Settings ............................................. 21-6
Protected Security Agent Files ...................................... 21-6
Scan Method Types ........................................................... 21-7
Scan Methods Compared ............................................. 21-8
Switching from Smart Scan to Conventional Scan ......... 21-8
Switching from Conventional Scan to Smart Scan ......... 21-9ix

Trend Micro Apex Central™ Widget and Policy Management Guide

Scan Types ...................................................................... 21-11
Real-time Scan .......................................................... 21-12
Configuring Real-time Scan Settings ..................... 21-12
Real-time Scan: Target Tab ............................. 21-13
Real-time Scan: Action Tab ............................ 21-13
Supported Compressed File Types .................. 21-14
Scan Actions ................................................. 21-15
Manual Scan ............................................................. 21-17
Configuring Manual Scan Settings ........................ 21-17
Manual Scan: Target Tab ................................ 21-17
Manual Scan: Action Tab ............................... 21-19
Supported Compressed File Types .................. 21-19
Scan Actions ................................................. 21-20
Scheduled Scan ......................................................... 21-22
Configuring Scheduled Scan Settings .................... 21-22
Scheduled Scan: Target Tab ............................ 21-22
Scheduled Scan: Action Tab ........................... 21-24
Supported Compressed File Types .................. 21-26
Scan Actions ................................................. 21-27
Scan Exclusions ............................................................... 21-28
Configuring Scan Exclusion Lists ................................ 21-29
Trusted Program List ....................................................... 21-32
Configuring the Trusted Program List ......................... 21-33
Update Settings ............................................................... 21-33
Pure IPv6 Agent Limitations ....................................... 21-35
Configuring Agent Update Settings ............................. 21-35
Web Reputation ............................................................... 21-36
Configuring Web Reputation Settings ......................... 21-37
Configuring the Approved and Blocked URL Lists ........ 21-39

Part VIII: Deep Discovery Widgets and PoliciesxTable of Contents

Chapter 22: Deep Discovery Analyzer and Email Inspector
Dashboard Widgets
Deep Discovery Analyzer Widgets ...................................... 22-2
Virtual Analyzer Summary Widget ............................... 22-2
Deep Discovery Email Inspector Widgets ............................ 22-3
Email Messages with Advanced Threats Widget ............ 22-3
Top Email Recipients of Advanced Threats Widget ........ 22-3

Chapter 23: Deep Discovery Inspector Integration and Policy
Settings
Deep Discovery Inspector Integration Summary ................. 23-2
Deep Discovery Inspector Affected Hosts Widget .......... 23-3
Deep Discovery Inspector Affected Hosts Detections 23-5
Deep Discovery Inspector System Status Widget ........... 23-6
Deep Discovery Inspector Policy Settings ........................... 23-9
Deny List/Allow List .................................................... 23-9
Creating a Custom Deny List .................................. 23-9
Creating a Custom Allow List ............................... 23-10
Importing/Exporting Custom Deny or Allow Lists . 23-10
Adding Monitored Network Groups ............................ 23-10
Adding Registered Services ........................................ 23-12
Configuring Virtual Analyzer Settings ......................... 23-13

Part IX: Deep Security Manager Widgets
Chapter 24: Deep Security Manager Dashboard Widgets
Deep Security Anti-Malware Event History Widget .............. 24-2
Deep Security Anti-Malware Status (Malware) Widget .......... 24-2
Deep Security Application Type Activity (Detected) Widget .. 24-3
Deep Security Application Type Activity (Prevented) Widget 24-4
Deep Security Component Summary Widget ....................... 24-5xiTrend Micro Apex Central™ Widget and Policy Management Guide

Deep Security Feature Summary Widget ............................. 24-7
Deep Security Firewall Activity (Detected) Widget ............... 24-8
Deep Security Firewall Activity (Prevented) Widget ............. 24-9
Deep Security Firewall Event History Widget ...................... 24-9
Deep Security Integrity Monitoring Activity Widget ........... 24-10
Deep Security Integrity Monitoring Event History Widget .. 24-11
Deep Security Intrusion Prevention Event History Widget .. 24-12
Deep Security IPS Activity (Detected) Widget .................... 24-12
Deep Security IPS Activity (Prevented) Widget ................... 24-13
Deep Security Log Inspection Activity Widget ................... 24-14
Deep Security Log Inspection Event History Widget .......... 24-15
Deep Security Reconnaissance Scan Event History Widget . 24-15
Deep Security Status Summary Widget ............................. 24-16
Deep Security Web Reputation Event History Widget ......... 24-17
Deep Security Web Reputation URL Activity Widget ........... 24-18

Part X: Endpoint Application Control Widgets andPolicies
Chapter 25: Endpoint Application Control Dashboard Widgets
Endpoint Application Control Key Performance Indicators
Widget ............................................................................. 25-2
Endpoint Application Control Rule Management ................ 25-6
Endpoint Application Control User and Endpoint Summary
Widget ............................................................................. 25-7
Endpoint Application Control Application, Rule, and Policy
Events Widget ................................................................. 25-12

xii

Table of Contents

Chapter 26: Endpoint Application Control Policy Settings
Policy Rules ...................................................................... 26-2
Policy Logging .................................................................. 26-3
Policy Deployment ............................................................ 26-4
Policy Server Connection ................................................... 26-5
Policy User Experience ...................................................... 26-6

Part XI: Endpoint Encryption Widgets and Policies
Chapter 27: Endpoint Encryption Dashboard Widgets
Endpoint Encryption Users ................................................ 27-2
Endpoint Encryption Devices ............................................. 27-9
Full Disk Encryption Status .............................................. 27-14
Endpoint Encryption Unsuccessful Device Logon .............. 27-16
Endpoint Encryption Unsuccessful User Logon ................. 27-19
Endpoint Encryption Device Lockout ................................ 27-21
Endpoint Encryption Security Violations Report ................ 27-23

Chapter 28: Endpoint Encryption Policy Settings
Authentication Overview ................................................... 28-2
Configuring Endpoint Encryption Users Rules .................... 28-5
Configuring Full Disk Encryption Rules .............................. 28-8
Configuring File Encryption Rules .................................... 28-11
Configuring Common Policy Rules ................................... 28-14
Migrating Groups to Apex Central .................................... 28-18

Part XII: Endpoint Sensor Widgets and Policies
xiiiTrend Micro Apex Central™ Widget and Policy Management Guide

Chapter 29: Trend Micro Endpoint Sensor Dashboard Widgets
Endpoint Sensor Investigation ........................................... 29-2
Intelligent Monitoring Summary by Host ........................... 29-3
Top Critical Threats by Dwell Time Widget ......................... 29-5

Chapter 30: Trend Micro Endpoint Sensor Integration and Policy
Settings
Endpoint Sensor Integration .............................................. 30-2
Registering with Apex Central ............................................ 30-2
Adding the Endpoint Sensor Widgets .................................. 30-3
Using Apex Central to Check Status .................................... 30-4
Using the Endpoint Sensor Investigation Widget ................. 30-5
Using Automatic Updates .................................................. 30-6
Trend Micro Endpoint Sensor Policy .................................. 30-8
Preparing the Server for Policy Deployment ................. 30-8
Creating and Deploying Policies ................................... 30-9Managing Monitoring Rules ......................................... 30-9Managing Submission Settings ................................... 30-11

Part XIII: InterScan Security Policies
Chapter 31: InterScan Messaging Security Suite Policy Settings
IMSS Rules ....................................................................... 31-2
Adding IMSS Rules ............................................................ 31-2
Step 1: Set Rule Name .................................................. 31-3
Step 2: Select Recipients and Senders ........................... 31-3
Configuring Exceptions ......................................... 31-4
Using the Asterisk Wildcard ................................... 31-5
Step 3: Select Templates ............................................... 31-5
Step 4: Select Actions ................................................... 31-6
Modifying Existing IMSS Rules .......................................... 31-6
xiv

Table of Contents

Deleting IMSS Rules .......................................................... 31-7

Chapter 32: InterScan Messaging Security Virtual Appliance
Policy SettingsIMSVA Rules ..................................................................... 32-2
Adding IMSVA Rules ......................................................... 32-2
Step 1: Set Rule Name .................................................. 32-3
Step 2: Select Recipients and Senders ........................... 32-3
Configuring Exceptions ......................................... 32-4
Using the Asterisk Wildcard ................................... 32-5
Step 3: Select Templates ............................................... 32-5
Step 4: Select Actions ................................................... 32-6
Modifying Existing IMSVA Rules ........................................ 32-6
Deleting IMSVA Rules ........................................................ 32-7

Chapter 33: InterScan Web Security Suite Policy Settings
Data Loss Prevention Rule List ........................................... 33-2
Step 1: Set Rule Name .................................................. 33-2
Step 2: Select Accounts ................................................ 33-2
Step 3: Select Compliance Templates to Block ............... 33-3
Step 4: Select Compliance Templates to Monitor ........... 33-3

Chapter 34: InterScan Web Security Virtual Appliance Policy
Settings
Data Loss Prevention Rule List ........................................... 34-2
Step 1: Set Rule Name .................................................. 34-2
Step 2: Select Accounts ................................................ 34-2
Step 3: Select Compliance Templates to Block ............... 34-3
Step 4: Select Compliance Templates to Monitor ........... 34-3

Part XIV: ScanMail for Microsoft Exchange Policies
xvTrend Micro Apex Central™ Widget and Policy Management Guide

Chapter 35: ScanMail for Microsoft Exchange Policy Settings
Configuring a Data Loss Prevention Policy .......................... 35-2
Selecting Accounts ...................................................... 35-2
Configuring DLP Targets .............................................. 35-3
Configuring DLP Actions ............................................. 35-4
Configuring DLP Notifications ..................................... 35-5
Enabling a DLP Policy ................................................. 35-6

Part XV: Smart Protection Server Widgets
Chapter 36: Smart Protection Server Dashboard Widgets
Active Users for File Reputation ......................................... 36-2
Active Users for Web Reputation ........................................ 36-2
HTTP Traffic Report for File Reputation ............................. 36-3
HTTP Traffic Report for Web Reputation ............................ 36-3
Real Time Status ............................................................... 36-3
Top 10 Infected Computers for File Reputation ................... 36-5
Top 10 Blocked Computers for Web Reputation ................... 36-5

Part XVI: Trend Micro Mobile Security Widgets andPolicies
Chapter 37: Trend Micro Mobile Security Dashboard Widgets
Android Device Health Status ............................................ 37-2
Android Device Encryption Status Summary Widget ........... 37-2
Android Device Operating System Version Summary Widget 37-2
Android Device Rooted Status Summary Widget ................. 37-3
Android Device Security Status Widget ............................... 37-3
Android Malware Scan Summary Widget ............................ 37-3
xvi

Table of Contents

Android Modified App Scan Summary Widget ..................... 37-4
Android Privacy Data Leak Scan Summary Widget .............. 37-4
Android Vulnerability Scan Summary Widget ..................... 37-5
Components Update Status Widget ..................................... 37-5
Cyber Security News for Mobile Widget .............................. 37-6
iOS Device Encryption Status Summary Widget .................. 37-6
iOS Device Health Status Widget ........................................ 37-6
iOS Device Security Status Widget ...................................... 37-6
iOS Device Jailbreak Status Summary Widget ...................... 37-7
iOS Device Operating System Version Summary Widget ...... 37-7
iOS Malware Scan Summary Widget ................................... 37-7
Mobile Device App Control Status Summary Widget ............ 37-8
Mobile Device Encryption Status Summary Widget ............. 37-8
Mobile Device Health Status Widget ................................... 37-9
Mobile Device Jailbreak Status Summary Widget ................ 37-9
Mobile Device Operating System Version Summary Widget . 37-9
Mobile Device Ransomware Scan Summary Widget ........... 37-10
Mobile Device Security Status Widget ............................... 37-10
Mobile Device Vendors Summary Widget .......................... 37-10
Policy Update Status Summary Widget .............................. 37-11
Server Component Health Status Summary Widget ........... 37-11
Telephone Carriers Summary Widget ............................... 37-11
Top 10 Applications Installed Widget ................................ 37-12
Top Five Android Ransomware Detected Widget ................ 37-12
Top Five Blocked Web Sites Widget ................................... 37-12
Top Five iOS Ransomware Detected .................................. 37-12
Top Five Malware Detected Widget ................................... 37-12
xvii

Trend Micro Apex Central™ Widget and Policy Management Guide

Windows Phone Device Encryption Status Summary Widget 37-13
Windows Phone Device Health Status Widget .................... 37-13
Windows Phone Device Operating System Version Summary
Widget ............................................................................ 37-13

Chapter 38: Trend Micro Mobile Security Policy Settings
Protecting Devices with Policies ......................................... 38-2
Common Policy in Full Version Deployment Mode ........ 38-4
Common Policy in Security Scan Deployment Mode ...... 38-5
Wi-Fi Policy ................................................................ 38-5
Exchange ActiveSync Policy ......................................... 38-5
Certificate Policy ......................................................... 38-5
VPN Policy ................................................................. 38-6
Global HTTP Proxy Policy ............................................ 38-6
Single Sign-On Policy .................................................. 38-6
Cellular Network Policy ............................................... 38-7
AirPlay/AirPrint Policy ................................................. 38-7
Theme Policy .............................................................. 38-7
Managed Domains Policy ............................................ 38-8
Security Policy in Full Version Deployment Mode ......... 38-8
Security Policy in Security Scan Deployment Mode ...... 38-10
Spam Prevention Policy ............................................. 38-12
Spam SMS Prevention Policies ............................. 38-12
Spam WAP Push Prevention Policies ..................... 38-14
Call Filtering Policy ................................................... 38-15
Web Threat Protection Policy ..................................... 38-17
Web Threat Protection for Android Mobile Devices 38-17
Web Threat Protection for iOS Mobile Devices ...... 38-19
Password Policy ........................................................ 38-19
Feature Lock Policy ................................................... 38-20
Supported Mobile Device OS Features ................... 38-20
Compliance Policy ..................................................... 38-29
Application Monitor and Control Policy ...................... 38-29
Volume Purchasing Program Policy ............................ 38-32
Adding an Application ......................................... 38-33
Container Policy ........................................................ 38-35
xviii

Table of Contents

Part XVII: Virtual Mobile Infrastructure Widgets
Chapter 39: Virtual Mobile Infrastructure Dashboard Widgets
Top 5 Trend Micro Virtual Mobile Infrastructure Launched
Applications Widget .......................................................... 39-2
Top 5 Trend Micro Virtual Mobile Infrastructure Launched Web
Applications Widget .......................................................... 39-2
Top 5 Trend Micro Virtual Mobile Infrastructure Online Users
Widget ............................................................................. 39-2
Trend Micro Virtual Mobile Infrastructure Server CPU Usage
Status Widget .................................................................... 39-3
Trend Micro Virtual Mobile Infrastructure Server Disk Usage
Status Widget .................................................................... 39-3
Trend Micro Virtual Mobile Infrastructure Server Memory Usage
Status ............................................................................... 39-3
Trend Micro Virtual Mobile Infrastructure User Status Widget ....
39-4

Part XVIII: Vulnerability Protection Widgets
Chapter 40: Vulnerability Protection Dashboard Widgets
Vulnerability Protection Application Type Activity (Detected)
Widget ............................................................................. 40-2
Vulnerability Protection Application Type Activity (Prevented)
Widget ............................................................................. 40-3
Vulnerability Protection Feature Summary Widget .............. 40-4
Vulnerability Protection Firewall Event History Widget ....... 40-5
Vulnerability Protection Intrusion Prevention Event History
Widget ............................................................................. 40-6
Vulnerability Protection IPS Activity (Detected) Widget ....... 40-6
Vulnerability Protection IPS Activity (Prevented) Widget ..... 40-7
xixTrend Micro Apex Central™ Widget and Policy Management Guide

Vulnerability Protection Key Performance Indicator Widget 40-8
Vulnerability Protection Reconnaissance Scan Event History
Widget ............................................................................. 40-9
Vulnerability Protection Status Summary Widget ................ 40-9
Vulnerability Protection Vulnerable Endpoints Widget ...... 40-10

Index
Index ............................................................................... IN-1

xx

xxi

Preface

Preface
Welcome to the Trend Micro Apex Central™ Widget and Policy Management
Guide. This document explains how to configure Dashboard widgets andPolicy Management settings on Apex Central.
Topics in this section:

1Trend Micro Apex Central™ Widget and Policy Management Guide

Documentation
Apex Central documentation includes the following:
Document

Description

Readme file

Contains a list of known issues and may also contain late-breaking
product information not found in the Online Help or printed
documentation

Administrator's Guide

A PDF document that provides detailed instructions of how to
configure and manage Apex Central and managed products, andexplanations on Apex Central concepts and features

Online Help

HTML files compiled in WebHelp format that provide "how to's", usage
advice, and field-specific information. The Help is also accessible fromthe Apex Central console

Widget and Policy
Management Guide

Contains information that explains how to configure dashboard
widgets and policy management settings in Apex Central
To access this guide, go to https://docs.trendmicro.com/en-us/
enterprise/apex-central-as-a-service-widget-and-policy-managementguide/preface-wpg-.aspx.

Automation Center

Online user guides and references that explain how to use the Apex
Central Automation APIs: https://automation.trendmicro.com/apexcentral/home

Data Protection Lists(Chapter 1 only)

A PDF document that lists predefined data identifiers and templates
for Data Loss Prevention

Knowledge BaseAn online database of problem-solving and troubleshooting
information. It provides the latest information about known productissues. To access the Knowledge Base, go to the following website:
http://success.trendmicro.com

Download the latest version of the PDF documents and readme at:
http://docs.trendmicro.com/en-us/enterprise/apex-central.aspx

Audience
Apex Central documentation is intended for the following users:2

Preface• Apex Central Administrators: Responsible for Apex Central installation,
configuration, and management. These users are expected to haveadvanced networking and server management knowledge.
• Managed Product Administrators: Users who manage Trend Micro
products that integrate with Apex Central. These users are expected tohave advanced networking and server management knowledge.

Document Conventions
The documentation uses the following conventions.
Table 1. Document Conventions
Convention

Description

UPPER CASE

Acronyms, abbreviations, and names of certain commands
and keys on the keyboard

Bold

Menus and menu commands, command buttons, tabs, andoptions

Italics

References to other documents

Monospace

Sample command lines, program code, web URLs, file names,and program output

Navigation > Path

The navigation path to reach a particular screen
For example, File > Save means, click File and then click
Save on the interface

Note

Tip

ImportantConfiguration notes

Recommendations or suggestions

Information regarding required or default configuration
settings and product limitations

3

Trend Micro Apex Central™ Widget and Policy Management Guide

Convention
WARNING!

Description
Critical actions and configuration options

Terminology
The following table provides the official terminology used throughout theApex Central documentation:
Terminology

Description

Administrator (or Apex Central
administrator)

The person managing the Apex Central server

Security Agent

The managed product program installed on an endpoint

Components

Responsible for scanning, detecting, and taking actions
against security risks

Apex Central console, web
console, or management
consoleThe web-based user interface for accessing, configuring, andmanaging a Apex Central
Note
Consoles for integrated managed products areindicated by the managed product name. For
example, the Apex One web console.

4

Managed endpoint

The endpoint where the managed product Security Agent isinstalled

Managed productA Trend Micro product that integrates with Apex Central

Managed server

The endpoint where the managed product is installed

Server

The endpoint where the Apex Central server is installed

Security risk

The collective term for virus/malware, spyware/grayware,and web threatsPreface

Terminology

Description

Dual-stack

Entities that have both IPv4 and IPv6 addresses

Pure IPv4

An entity that only has an IPv4 address

Pure IPv6

An entity that only has an IPv6 address

5Part I
Introduction

Chapter 1

The Dashboard
This section discusses how to use the Apex Central dashboard tabs andwidgets.
Topics include:

1-1Trend Micro Apex Central™ Widget and Policy Management Guide

About the Dashboard
The Dashboard appears when you open the Apex Central web console or
click Dashboard on the main menu. Each Apex Central user account has acompletely independent dashboard. Any changes to the dashboard belonging
to a specific user account will not affect the dashboards of the other user
accounts.
The Dashboard contains the following:• Tabs• Widgets

Tabs and Widgets
Widgets are the core components of the Dashboard. Widgets provide specificinformation about various security-related events.
The information that widgets display comes from:• Apex Central database• Registered managed products• Trend Micro Smart Protection Network
Tabs provide a container for widgets. The Dashboard supports up to 30 tabs.

Working with Tabs
Manage tabs by adding, renaming, changing the layout, deleting, andautomatically switching between tab views.
Procedure
1.

Go to the Dashboard.

2.

To add a tab:a.

1-2

Click the add icon ().

The Dashboard

b.
3.

4.

5.

6.

Type a name for the new tab.

To rename a tab:a.

Hover over the tab name and click the down arrow.

b.

Click Rename and type the new tab name.

To change the layout of the widgets for a tab:a.

Hover over the tab name and click the down arrow.

b.

Click Change Layout.

c.

Select the new layout from the screen that appears.

d.

Click Save.

To delete a tab:a.

Hover over the tab name and click the down arrow.

b.

Click Delete and confirm.

To play a tab slide show:a.

Click the Settings button to the right of the tab display.

1-3

Trend Micro Apex Central™ Widget and Policy Management Guideb.

Enable the Tab Slide Show control.

c.

Select the length of time each tab displays before switching to thenext tab.

Working with Widgets
Manage widgets by adding, moving, resizing, renaming, and deleting items.
You can also modify the products that contribute data for the widget.
Procedure
1.

Go to the Dashboard.

2.

Click a tab.

3.

To add a widget:a.

1-4

Click the Settings button to the right of the tab display.

The Dashboardb.

Click Add Widgets.

c.

Select widgets to add.
• In the drop-down on top of the widgets, select a category tonarrow down the selections.
• Use the search text box on top of the screen to search for a
specific widget.

d.

Click Add.

4.

To move a widget to a new location on the same tab, drag-and-drop awidget to a new location.

5.

Resize widgets on a multi-column tab by pointing the cursor to the rightedge of the widget and then moving the cursor to the left or right.

6.

To rename a widget:7.

a.

Click the settings icon (b.

Type the new title.

c.

Click Save.

>).

To modify the product scope of the widget:a.

Click the settings icon (

>

).

1-5

Trend Micro Apex Central™ Widget and Policy Management Guide

8.

b.

Click the double arrow button () in the Scope field.

c.

(Optional) Click the funnel icon (products.

d.

Select the products that contribute data for the widget and click OK.

e.

Click Save.

) to filter and search for

To delete a widget, click the delete icon (>).

Security Posture Tab
The Security Posture tab provides a holistic summary of your network
protection status by consolidating data about the compliance levels, criticalthreat detections, and detections stopped on your network. You can use the
Security Posture chart to quickly identify high risk users and groups from an
integrated Active Directory structure.
Note
To change the sample chart data and display sites or reporting lines based onyour company network, enable Active Directory integration or create custom
sites based on IP addresses.

By default, the Security Posture tab is toggled to Chart view ( ). To display
the chart nodes, critical threats, and antivirus pattern complianceinformation in a table, toggle the Table view ().
Click the settings icon (displays on the tab.

>) to change the following information that• Organization: Specify the display name of the organization.
• Active Directory grouping: Specify whether the nodes on the chart
represent Sites or Reporting Lines from your Active Directory.
• Groups to display: Select the top number of groups at the highest risk

1-6

The Dashboard• Period: Specify the time range for the data that displays on the chart.

Compliance Indicators
This section of the Security Posture tab provides information about theantivirus pattern compliance level or the Data Loss Prevention compliancelevel of your network.
As your network compliance level changes, the color of the complianceindicator icon changes to reflect the thresholds configured on the Active
Directory and Compliance Settings screen.
The default view displays information for the Antivirus pattern complianceindicator.
Note
Changing the compliance indicator also changes the compliance level
information that displays in the Security Posture chart.

To change the compliance information that displays, click the name of theselected compliance indicator next to the down arrow icon ( ) and selectone of the following indicators from the drop-down.
Indicator
Antivirus patterncompliance

Description
Displays the following information:• The percentage of Security Agents using acceptable Virus Pattern
and Smart Scan Agent Pattern versions• The total number of endpoints with outdated antivirus patterns
on your network
Click the count for Endpoints with outdated patterns to view
detailed information about the affected endpoints in the User/
Endpoint Directory.

1-7

Trend Micro Apex Central™ Widget and Policy Management Guide

Indicator
Data Loss Prevention
compliance

Description
Displays the following information:• The percentage of Data Loss Prevention enabled Security Agentswith an acceptable number of threat detections• The total number of endpoints with Data Discovery threat
detections
Click the count for Endpoints with unacceptable threat
detections to view detailed information about the affected
endpoints in the User/Endpoint Directory.

Critical Threats
The Critical Threats section of the Security Posture tab displays the total
number of unique critical threats (by threat type) detected on your network,
the total number of affected users, and the number of affected important
users (marked by the star).
Click the number of affected users to view additional details on the User/
Endpoint Directory screen.
Critical threat detections include the following threat types.
Threat Type

1-8

Description

Ransomware

Malware that prevents or limits users from accessing their system
unless a ransom is paid

Known Advanced
Persistent Threat(APT)

Intrusions by attackers that aggressively pursue and compromisechosen targets, often conducted in campaigns—a series of failed andsuccessful attempts over time to get deeper and deeper into a target
network—and not isolated incidents

Social engineering
attackMalware or hacker attacks that exploits a security vulnerability foundin documents, such as a PDF file

Vulnerability attack

Malware or hacker attacks that exploits a security weakness typicallyfound in programs and operating systems

The Dashboard

Threat Type

Description

Lateral movement

Searches for directories, email, and administration servers, and otherassets to map the internal structure of a network, obtain credentials toaccess these systems, and allow the attacker to move from system tosystem

Unknown threats

Suspicious objects (IP addresses, domains, file SHA-1 hash values,
email messages) with the "high" risk level, as detected by Deep
Discovery Inspector, endpoint security products, or other productswith Virtual Analyzer

C&C callback

Attempts to communicate with a command-and-control (C&C) server
to deliver information, receive instructions, and download othermalwareResolved Events
This section of the Security Posture tab displays the total number of resolved
and unresolved events on your network.
Click the count for the Users affected by __ unresolved events field to view
detailed information about the users affected by unresolved events on yournetwork.

Security Posture Chart
The chart on the Security Posture tab displays the relationship between thecritical threat ratio and compliance level of your network. The x-axis
indicates the ratio of critical threats to total endpoints within a site orreporting line. The y-axis indicates the compliance levels of the sites orreporting lines for the selected compliance indicator. You can use this data toquickly identify high risk users and groups from an integrated Active
Directory structure.
Note
To change the sample chart data and display sites or reporting lines based onyour company network, enable Active Directory integration or create custom
sites based on IP addresses.

1-9Trend Micro Apex Central™ Widget and Policy Management Guide

Hover over a node to view compliance and critical threat information forparticular sites or reporting lines. The tail on a node indicates the direction
from which the security status has changed over the specified time period.
• Click the settings icon ( > ) to change the Active Directorygrouping (Sites, Reporting Lines) represented by the node.
• You can also customize sites and reporting lines by using the Active
Directory and Compliance Settings screen.
The default view displays the selected compliance indicator information for
all nodes on your network for the last 7 days.
• Select a different compliance indicator to change the complianceinformation that displays.
• Click the settings icon (displays.

>) to change the Period for the data that

• Click a node to view detailed information about the selected node in thesummary panel on the right.

Security Posture Details Pane
The details pane on the Security Posture tab displays more detailed
information about the compliance levels, critical threat detections, and total
resolved/unresolved events on your network.
The default view displays the selected compliance indicator information for
all nodes on your network for the last 7 days.
• Select a different compliance indicator to change the complianceinformation that displays.
• Click a node on the chart to display only the information for the selectednode.
• Click the settings icon (displays.

1-10>) to change the Period for the data that

The Dashboard

Table 1-1. Compliance Information
Indicator
Antivirus patterncompliance

Description
Displays the percentage of Security Agents using acceptable Virus
Pattern and Smart Scan Agent Pattern versions
You can also view the following details:• Managed agents: The number of endpoints that have Apex One
or Worry-Free Business Security Services Security Agents
installed• With compliant virus patterns: The number of managed
agents using acceptable Virus Pattern and Smart Scan Agent
Pattern versions• With outdated virus patterns: The number of managed
agents not using acceptable Virus Pattern and Smart Scan
Agent Pattern versions• Offline for 7 days: The number of managed agents thathave not communicated with the managed product server in
7 or more days
• Exceptions: The number of users or endpoints excluded
from the compliance calculations• Unmanaged endpoints: The number of endpoints that do nothave Apex One or Worry-Free Business Security Services Security
Agents installed
Expand the categories and click a count to view additional details
about the affected endpoints.

1-11

Trend Micro Apex Central™ Widget and Policy Management Guide

Indicator
Data Loss Prevention
compliance

Description
Displays the percentage of Data Loss Prevention enabled Apex One
agents with an acceptable number of threat detections
You can also view the following details:• Managed agents: The number of endpoints that have Apex One
or Worry-Free Business Security Services Security Agents
installed• With acceptable threat detections: The number ofmanaged agents with an acceptable number of threat
detections• With unacceptable threat detections: The number ofmanaged agents that exceeded the acceptable number of
threat detections• Offline for 7 days: The number of managed agents thathave not communicated with the managed product server in
7 or more days
• Exceptions: The number of users or endpoints excluded
from the compliance calculations• Unmanaged endpoints: The number of endpoints that do nothave Apex One or Worry-Free Business Security Services Security
Agents installed
Expand the categories and click a count to view additional details
about the affected endpoints.

Table 1-2. Critical Threats
SectionCritical threats

Description
Displays the total number of unique critical threats (by threat type)detected on your network
Lists all the critical threat types affecting your network
For threat types with detections:• Expand the threat type to view a list of detections.
• Click a detection to view additional details on the Threat
Information screen.

1-12

The Dashboard

SectionAffected users

Description
Displays the total number of users affected by critical threats• Expand the section to view affected users.
• Click an affected user to view additional details on the User
information screen.

Affected endpoints

Displays the total number of endpoints affected by critical threats• Expand the section to view affected endpoints.
• Click an affected endpoint to view additional details on the
Endpoint information screen.

Table 1-3. Total Events
Data

Description

Total events

Displays the total number of events detected

Resolved events

Displays the number of resolved events on your network

Unresolved events

Displays the number of unresolved events on your network that
require action

Affected users

Displays the number of users affected by unresolved events on yournetwork
Click the count to view details about the affected users.

Summary Tab
The Summary tab contains a predefined set of widgets that provides an
overview of the security status of your network.
Note
You can add, delete, or modify the widgets that display on the Summary tab.

Available widgets:• Critical Threats

1-13

Trend Micro Apex Central™ Widget and Policy Management Guide• Users with Threats• Endpoints with Threats• Product Connection Status• Product Component Status• Ransomware Prevention

Critical Threats Widget
This widget displays the total number of unique critical threat types detectedon your network and the number of affected users and threat detections foreach threat type.
Click the settings icon (>) to change the default View.

• On the Summary tab or a custom tab, the Affected users view is selectedby default.
• On the Threat Investigation tab, the Threat detections view is selectedby default.
Note• The widget lists critical threat types in order of severity.
• Individual users may be affected by more than one critical threat type.

1-14

The Dashboard

Use the Range drop-down to select the time period for the data that displays.

Figure 1-1. Affected Users View

The Affected users view displays the number of Important Users and Other
Users affected by each threat type.
• Click the count in the Important Users or Other Users column, and thenclick the affected user you want to view.
• You can define important users or endpoints on the User/Endpoint
Directory screen.

1-15

Trend Micro Apex Central™ Widget and Policy Management Guide

Figure 1-2. Threat Detections View

The Threat detections view displays the number of detections for eachcritical threat type.
• Click a critical threat type to view the specific threat detections.
• Click the hyperlink for a specific threat detection to view details about
the affected users and automatically start a Root Cause Analysis todetermine whether the threat has affected other endpoints on yournetwork.
Critical threat detections include the following threat types.
Threat Type

1-16

Description

Ransomware

Malware that prevents or limits users from accessing their system
unless a ransom is paid

Known Advanced
Persistent Threats(APT)

Intrusions by attackers that aggressively pursue and compromisechosen targets, often conducted in campaigns—a series of failed andsuccessful attempts over time to get deeper and deeper into a target
network—and not isolated incidents

Social engineering
attacks

Malware or hacker attacks that exploits a security vulnerability foundin documents, such as a PDF file

The Dashboard

Threat Type

Description

Vulnerability attacks

Malware or hacker attacks that exploits a security weakness typicallyfound in programs and operating systems

Lateral movements

Searches for directories, email, and administration servers, and otherassets to map the internal structure of a network, obtain credentials toaccess these systems, and allow the attacker to move from system tosystem

Unknown threats

Suspicious objects (IP addresses, domains, file SHA-1 hash values,
email messages) with the "high" risk level, as detected by Deep
Discovery Inspector, endpoint security products, or other productswith Virtual Analyzer

C&C callbacks

Attempts to communicate with a command-and-control (C&C) server
to deliver information, receive instructions, and download othermalwareUsers with Threats Widget
This widget displays information about users with security threat detections.
Use the Range drop-down to select the time period for the data that displays.
Click the Important Users or Other Users tabs to switch between the
different views.
The table lists affected users in order by critical threat type severity first, andthen by the number of threat detections for the user.
• Click the number in the Threats column for the user you want to view.
The Most Critical Threat column displays the following threat types.
Threat TypeC&C callback

Description
Attempts to communicate with a command-and-control (C&C) server
to deliver information, receive instructions, and download othermalware1-17

Trend Micro Apex Central™ Widget and Policy Management Guide

Threat Type

Description

Known Advanced
Persistent Threat(APT)

Intrusions by attackers that aggressively pursue and compromisechosen targets, often conducted in campaigns—a series of failed andsuccessful attempts over time to get deeper and deeper into a target
network—and not isolated incidents

Lateral movement

Searches for directories, email, and administration servers, and otherassets to map the internal structure of a network, obtain credentials toaccess these systems, and allow the attacker to move from system tosystemRansomware

Malware that prevents or limits users from accessing their system
unless a ransom is paid

Social engineering
attackMalware or hacker attacks that exploits a security vulnerability foundin documents, such as a PDF file

Unknown threats

Suspicious objects (IP addresses, domains, file SHA-1 hash values,
email messages) with the "high" risk level, as detected by Deep
Discovery Inspector, endpoint security products, or other productswith Virtual Analyzer

Vulnerability attack

Malware or hacker attacks that exploits a security weakness typicallyfound in programs and operating systems

Endpoints with Threats Widget
This widget displays information about endpoints with security threat
detections.
Use the Range drop-down to select the time period for the data that displays.
Click the Important Users or Other Users tabs to switch between the
different views.
The table lists affected users in order by critical threat type severity first, andthen by the number of threat detections for the user.
• Click the number in the Threats column for the user you want to view.
The Most Critical Threat column displays the following threat types.

1-18

The Dashboard

Threat Type

Description

C&C callback

Attempts to communicate with a command-and-control (C&C) server
to deliver information, receive instructions, and download othermalwareKnown Advanced
Persistent Threat(APT)

Intrusions by attackers that aggressively pursue and compromisechosen targets, often conducted in campaigns—a series of failed andsuccessful attempts over time to get deeper and deeper into a target
network—and not isolated incidents

Lateral movement

Searches for directories, email, and administration servers, and otherassets to map the internal structure of a network, obtain credentials toaccess these systems, and allow the attacker to move from system tosystemRansomware

Malware that prevents or limits users from accessing their system
unless a ransom is paid

Social engineering
attackMalware or hacker attacks that exploits a security vulnerability foundin documents, such as a PDF file

Unknown threats

Suspicious objects (IP addresses, domains, file SHA-1 hash values,
email messages) with the "high" risk level, as detected by Deep
Discovery Inspector, endpoint security products, or other productswith Virtual Analyzer

Vulnerability attack

Malware or hacker attacks that exploits a security weakness typicallyfound in programs and operating systems

Apex Central Top Threats Widget
This widget displays information about the malicious files and malicious
URLs detected for a specified time range.
You can choose to display the data in a bar chart or table by clicking thedisplay icons ().
Use the drop-down list above the chart/table to select the type of threat data
to display.
• Malicious Files: Ranks the malicious files detected on your network by
the number of detections

1-19

Trend Micro Apex Central™ Widget and Policy Management Guide• Malicious URLs: Ranks the malicious URLs detected on your network by
the number of detections
Click a bar, threat name, or detection number to open the Log Query screenthat displays information about the affected endpoints, threat details, anddetection count.
The default view displays the top 10 threats from all the managed products
for which the logged on user account has access rights.
• Click the settings icon ( > ) to edit the widget title, product scope, or
number of threats that displays.

Product Component Status Widget
This widget displays the component versions and compliance status ofmanaged products or endpoints on your network. Use this widget to track
managed products or endpoints with outdated components.
The default view displays the latest versions of components managed by
Apex Central and the compliance status of managed products. The Patternand Engine sections list components in order of the highest rate of noncompliance first. You can click the Rate column to change the sort order.
Click any of the components in the Pattern or Engine columns to view a pie
chart that displays the number of managed products or endpoints using eachcomponent version.
Click the counts in the Outdated/All columns to view information about thecomponent versions on outdated managed products, all managed products,
outdated endpoints, or all endpoints.
Click the settings icon (>) to configure the following options:

Note
The settings icon (1-20) does not display for widgets on the Summary tab.

The Dashboard• To modify the product scope of the widget, click the double arrow
button ( ) in the Scope field and select the products that contributedata.
• To edit the components that display in the widget, select or clear
components from the Pattern or Engine fields.
• To display compliance information for managed products, endpoints, orboth, specify the Source.
• To specify whether to view data from all components reported bymanaged products or to view data from only components managed by
Apex Central, select the View.
Data

Description

Pattern

Displays the name of the pattern file, template, or antispam ruleEngineDisplays the name of the scan engine

Latest Version

Displays the following information:• The latest version of the component downloaded by Apex Central• The latest version of the component that is available fordownload (reported by managed products)

1-21

Trend Micro Apex Central™ Widget and Policy Management Guide

Data
Outdated/All

Description
Displays the following information:• Outdated: The number of managed products or endpoints withoutdated components
Click the first count in the Outdated/All column to view
information about the component versions on the outdated
managed products or endpoints.
• All: The total number of managed products or endpoints that use
the component
Click the second count in the Outdated/All column to view
information about the component versions on all managed
products or endpoints.
Note
This column displays when Both is selected for the Source.

Rate

Displays the percentage of managed products or endpoints withoutdated components
Note
This column displays when Both is selected for the Source.

Product Connection Status Widget
This widget displays the connection status of all managed products that
register to the Apex Central server.
The default view lists the connection status and managed server name ofeach managed product for which the logged on user account has accessrights.
• To change the product scope, click the settings icon (a new Scope.

1-22

>

) and selectThe Dashboard• To view a summary of the total number of managed products for eachconnection status, click the settings icon ( > ) and switch the View
to Summary.
Click View details to view detailed information on the Log Query screen.
StatusDescription

ActiveIndicates that the product service is running and communication with
the Apex Central server is established successfully

Inactive

Indicates that the product service is not running or is unable toestablish communication with the Apex Central server

AbnormalIndicates that the product service has not communicated with theApex Central server within the user-defined agent communication
time-out interval

Ransomware Prevention Widget
This widget provides an overview of all the attempted ransomware attacks
for a specified time range.
The default view displays a summary of all the ransomware detections andcategorizes all the attempts based on the infection channel.
• Click the ransomware detection count to view additional details.
ChannelDescription

Messages

Ransomware detected in email messages or email attachments

WebsitesRansomware detected by Web Reputation Services

Network traffic

Ransomware detected by Apex One Suspicious Connections and Deep
Discovery Inspector

Cloud sync

Ransomware detected by Cloud App Security on cloud storage andOffice 365 servers (Exchange Online, SharePoint Online, and
OneDrive), or detected by Apex One in local folders on Apex One
agents that sync with cloud storage

Files

Ransomware detected by File Reputation Services

1-23Trend Micro Apex Central™ Widget and Policy Management Guide

ChannelBehaviors

Description
Ransomware detected by Apex One Behavior Monitoring

Data Loss Prevention Tab
The Data Loss Prevention tab contains widgets that display information
about DLP incidents, template matches, and incident sources.
The predefined widgets include:• DLP Incidents by Severity and Status• DLP Incident Trends by User
• DLP Incidents by User
• DLP Incidents by Channel• DLP Template Matches• Top DLP Incident Sources• DLP Violated Policy

DLP Incident Trends by User Widget
This widget checks the number of DLP incident trends based on managed
users. Data can be filtered by severity level, or filtered to show only the total
number of incidents triggered by a specific user for a specified period oftime. By default the widget displays data from all the managed products thata user's account privileges allow.
Use the Range drop-down to select the time period for the data that displays.
Click the sections from the graph to open the Incident Information screen
and review the summary of incidents.
Click the widget settings icon on the widget to access additional settings.

1-24

The Dashboard

Setting

Description

Title

Specify a new and meaningful title for the widget in the field.

Range

Specify the time range when the DLP incidents were triggered.

Scope

Specify the data scope displayed by the widget.
• Directly managed users• All managed users: Data is collected from both directly managed
users and people under the directly managed users.

Severity

Specify the severity levels to filter the data.

Users to display

Specify the number of managed users to display.

Click Save to apply changes and update the widget data.

DLP Incidents by Severity and Status Widget
This widget checks the number of DLP incidents based on severity levels andincident status. Data can be filtered by severity level, as well as display the
total number of new and high severity incidents. By default the widget
displays data from all the managed products that a user's account privileges
allow.
Use the Range drop-down to select the time period for the data that displays.
Click the numbers in any column to open the Incident Information screen
and review the summary of incidents.
To look up a specific incident, type an ID in the Incident ID field and click
Search.
Tip
Each incident is assigned an ID number. ID numbers can be found by clicking
a table link, in Incident details updated event notifications, or in Data Loss
Prevention log query results.

Click the widget settings icon on the widget to access additional settings.

1-25

Trend Micro Apex Central™ Widget and Policy Management Guide

Setting

Description

Title

Specify a new and meaningful title for the widget in the field.

Range

Specify the time range when the DLP incidents were triggered.

Scope

Specify the data scope displayed by the widget.
• Directly managed users• All managed users: Data is collected from both directly managed
users and people under the directly managed users

Severity

Specify the severity levels to filter the data.

Click Save to apply changes and update the widget data.

DLP Incidents by User Widget
This widget checks the number of DLP incidents based on severity levels andmanaged users. Data can be filtered by severity level, as well as display the
total number of new and high severity incidents triggered by specific users.
By default the widget displays data from all the managed products that auser's account privileges allow. The widget shows a maximum of 50 users.
Use the Range drop-down to select the time period for the data that displays.
Click the numbers in any column to open the Incident Information screen
and review the summary of incidents.
To look up a specific user, type a few characters in the User field and click
Search. For example typing ke shows all user names with ke, such as “Ken”
and “Brooke”. You can also type a domain and user name, such as
domain1\chris.
Note
User names must not contain the following characters: " [ ] : ; | = + * ? / \ < &> ,Domain names must not contain the following characters: \ * + = | : ; " ? < &> ,Click the widget settings icon on the widget to access additional settings.

1-26

The Dashboard

Setting

Description

Title

Specify a new and meaningful title for the widget in the field.

Range

Specify the time range when the DLP incidents were triggered.

Scope

Specify the data scope displayed by the widget.
• Directly managed users• All managed users: Data is collected from both directly managed
users and people under the directly managed users.

Severity

Specify the severity levels to filter the data.

Users to display

Specify the number of managed users to display.

Click Save to apply changes and update the widget data.

DLP Incidents by Channel Widget
This widget displays the total number of DLP incidents. Data can be filteredby the type of channels where the incident is triggered.
Use the Range drop-down to select the time period for the data that displays.
Use the Channel drop-down to filter out the type of channels where theincident is triggered.
This widget displays the number of DLP incidents and the ratio of channels
compared to the total number of incidents. This widget displays this data by:
Data

Description

P2P

Displays all peer-to-peer DLP incidents by any managed product thatthe Data Scope specifies

IM

Displays all instant messaging DLP incidents by any managed productthat the Data Scope specifies

Webmail

Displays all webmail DLP incidents by any managed product that theData Scope specifies

Email

Displays all email DLP incidents by any managed product that theData Scope specifies

1-27

Trend Micro Apex Central™ Widget and Policy Management Guide

Data

Description

Web App

Displays all web application DLP incidents by any managed productthat the Data Scope specifies

Others

Displays the remaining DLP incidents by any managed product thatthe Data Scope specifies

Clicking links in the Channel column or sections from the graphs opens a
screen that displays detailed information.
Data

Description

ChannelType of channels where the DLP incidents is triggered

Incidents

Number of DLP incidents triggered

Percentage (%)

DLP incidents percentage of total number of incidents

To change the information that the widget displays, click> . On the
dialog box that appears, specify the Scope by clicking
and selecting theparent servers that the widget uses as its source.

DLP Template Matches Widget
This widget displays the type of DLP incidents on your network. Data can befiltered by template.
Use the Range drop-down to select the time period for the data that displays.
Clicking links in the Template column or sections from the graphs opens a
screen that displays detailed information.
Description

Data

1-28

Template

Template triggered by DLP incidents

Incidents

Number of DLP incidents

Percentage (%)

DLP incidents percentage of total number of incidents

The Dashboard

To change the information that the widget displays, click> . On the
dialog box that appears, specify the Scope by clicking
and selecting theparent servers that the widget uses as its source.

Top DLP Incident Sources Widget
This widget displays the total number of top DLP incident sources on yournetwork. This data includes users, email addresses, host names, and IP
addresses, which can be filtered by incident source.
Use the Range drop-down to select the time period for the data that displays.
Use the Show drop-down to select the data to be displayed.

DLP Violated Policy Widget
This widget displays the DLP violated policy. Use this widget to check the
total number of DLP incidents. By default data is sorted by the number ofincidents. To sort data by policy name, click the Policy column title.
Use the Range drop-down to select the time period for the data that displays.
Clicking links in the Incidents column opens a screen that displays detailed
information.
Description

Data
PolicyName of the policy where the DLP incidents is triggered

Incidents

Number of DLP incidents triggered

Compliance Tab
The Compliance tab contains widgets that display information relating tocomponent or connection compliance for managed products or endpoints.
The predefined widgets are as follows:• Product Application Compliance• Product Component Status

1-29

Trend Micro Apex Central™ Widget and Policy Management Guide• Product Connection Status• Agent Connection Status

Product Application Compliance Widget
This widget displays the product version, language, build, and update status
for managed products. This provides administrators a quick way to discern
which managed product's applications are up-to-date and which require
updating.
You can choose to display the data in a bar chart or table by clicking thedisplay icons ().
Click the counts in the Up-to-date and Out-of-date columns to open a screenthat displays detailed information. Apex Central performs a log query toprovide the detailed information.
Data

Description

Product

The managed product registered to Apex Central

VersionVersion of the managed productLanguage

Language version of the managed product

Build

Build number of the managed productUp-to-date

Number of products that are considered updated
Edit the widget to specify the minimum product version that shouldstill be considered "up-to-date".
Click the count to view more details about the product.

Out-of-date

Number of products that are "out-of-date"
Click the count to view more details about the product.

Up-to-date Rate (%)

Percentage of products that are "up-to-date"

By default the widget displays data from all the managed products that auser's account privileges allow.

1-30

The Dashboard

Specify a bar graph or a table to display the data. By default, data is displayed
as a bar graph.
Click Edit to access the following options:• Click Scope > Browse to specify the products that contribute data for thewidget.
The data scope specifies the products which the widget uses to display
data. This can have a drastic affect on the usefulness of the informationthat the widget displays.
• On the Up-to-date range drop-down, specify the number of productversions away from the latest build that should still be considered "upto-date".
Click Save to apply changes and exit.

Product Component Status Widget
This widget displays the component versions and compliance status ofmanaged products or endpoints on your network. Use this widget to track
managed products or endpoints with outdated components.
The default view displays the latest versions of components managed by
Apex Central and the compliance status of managed products. The Patternand Engine sections list components in order of the highest rate of noncompliance first. You can click the Rate column to change the sort order.
Click any of the components in the Pattern or Engine columns to view a pie
chart that displays the number of managed products or endpoints using eachcomponent version.
Click the counts in the Outdated/All columns to view information about thecomponent versions on outdated managed products, all managed products,
outdated endpoints, or all endpoints.
Click the settings icon (>) to configure the following options:

1-31

Trend Micro Apex Central™ Widget and Policy Management Guide

Note
The settings icon () does not display for widgets on the Summary tab.

• To modify the product scope of the widget, click the double arrow
button ( ) in the Scope field and select the products that contributedata.
• To edit the components that display in the widget, select or clear
components from the Pattern or Engine fields.
• To display compliance information for managed products, endpoints, orboth, specify the Source.
• To specify whether to view data from all components reported bymanaged products or to view data from only components managed by
Apex Central, select the View.
Data

Description

Pattern

Displays the name of the pattern file, template, or antispam ruleEngineDisplays the name of the scan engine

Latest Version

Displays the following information:• The latest version of the component downloaded by Apex Central• The latest version of the component that is available fordownload (reported by managed products)

1-32

The Dashboard

Data
Outdated/All

Description
Displays the following information:• Outdated: The number of managed products or endpoints withoutdated components
Click the first count in the Outdated/All column to view
information about the component versions on the outdated
managed products or endpoints.
• All: The total number of managed products or endpoints that use
the component
Click the second count in the Outdated/All column to view
information about the component versions on all managed
products or endpoints.
Note
This column displays when Both is selected for the Source.

Rate

Displays the percentage of managed products or endpoints withoutdated components
Note
This column displays when Both is selected for the Source.

Product Connection Status Widget
This widget displays the connection status of all managed products that
register to the Apex Central server.
The default view lists the connection status and managed server name ofeach managed product for which the logged on user account has accessrights.
• To change the product scope, click the settings icon (a new Scope.

>) and select1-33

Trend Micro Apex Central™ Widget and Policy Management Guide• To view a summary of the total number of managed products for eachconnection status, click the settings icon ( > ) and switch the View
to Summary.
Click View details to view detailed information on the Log Query screen.
StatusDescription

ActiveIndicates that the product service is running and communication with
the Apex Central server is established successfully

Inactive

Indicates that the product service is not running or is unable toestablish communication with the Apex Central server

AbnormalIndicates that the product service has not communicated with theApex Central server within the user-defined agent communication
time-out interval

Agent Connection Status Widget
This widget displays the connection status of agents with their parent
servers. Agents for the following managed products are displayed:• Endpoint Sensor• Endpoint Encryption• Mobile Security• Mobile Security (for Mac)
• Apex One• Vulnerability Protection• Worry-Free Business Security Services
By default the widget displays data from all the managed products that auser's account privileges allow.
Click the values in the Online, Offline, or Total columns to view more
information. Apex Central performs a log query to provide the information.

1-34

The Dashboard

Data

Description

ServerParent servers

OnlineAgents connected to their parent servers

OfflineAgents disconnected from their parent servers

Total

Total number of endpoints

To change the information that the widget displays, click> . On the
dialog box that appears, specify the Scope by clicking
and selecting theparent servers that the widget uses as its source.

Threat Statistics Tab
The Threat Statistics tab contains widgets that display aggregated detectionsof security threats.
The predefined widgets include:• Apex Central Top Threats• Apex Central Threat Statistics• Threat Detection Results• Policy Violation Detections• C&C Callback Events

Apex Central Top Threats Widget
This widget displays information about the malicious files and malicious
URLs detected for a specified time range.
You can choose to display the data in a bar chart or table by clicking thedisplay icons ().
Use the drop-down list above the chart/table to select the type of threat data
to display.
• Malicious Files: Ranks the malicious files detected on your network by
the number of detections
1-35

Trend Micro Apex Central™ Widget and Policy Management Guide• Malicious URLs: Ranks the malicious URLs detected on your network by
the number of detections
Click a bar, threat name, or detection number to open the Log Query screenthat displays information about the affected endpoints, threat details, anddetection count.
The default view displays the top 10 threats from all the managed products
for which the logged on user account has access rights.
• Click the settings icon ( > ) to edit the widget title, product scope, or
number of threats that displays.

Apex Central Threat Statistics Widget
This widget displays the total number of security threat detections on yournetwork. Data can be filtered by security threat type or by the location on
your network where the threat is detected.
• Product Category
Data

1-36

Description

File server

Security threats on file servers detected by any managed productthat the Data Scope specifies

Network

Security threats on your network detected by any managed
product that the Data Scope specifies

Unknown

Unidentified security threats

Mail

Security threats on email servers detected by any managed
product that the Data Scope specifies

Desktop

Security threats on desktops detected by any managed productthat the Data Scope specifies

Gateway

Security threats at the gateway detected by any managed productthat the Data Scope specifies

Apex Central server

Security threats on Apex Central servers detected by any managed
product that the Data Scope specifies

The Dashboard• Violation Type
Data

Description

Behavior
Monitoring

Behavior Monitoring violation detected by any managed productthat the Data Scope specifies

Content Violation

Content security violations (spam, blocked keywords andexpressions) detected by any managed product that the Data
Scope specifies

Device Control

Device Control violation detected by any managed product thatthe Data Scope specifies

Firewall Violation

Firewall violation by any managed product that the Data Scope
specifies

Network Content
Inspection

Network Content Inspection violation detected by any managed
product that the Data Scope specifies

Predictive Machine
Learning

Predictive Machine Learning detection by any managed productthat the Data Scope specifies

Spyware/Grayware

Spyware/grayware detected by any managed product that theData Scope specifies

Suspicious Files

Suspicious file detection by any managed product that the Data
Scope specifies

Virus/Malware

Viruses/malware detected by any managed product that the Data
Scope specifies

Web Security

Web security violations (malicious URLs, blocked URLs) detectedby any managed product that the Data Scope specifies

Note
The widget can display data for only one information type at a time.

Click the links in the Detections column to open a screen that displays
detailed information. Apex Central performs a log query to provide thedetailed information.

1-37

Trend Micro Apex Central™ Widget and Policy Management Guide

Data

Description

Type

Type of security threat or managed product where the threat is
detected

Detections

Number of security threats detected

Percentage (%)

Security threat percentage of total number of detected threatsSpecify the date range for the data that the widget displays:• Today• Last 7 days
• Last 14 days
• Last 30 days
Specify how the widget displays the data:• Pie chart• Bar chart• Tabular• Line chart
By default the widget displays data from all the managed products that auser's account privileges allow.
> . On the
To change the information that the widget displays, click
dialog box that appears, specify the Scope by clicking
and selecting theparent servers that the widget uses as its source.

Threat Detection Results Widget
This widget displays the number of threat detections and the ratio of threats
compared to the total number of detections. The widget can display data for
only one information type at a time. Clicking links in the Detections column
opens a screen that displays detailed information. Apex Central performs a
log query to provide the detailed information.

1-38

The Dashboard

Data
Results

Description
The action or result of the action performed by the managed product
Note
This column does not display for the Web Security threattype

Policy/Rule

The type of policy/rule applied under the Web Security threat type.
Note
This column does not display for other listed threat types.

Detections

The number of security threats detected

Percentage (%)

The percentage of total detections that are security threats

This widget displays threat detections for the following threat types:
Table 1-4. Threat Types
Threat Type

Description

Virus/Malware

Displays the action taken on all files by any managed product that theData Scope specifies. For example: Cleaned, Access denied, and so on.

Spyware/Grayware

Displays the action taken on all files by any managed product that theData Scope specifies. For example: Successful, Further action
required, and so on.

Content Security

Displays the action taken on all email messages by any managed
product that the Data Scope specifies. For example: Deleted,
Attachments stripped, and so on.

Web Security

Displays all web security violations blocked using the policies by any
managed product that the Data Scope specifies. For example: Fileblocking, File name, and so on.

Network Virus

Displays the action taken on all network viruses by any managed
product that the Data Scope specifies

1-39

Trend Micro Apex Central™ Widget and Policy Management Guide

Click the settings icon ( >type of threats that displays.

) to edit the widget title, product scope, or

Policy Violation Detections Widget
This widget displays the policy violation detections for Network VirusWall
Enforcer devices. Clicking links in the Detections column opens a screenthat displays detailed information. Apex Central performs a log query toprovide the detailed information.
Data

Description

Type

Lists Service Violations as a type of security threat

UpdatedLast updated date

Detections

Number of service violations Network VirusWall Enforcer devices
detectClick the settings icon (>) to edit the widget title or product scope.

Note
This widget only displays policy violation detections for Network VirusWall
Enforcer.

Click Save to apply changes and exit.

C&C Callback Events Widget
This widget displays the number of C&C callback attempts based oncompromised hosts or callback addresses. The widget can display data for
only one information type at a time. Clicking the numbers in any table cells
opens the C&C Callback Events screen, which contains the following
callback summary data:
Data
Compromised Host

1-40

Description
Affected host or email address

The Dashboard

Data

Description

Callback Address

URL, IP address, or email address to which a compromised host
attempts a callback

C&C Server Location

Region and country where the C&C server locates

Callback Attempts

Number of contacts made between callback addresses andcompromised hosts

Latest Callback
Address/
Compromised Host

URL, IP address, or email address to which the last callback attempt
was logged

Callback Addresses/
Compromised Hosts(with numbers
displayed in thecolumns)

Number of compromised hosts or callback addresses associated withthe callback attempts

Logged By

Name of the managed product that logged the event

Click the settings icon (>) to edit the following:• Title: Modify the title of the C&C Callback Events widget.
• Scope: Clicksource.

and select the parent servers that the widget uses as the• C&C list source: Select Global Intelligence, Virtual Analyzer, or Userdefined as the C&C list sources.
• Items to display: Select the number of items to display on the widget.
Click Save to apply changes and exit.

1-41Chapter 2

Policy Management
This section contains information about how to perform policy management
on managed products and endpoints.
Important
Each managed product provides different policy settings that you canconfigure and deploy to policy targets. You can find a complete list of
supported managed products and the policy settings for each in the Apex
Central Widget and Policy Management Guide.
You can download a PDF version of the guide using the following link:
https://docs.trendmicro.com/en-us/enterprise/apex-central.aspx
You can also view the guide online using the following link:
https://docs.trendmicro.com/en-us/enterprise/apex-central-widget-and-policymanagement-guide/introduction.aspx

Topics include:• Policy Management on page 2-2• Policy Status on page 2-25

2-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Policy Management
Policy management allows administrators to enforce product settings on
managed products and endpoints from a single management console.
Administrators create a policy by selecting the targets and configuring a listof product settings.
To perform policy management on a new managed product or endpoint,
move the managed product from the New Entity folder to another folder in
the Product Directory structure.

Creating a New Policy
Important
Each managed product provides different policy settings that you canconfigure and deploy to policy targets. You can find a complete list of
supported managed products and the policy settings for each in the Apex
Central Widget and Policy Management Guide.
You can download a PDF version of the guide using the following link:
https://docs.trendmicro.com/en-us/enterprise/apex-central.aspx
You can also view the guide online using the following link:
https://docs.trendmicro.com/en-us/enterprise/apex-central-widget-and-policymanagement-guide/introduction.aspx

Procedure
1.

Go to Policies > Policy Management.
The Policy Management screen appears.

2.

Select the type of product settings from the Product list.
The screen refreshes to display policies created for the selected
managed product.

2-2

Policy Management

For more information about configuring policy settings for specificmanaged products, see the Apex Central Widget and Policy Management
Guide.
3.

Click Create.
The Create Policy screen appears.

4.

Type a policy name.

5.

Specify targets.
Apex Central provides several target selection methods that affect how apolicy works.
Note
To include a managed product or endpoint as a target, make sure theproduct version of the managed product or endpoint supports policy
management in Apex Central. The Policy Template Settings screen(Policies > Policy Resources > Policy Template Settings) contains
information about supported product versions.

The policy list arranges the policy targets in the following order:• Specify Targets: Use this option to select specific endpoints or
managed products.
For details, see Specifying Policy Targets on page 2-9.
• Filter by Criteria: Use this option to allocate endpoints
automatically based on the filtering criteria.
For details, see Filtering by Criteria on page 2-5.
• None (Draft only): Use this option to save the policy as a draft
without choosing any targets.
For more information about the policy list, see Understanding the Policy
List on page 2-21.

2-3

Trend Micro Apex Central™ Widget and Policy Management Guide

6.

Click a managed product feature to expand it and configure its settings.
Repeat this step to configure all features.
• Each feature has a link to a Help topic that discusses the feature andhow to use it.
• For certain product settings, Apex Central needs to obtain specificsetting options from the managed products. If administrators selectmultiple targets for a policy, Apex Central can only obtain thesetting options from the first selected target. To ensure a successfulpolicy deployment, make sure the product settings aresynchronized across the targets.
• If you are creating a policy for Apex One Security Agent that you
want to act as a parent to a future child policy, configure settings
that can be inherited, customized, or extended on the child policy.
• For a list of Security Agent settings that can be inherited,customized, or extended, see Working with Parent Policy Settings
on page 2-10.
• For details on creating a child policy, see Inheriting Policy
Settings on page 2-14.

7.

Click Deploy or Save.
If you clicked Deploy, Apex Central starts the deployment. The deployed
policy appears in the list on the Policy Management screen. It usuallytakes a few minutes for Apex Central to deploy the policy to the targets.
Click Refresh on the Policy Management screen to update the status
information in the policy list. If the status of the deployment remains
pending after an extended period of time, there might be issues with thetargets. Check if there is a connection between Apex Central and thetargets. Also check if the targets are working properly.
Once Apex Central deploys a policy to the targets, the settings defined in
the policy overwrite the existing settings in the targets. Apex Central
enforces the policy settings in the targets every 24 hours. Although local
administrators can make changes to the settings from the managed
product console, the changes are overwritten every time Apex Central
enforces the policy settings.

2-4

Policy Management• Apex Central enforces the policy settings on the targets every 24
hours. Since policy enforcement only occurs every 24 hours, theproduct settings in the targets may not align with the policy settings
if local administrators make changes through the managed productconsole between the enforcement period.
• Policy settings deployed to IMSVA servers take priority over the
existing settings on the target servers instead of overwriting them.
IMSVA servers save these policy settings on the top of the list.
• If an Apex One Security Agent assigned with a Apex Central policy
has been moved to another Apex One domain, the agent settings
will temporarily change to the ones defined by that Apex One
domain. Once Apex Central enforces the policy again, the agent
settings will comply with the policy settings.

Filtering by Criteria
Use this option to allocate endpoints automatically based on the filtering
criteria.
This option:• Is only available on the following managed products:• Apex One (Mac)• Apex One Data Loss Prevention• Apex One Security Agent• Mobile Security for Enterprise• Trend Micro Endpoint Application Control• Uses a filter to automatically assign current and future targets to thepolicy• Is useful for deploying standard settings to a group of targets
Administrators can change the priority of filtered policies in the policy list.
When an administrator reorders the policy list, Apex Central re-assigns the

2-5Trend Micro Apex Central™ Widget and Policy Management Guidetargets to different filtered policies based on the target criteria and the user
roles of each policy creator.
Apex Central can only assign endpoints without policies to a new filteredpolicy. To re-allocate an endpoint already assigned to a filtered policy, moveanother filtered policy with the matching criteria up the priority list.
See Assigning Endpoints to Filtered Policies on page 2-7 for more information
on how Apex Central assign targets to filtered policies.
Procedure
1.

On the Create Policy screen, go to the Targets section, select Filter byCriteria, and then click Set Filter.
The Filter by Criteria screen appears.

2.

Select the following options and define the criteria.
Criteria

Description

Match keywords in

Define keywords based on the host name or Apex Central display
name.
Note
Apex Central performs partial matching for single
keyword searches. You can search multiple, commaseparated keywords, however,Apex Central only provides
full string matches for each keyword provided.

2-6

Policy Management

Criteria
IP addresses

Description
Define a range of IP addresses and click Add.
Note
• Policy management only supports IPv4 addresses.
• When a new managed product or endpoint registers
to Apex Central, it takes about an hour for the
managed product or endpoint to become available
for searching by IP address.

Operating systems

Select one or more operation systems from the drop-down list.

Directories

Select one of the following directories and define the criteria.
• Product Directory: Select folders from the Product Directory
structure• Active Directory: Select organizational units from an
integrated Active Directory structure• Apex One domain hierarchy: Type at least one Apex One
domain hierarchy keyword

3.

Click Save.
The Create Policy screen reloads.

Assigning Endpoints to Filtered Policies
When a new endpoint registers to Apex Central, it goes through the filteredpolicies in the list in descending order. Apex Central assigns the new
endpoint to a filtered policy when the following conditions are both satisfied:• The new endpoint matches the target criteria in the policy• The policy creator has the permission to manage the new endpoint
The same action applies to an endpoint already assigned to a policy, but thepolicy creator later deletes the policy.

2-7Trend Micro Apex Central™ Widget and Policy Management Guide

Note
For endpoints just registered to Apex Central and for those just released fromdeleted policies, there is a three-minute grace period during which noendpoint allocation occurs. These endpoints are temporarily without policies
during this period.

If an endpoint does not meet the target criteria in any filtered policies, theendpoint does not associate with any policies. Apex Central allocates these
endpoints again when the following actions occur:• Create a new filtered policy• Edit a filtered policy• Reorder the filtered policies• Daily endpoint allocation schedule
Apex Central uses a daily endpoint allocation schedule to ensure that
endpoints are assigned to the correct policies. This action occurs once at
3:15 pm every day. When endpoint properties change, such as theoperating system or IP address, these endpoints require the dailyschedule to re-assign them to the correct policies.
Note• If the endpoints are offline during the daily endpoint allocation
schedule, the policy status for these endpoints will remain pending
until they go online.
• If the Apex One domain of the endpoint is changed, Apex Central
deploys the updated the policy after 10 minutes.

When the above actions occur, Apex Central allocate endpoints based on thefollowing conditions:

2-8

Policy Management

Table 2-1. Endpoint Allocation for Filtered Policies
New endpoints or
endpoints fromdeleted policies

Endpoints without
policies

Endpoints with
policies

Create a new policy
Edit a policy
Reorder the filtered policies
Daily endpoint allocation
schedule

Specifying Policy Targets
Use this option to select specific endpoints or managed products.
This option:• Uses the search or browse function to locate specific targets andmanually assigns them to the policy• Is useful when administrators plan to deploy specific settings only to acertain targets• Remains static on the top of the policy list and takes priority over any
filtered policies

Procedure
1.

On the Create Policy screen, go to the Targets section, select Specify
Target(s), and then click Select.
The Specify Targets screen appears.

2.

Use Search or Browse to locate the targets.
• Search: Use the following search criteria to find endpoints or
managed products. The search results display the endpoints or
managed products matching all of the selected criteria.

2-9Trend Micro Apex Central™ Widget and Policy Management Guide• Match keywords in: Define keywords based on the host nameor Apex Central display name.
• IP addresses: Define a range of IP addresses and click Add.
Note
• Policy management only supports IPv4 addresses.
• When a new managed product or endpoint registers toApex Central, it takes about an hour for the managed
product or endpoint to become available for search by IP
address.

• Operating systems: Select one or more operating systems fromthe drop-down.
• Browse: Browse the Product Directory or Active Directory to locate
endpoints or managed products to assign to the policy.
3.

Select the endpoints or managed products and then click Add Selected
Targets.

4.

Wait for the numbers in View Action List and View Results to change.

5.

Click OK.
The Create Policy screen reloads.

Working with Parent Policy Settings
Apex Central administrators who create a parent policy for an Apex One
Agent can configure certain policy settings to be inherited, customized, or
extended.
Note
These options are not available on other managed products.

• Inherit from parent
2-10

Policy Management• A child policy administrator cannot change the setting at all. An
Apex One administrator can manually change the setting from theApex One server console. However, the setting will be overwritten
when Apex Central deploys policies to the Apex One server.
For example, a Apex Central administrator can create a parent
policy that enforces the exclusion of PDF files from a Manual Scan.
• Changes to the setting on the parent policy are always enforced on
the child policy.
• If the permission on the parent policy changes from "Inherit fromparent" to "Are customizable" or "Extend from parent", the childpolicy administrator can customize or extend the current setting.
Changes to the setting on the parent policy are no longer enforced.
• Are customizable• A child policy can deviate from the setting configured in the parent
policy.
For example, if Scheduled Scan on the parent policy runs weekly
but is customizable, the child policy administrator can change theschedule to daily.
• Changes to the setting on the parent policy are never enforced on
the child policy.
• If the permission on the parent policy changes from "Arecustomizable" to "Inherit from parent", the current setting on theparent policy overwrites the setting on the child policy. Changes tothe setting on the parent policy are always enforced.
• Extend from parent• A child policy administrator can add to the items configured in theparent policy.
For example, if the parent policy excludes 20 file names from being
scanned during a Manual Scan, the administrator can add 10 more
safe and trustworthy files to the child policy.

2-11Trend Micro Apex Central™ Widget and Policy Management Guide• Items added or removed from the parent policy are also added or
removed from the child policy. A removed item can be added backto the child.
• If the permission on the parent policy changes from "Extend fromparent" to "Inherit from parent", items in the child policy that haveno match in the parent are removed. Changes to the items on theparent policy are always enforced.
The following table lists the parent policy settings that can be inherited,customized, or extended.
Available Options
Setting and Path

Scan schedule
Scheduled Scan Settings >Target tab > Schedule section
File extensions to scan
Manual Scan / Real-time
Scan / Scan Now / Scheduled
Scan Settings > Target tab >Files to Scan section > Fileswith the following extensions
optionScan exclusion lists(directories, files, and fileextensions to exclude fromscans)
Manual Scan / Real-time
Scan / Scan Now / Scheduled
Scan Settings > Scan
Exclusion tab

2-12Inherit
From
ParentAre
Customizable

Extend From Parent

Policy Management

Available Options
Setting and Path

Inherit
From
ParentAre
Customizable

Extend From Parent
Note
When selecting Extend
from parent from ascan exclusion list, thelist expands to show aChild Policy
Restrictions section
where the parent
policy creators can
specify items that childpolicies cannot
exclude from scans.

Copying Policy Settings
Administrators can copy the settings from an existing policy, create a newpolicy with the same settings, and deploy the settings to different endpoints
or managed products.
Note
It is not possible to copy the settings of a child Apex One Agent policy. To
determine whether the Apex One Agent policy is a child or a parent, checkthe Parent Policy column. A clickable value displays if the policy is a child,and N/A if otherwise.

Procedure
1.

Go to Policies > Policy Management.
The Policy Management screen appears.
2-13

Trend Micro Apex Central™ Widget and Policy Management Guide

2.

Select the type of product settings from the Product list.
The screen refreshes to display policies created for the selected
managed product.

3.

Select a policy from the list.

4.

Click Copy Settings.
The Copy and Create Policy screen appears.

5.

In the Policy Name field, type a name for the policy.

6.

Assign Targets to the policy.

7.

(Optional) Change settings as necessary.

8.

Click Deploy.
Note• After clicking Deploy, please wait two minutes for Apex Central to
deploy the policy to the targets. Click Refresh on the Policy
Management screen to update the status information in the policy
list.
• Apex Central enforces the policy settings on the targets every 24
hours.

Inheriting Policy Settings
Create a new child policy by inheriting the settings of an existing parent
policy. A child policy cannot be copied and its settings cannot be inherited.
This task requires a parent policy for the Apex One agent. A parent policy for
the Apex One agent has the value N/A displayed under the Parent Policy
column.
Procedure
1.
2-14

Go to Policies > Policy Management.

Policy Management

The Policy Management screen appears.
2.

Select Apex One Agent from the Product list.
The screen refreshes to display policies created for the selected
managed product.

3.

Select a parent policy that does not have locally managed settings.

4.

Click Inherit Settings.
The Inherit and Create Policy screen appears.

5.

In the Policy Name field, type a name for the policy.

6.

Assign Targets to the policy.

7.

(Optional) Review the settings that can be customized or extended andthen make changes as necessary. For a list of settings to review, see
Working with Parent Policy Settings on page 2-10.
Note
A setting cannot be customized or extended if the option selected on theparent policy is Inherit from parent.

For example:• If the Scheduled Scan setting is customizable, you can change theschedule from weekly to daily.
• If the scan exclusion list for Real-time Scan can be extended, you
can type additional file names that you deem safe and trustworthy.
After the child policy is created, it will add those file names to thescan exclusion list.
8.

Click Deploy.

2-15

Trend Micro Apex Central™ Widget and Policy Management Guide

Note• After clicking Deploy, please wait two minutes for Apex Central to
deploy the policy to the targets. Click Refresh on the Policy
Management screen to update the status information in the policy
list.
• Apex Central enforces the policy settings on the targets every 24
hours.

Modifying a Policy
Administrators can modify policy targets and settings as necessary. The rootaccount owner can modify every policy in the list, while other accountowners can only modify the policies they created. After a policy is modified,
Apex Central deploys the policy to the targets.
Important
Each managed product provides different policy settings that you canconfigure and deploy to policy targets. You can find a complete list of
supported managed products and the policy settings for each in the Apex
Central Widget and Policy Management Guide.
You can download a PDF version of the guide, or view the guide online, using
the following link:
https://docs.trendmicro.com/en-us/enterprise/apex-central.aspx

For a parent policy for the Apex One agent, if you modified the targets andsettings for specific features, the modifications will apply to all child policies
and deployed to the respective targets. Some settings on a parent policy
support permissions, which control the changes allowed on child policies.
Modifications to these parent policy permissions are also applied to childpolicies and deployed to targets. For a list of settings that support
permissions, see Working with Parent Policy Settings on page 2-10.
For example:
2-16

Policy Management• If you changed the scan schedule permission from "Inherit from parent"
to "Are customizable", administrators can start to customize the existingschedule on their child policies.
• If you changed the Manual Scan file extensions permission from "Extend
from parent" to "Inherit from parent", any file extensions thatadministrators added to child policies will be removed. In addition,
administrators will no longer be able to add file extensions.

Procedure
1.

Navigate to Policies > Policy Management.
The Policy Management screen appears.

2.

Select the type of product settings from the Product list.
The screen refreshes to display policies created for the selected
managed product.

3.

Click a policy name in the Policy column.
The Edit Policy screen appears.

4.

Modify the policy.
Note
Modifying the filtering criteria in a filtered policy can affect target
allocation. Apex Central may re-assign some targets to other filteredpolicies, or add additional targets to the current policy.

5.

Click Deploy.
It may take some time for Apex Central to deploy the policy to thetargets. Click Refresh on the Policy Management screen to update thestatus information in the policy list. If the status of the deployment
remains pending after an extended period of time, there might be issues
with the targets. Check if there is a connection between Apex Central
and the targets. Also check if the targets are working properly.

2-17Trend Micro Apex Central™ Widget and Policy Management Guide

Apex Central enforces the policy settings on the targets every 24 hours.

Importing and Exporting Policies
Export policies for backup or to import to another Apex Central server of thesame version.
Note• Apex Central exports policy settings but not policy targets.
• A parent policy stays as a parent after the export or import.
• A child policy becomes a parent after the export. Consequently, it is aparent after the import.
• Apex Central cannot import a policy if its name is the same as an existingchild policy. If the existing policy is not a child, Apex Central overwrites it
after the import.
• For more information, see the following topics:• Creating a New Policy on page 2-2• Inheriting Policy Settings on page 2-14

Procedure
1.

Go to Policies > Policy Management.
The Policy Management screen appears.

2.

Select the type of product settings from the Product list.
The screen refreshes to display policies created for the selected
managed product.

3.

To export, select one or several policies, click Export Settings, and thensave the resulting policy file.
• If you exported a single policy, the resulting file has the extension*.cmpolicy.

2-18

Policy Management• If you exported several policies, the resulting file is a compressed(*.zip) file containing the individual .cmpolicy files.
4.

To import, click Import Settings and then locate and load the policy file.
• You can import an entire *.zip file or import individual*.cmpolicy files one by one.
• If the policy already exists in the policy list, a confirmation prompt
appears, asking if you want to overwrite the existing policy.
Click OK to proceed.
The screen refreshes and displays the imported policy at the top of thelist.
For more information about reordering the policy list, see Reordering the
Policy List on page 2-24.

Deleting a Policy
Administrators can remove a policy from the list. Apex Central then reallocates the targets associated with the deleted policy if the targets match
the filtering criteria of another policy. Those without a match become
endpoints without policies, and they keep the settings defined by the deleted
policy unless a managed product administrator modifies the settings.
Apex Central only allows policy creators to delete their own policies.
However, the root account can delete every policy in the list.
It is not possible to delete an Apex One Agent parent policy with settings
inherited by an existing child policy.
Procedure
1.

Go to Policies > Policy Management.
The Policy Management screen appears.

2.

Select the type of product settings from the Product list.
The screen refreshes to display policies created for the selected
managed product.
2-19

Trend Micro Apex Central™ Widget and Policy Management Guide

3.

Select the policy to delete.

4.

Click Delete.
A confirmation screen appears.

5.

Click OK.

Changing the Policy Owner
The default owner of a policy is the user account that created the policy. You
can use the Policy Management screen to change the owner of a policy to
any Apex Central user account. You can also change the policy owner to an
Active Directory group, which designates all Active Directory users within
the group as owners of the policy.
Important
If you change the owner of a policy to a user account that does not have accessrights to the specified targets, the new owner can modify the policy settings
but cannot view the policy data.

Procedure
1.

Go to Policies > Policy Management.
The Policy Management screen appears.

2.

Select one or more policies to change the owner.

3.

Click Change Owner.
The Change Policy Owner screen appears.

4.

Select a user account from the drop-down list.

5.

Click Save to change the owner.
Apex Central sends an email notification to all user accounts assigned
the “Administrator” role.

2-20

Policy Management

Understanding the Policy List
The policy list displays the information and status of policies created by allusers. When a new endpoint registers to Apex Central, it goes through thefiltered policies in the list in descending order. Apex Central assigns the new
endpoint to a filtered policy when the following conditions are both satisfied:• The new endpoint matches the target criteria of the policy• The policy creator has the permission to manage the new endpoint
The following table describes the policy list columns that display on the
Policy Management screen. Click a column to sort the data.
Table 2-2. Policy List
ColumnPriority

Description
Displays the priority of the policies• Apex Central lists policies from the highest to the lowest priority.
• When administrators create a filtered policy, Apex Central saves
the new policy as the lowest priority policy.
• A specified policy takes priority over any filtered policies andremains on the top of the list. Administrators cannot reorderspecified policies.
• Apex Central places draft policies at the bottom of the list.

Policy

Displays the name of the policy

Policy Version

This column only appears if the selected product is Apex One
Security Agent.
Displays the latest policy version deployed
Note
Some targets might not have the latest policy version
deployed. To view the current policy deployed on specifictargets, click the number in the Deployed column.

2-21Trend Micro Apex Central™ Widget and Policy Management Guide

ColumnParent Policy

Description
This column only appears if the selected product is Apex One
Security Agent.
If a policy is a child policy (that is, it inherited its settings from a parent
policy), this column shows the name of the parent policy. Otherwise,N/A displays.

Deviations

This column only appears if the selected product is Apex One
Security Agent.
If a policy is a child policy, this column shows the number of settings
that have been changed on the policy and are therefore inconsistent
with settings on the parent policy. If settings are consistent between
the policy and its parent, 0 (zero) displays.
If a policy is not a child policy, N/A displays.

Owner

Displays the user who is currently assigned the policy
Note
The default owner is the user who created the policy.
• If you change the owner of a policy to a user account that
does not have access rights to the specified targets, thenew owner can modify the policy settings but cannot
view the policy data.
• You can also assign multiple owners by assigning thepolicy to an Active Directory group.
For more information, see Changing the Policy Owner on page2-20.

Last Editor

Displays the user who last edited the policy

Last EditedThis column only appears if the selected product is Apex One
Security Agent.
Displays when the policy was last edited

2-22

Policy Management

ColumnTargets

Description
Displays how administrators select targets for the policy.
• Specified: Uses the browse or search function to select specifictargets for the policy. Specified policies remain static on the topof the policy list and take priority over filtered policies.
• Filtered: Uses a filter to automatically assign current and future
endpoints to the policy. Administrators can rearrange the priorityof filtered policies. Hover over an item to conveniently view thefilter criteria and make adjustments as necessary.
• None: The policy creator saved the policy as a draft without
selecting any targets.

Deployed

Displays the number of targets that have applied the policy settings orhave unactivated product services
Click the number to view the policy status.

Pending

Displays the number of targets that have not applied the policy
settings
Click the number to view the policy status.

Offline

Displays the number of targets that have offline agents
Click the number to view the policy status.

With Issues

Displays the number of targets that have not applied the policy
settings due to unsupported policy deployment, no policy
configuration, system errors, endpoint communication errors with the
product server, unsupported endpoints, locally changed settings,
disabled product services, or partial deployment
Click the number to view the policy status.

Note
The numbers in Deployed and Pending columns only reflect the endpoints or
managed products that an administrator has permission to manage.

2-23

Trend Micro Apex Central™ Widget and Policy Management Guide

Reordering the Policy List
Administrators can use the Reorder button to change the order of thefiltered policies. Rearranging the policy list can affect target allocation. Apex
Central may re-assign some targets to different filtered policies.
Note• Specified policies remain static and always take priority over filteredpolicies.
• This function is only available for managing Apex One settings.

Procedure
1.

Go to Policies > Policy Management.
The Policy Management screen appears.

2.

Select the type of product settings from the Product list.
The screen refreshes to display policies created for the selected
managed product.

3.

Click Reorder.
The Reorder Policies screen appears.

4.

Rearrange the order of the Priority column.

5.

Click Save.
Note
After clicking Save, please wait two minutes for Apex Central to re-assign
the targets. Click Refresh on the Policy Management screen to update
the status information in the policy list.

2-24

Policy Management

Policy Status
Policy status allows administrators to check if Apex Central has successfully
deployed a policy to its targets.
To check the policy deployment status, use one of the following methods:• On the Policy Management screen, click a number in the policy list. The
Log Query screen appears.
• On the dashboard, click a number in the Policy Status widget. The Log
Query screen appears.
• Perform a log query
The following table provides the descriptions and suggestions about eachpolicy status:
Table 2-3. Policy Status
Policy Status

Description

Suggestions

Pending

Apex Central is processing thepolicy.

Wait a few minutes and then checkthe status again.

Without policy

Apex Central has not assigned apolicy to this endpoint or managed
product.

Assign a policy to the endpoint ormanaged product.

Deployed

Apex Central has successfully
deployed the policy.

N/A

Endpoint unable
to connect toserver• The endpoint did not receive
the policy settings.

• Check the connection status of
the endpoint• The server is currently busy.

• Connect the endpoint to thecompany network• Wait for the updated policy
status2-25

Trend Micro Apex Central™ Widget and Policy Management Guide

Policy Status

Description

Inapplicableproduct settings

The managed product cannot
process some of the policy settings.

Suggestions• Verify the policy settings• Update to the latest policy
template version• Check the settings on the
managed product• Verify the IP address of the
managed product on theManaged Servers screen
If the IP address is incorrect,
unregister and then register the
managed product again to
Apex Central.
• Refer to the Administrator's
Guide for the managed product2-26

Unsupported
endpoint

The endpoint does not support
some features specified in the policy
settings.

Upgrade the agent to a supported
version.

Settings
changed locallySome settings on the endpoint ormanaged product do not comply
with the settings specified in thepolicy because the managed
product administrator has madesome changes through the
managed product console.

Verify the settings on the managed
product console.

Unactivatedlicenses

The managed product has not
activated the licenses for some ofthe services specified in the policy
settings.

Activate the licenses for the related
services from the LicenseManagement screen on the Apex
Central console

Disabled
product services

The managed product has disabledsome of the services specified in thepolicy settings.

Enable the related services on the
managed product.

Partially
deployed

Apex Central has enforced a portionof the policy settings.

Wait a few minutes and then checkthe status again.

Policy Management

Policy Status

Description

Suggestions

Managed by[Apex Central
server name]

Another Apex Central is currently
managing the managed product.

Remove the managed product from
the Managed Server list and add the
managed product to the list again.

Invalid username orpassword

The user name or password forauthentication is incorrect.

Verify the user name or password.

Invalid productserver orauthentication
information

The server name or theauthentication information isincorrect.

Verify the server name and theauthentication information.

Unable toautomaticallylog on to
product

Apex Central cannot use the single
sign-on function to access the
managed product.

• Check the single sign-on
function in the ProductDirectory• Check the connection status of
the MCP agent• Change the server connection
type from Automatic to
Manual in the Managed
Servers list.

Web server
configurationerror

A web service error has occurred.

Product
communication
error

Unable to access the productconsole.

Check the IIS configuration.

• Check if you can connect to the
managed product's web
console.
• Check the settings of the
managed product.

Unable toconnect toproduct

Apex Central cannot establish aconnection with the managed
product.

Unsupported
product version

The managed product version is notsupported.

• Check the connection status of
the managed product.
• Check the network connection
Upgrade the managed product to asupported version.

2-27

Trend Micro Apex Central™ Widget and Policy Management Guide

Policy Status

2-28

Description

Suggestions

Network
configurationerror

A network connection error has
occurred.

Check the network connection.

System error.
Error ID: [error
ID number].

A system error has occurred.

Contact your Trend Micro support
representative.

Chapter 3

Policy Resources
This section contains information about policy resources for integrated
products/services.
Important
Each managed product provides different policy settings that you canconfigure and deploy to policy targets. You can find a complete list of
supported managed products and the policy settings for each in the Apex
Central Widget and Policy Management Guide.
You can download a PDF version of the guide, or view the guide online, using
the following link:
https://docs.trendmicro.com/en-us/enterprise/apex-central.aspx

Topics include:• Application Control Criteria on page 3-2• Data Loss Prevention on page 3-15
• Intrusion Prevention Rules on page 3-33
• Device Control Allowed Devices on page 3-37

3-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Application Control Criteria
Configure Application Control criteria that you can then assign to Security
Agent policy rules. You can create “Allow” and “Block” criteria to limit theapplications that users can execute or install on protected endpoints. You canalso create assessment criteria to monitor the applications executing on
endpoints and then refine the criteria based on the usage results.
Important
You must configure Application Control criteria before deploying an
Application Control policy to Security Agents.
Each managed product provides different policy settings that you canconfigure and deploy to policy targets. You can find a complete list of
supported managed products and the policy settings for each in the Apex
Central Widget and Policy Management Guide.
You can download a PDF version of the guide, or view the guide online, using
the following link:
https://docs.trendmicro.com/en-us/enterprise/apex-central.aspx

The following table outlines the tasks available on the Application Control
Criteria screen.

3-2

Policy Resources

Task
Add criteria

Description
Click the Add Criteria drop-down button and select from thefollowing options:• Allow: Click to define “Allow” or “Lockdown” criteria
For more information, see Defining Allowed Application Criteria on
page 3-4.
• Block: Click to define “Block” or “Assessment” criteria
For more information, see Defining Blocked Application Criteria on
page 3-6.
• Copy: Select an existing criteria and click Copy to define newcriteria based on the existing settings• Import: Click to select a ZIP package exported from a compatible
Application Control source
Note
If the imported package contains criteria names thatmatch preexisting criteria, you have the option to
Overwrite existing criteria or Skip the import of thecriteria with duplicated names.

Export criteria

Select the check box to the left of existing criteria and click Export tosave the selected criteria to a ZIP package(<timestamp>_iACRuleExport.zip)

Delete criteria

Select the check box to the left of existing criteria and click Delete toremove the selected criteria from the list
WARNING!
If you selected criteria used by existing Apex One Security
Agent policies, you must confirm that you want to delete andremove the criteria from all affected Security Agent policies.
You cannot undo this action.

3-3

Trend Micro Apex Central™ Widget and Policy Management Guide

Task
Modify criteria

Description
Click a Criteria Name to modify the criteria settings
Note
Affected endpoints receive modified criteria settings the nexttime the Security Agents connect to the server.

View policy
associations

Click the value in the Target Policies column to display a list of all
Apex One Security Agent policies that implement the criteria.
Tip
Click a policy name to open a new browser tab on which you
can view or modify the policy settings.

Defining Allowed Application Criteria
Application Control provides the ability to define criteria that specificallyallow certain applications to execute. You can define allow criteria to ensurethat Application Control never blocks a certain application, or you can create
a complete list of applications allowed to execute on endpoints and thendeploy a Lockdown policy to the endpoints. While in Lockdown mode, users
cannot execute, access, or install any application that you did not include in
the allow criteria.
For more information about Lockdown policies, see Application Control Policy
Settings.

Procedure
1.

Go to Policies > Policy Resources > Application Control Criteria.
The Application Control Criteria screen appears.

2.

Click Add Criteria and select Allow.
The Allow Criteria Settings screen appears.

3-4

Policy Resources3.

Type a unique Name for the criteria.

4.

Select the level of Trust permission for the applications.
Permission

Description

Example Use

Application
cannotexecuteexternal
processes

Applications cannot access any
external processes or start anyother applications

Use when you want to allow
standalone applications to run on
endpoints but prevent access toother processes

Application
can execute
otherprocesses

Applications can start external
processes and applications thatusers are unable to access directly

For example, this setting allows
Microsoft Word to run but
prevents embedded OLE objects
from executing.
Use when you want to allow
applications to run on endpoints
and still allow access to required
child processes or add-ons.
For example, this setting allows
Internet Explorer to run and also
allows Internet Explorer to
execute any installed plug-ins.

Inheritable
executionrights (notrecommended)

5.

Applications can install and start
external processes andapplications, and the childapplications can also install andstart external processes andapplications

Use when you want to allow
installation packages to executeon the endpoint
Inheritable execution rights(not recommended) allows theinstallation package to perform
all installation tasks and then also
allows the installed application torun all required processes.

Select the Match method used to identify applications and configure
required settings.

3-5Trend Micro Apex Central™ Widget and Policy Management Guide

MethodDescription

Application
Reputation
List

Allows you to apply the criteria to applications that Trend Micro has
tested and assigned a security score forFile paths

Allows you to apply the criteria to any application installed in thespecified location

For more information, see Application Reputation List on page 3-8.

For more information, see File Paths on page 3-9.
Certificates

Allows you to apply the criteria to applications based on certificate
validity and certificate attributes
For more information, see Certificates on page 3-13.

Hash values

Allows you to apply the criteria to applications based on SHA-1 or
SHA-256 hash values
For more information, see Hash Values on page 3-14.

Gray Software
List

Allows you to include applications to the criteria that Trend Micro has
tested and found to be potentially harmful
The Gray Software List is a subset of the Application Reputation Listand contains applications that may be malicious if not used properly.
Trend Micro recommends blocking or monitoring applications in theGray Software List to ensure that your network remains secure.

6.

Click Save.

Defining Blocked Application Criteria
Application Control provides the ability to define criteria that specifically
block certain applications from executing. You can define block criteria toensure that Application Control always blocks certain applications or you cancreate “Assessment” criteria to monitor the applications that users access.
Procedure
1.

Go to Policies > Policy Resources > Application Control Criteria.
The Application Control Criteria screen appears.

3-6

Policy Resources2.

Click Add Criteria and select Block.
The Block Criteria Settings screen appears.

3.

Type a unique Name for the criteria.

4.

To create a monitoring rule, select Enable assessment mode.
Note
Application Control logs all applications that match the assessment
criteria but takes no further action. Application Control allows theapplications to execute normally.

5.

Select the Match method used to identify applications and configure
required settings.
MethodDescription

Application
Reputation
List

Allows you to apply the criteria to applications that Trend Micro has
tested and assigned a security score forFile paths

Allows you to apply the criteria to any application installed in thespecified location

For more information, see Application Reputation List on page 3-8.

For more information, see File Paths on page 3-9.
Certificates

Allows you to apply the criteria to applications based on certificate
validity and certificate attributes
For more information, see Certificates on page 3-13.

Hash values

Allows you to apply the criteria to applications based on SHA-1 or
SHA-256 hash values
For more information, see Hash Values on page 3-14.

3-7

Trend Micro Apex Central™ Widget and Policy Management Guide

MethodDescription

Gray Software
List

Allows you to include applications to the criteria that Trend Micro has
tested and found to be potentially harmful
The Gray Software List is a subset of the Application Reputation Listand contains applications that may be malicious if not used properly.
Trend Micro recommends blocking or monitoring applications in theGray Software List to ensure that your network remains secure.

6.

Click Save.

Application Match Methods
Application Control provides multiple methods for identifying applications
to include in the allow and block criteria.
NoteApplication Control also provides the Gray Software List which you cannot
modify.
The Gray Software List is a subset of the Application Reputation List andcontains applications that may be malicious if not used properly. Trend Microrecommends blocking or monitoring applications in the Gray Software List toensure that your network remains secure.

Application Reputation List
The Application Reputation List is a comprehensive list of applications tested
by Trend Micro. The list includes most popular operating system files andbinaries as well as applications for desktops, servers, and mobile devices.
Trend Micro periodically provides updates to the list.
Important
Ensure that you have turned on regular updates to the Certified Safe Software
Pattern to stay up-to-date with the latest application information.

3-8

Policy Resources

You can search for applications by typing the name of Vendors or
Applications. Select applications using the data provided.
Data
Application

Description
The name of the application
Tip
To view detailed information for each application version, expand
the Application Reputation List.

AIR Score

A comprehensive security score based on an application's popularity andreputation

Global Usage

The global prevalence of the application
Tip
Click the prevalence to view a regional breakdown of theapplication usage.

File Paths
You can configure Application Control to specifically target certain directory
locations based on absolute path, storage type, and Perl Compatible Regular
Expressions (PCRE).
Select whether to match by a specific path or a storage type, and specify thematch string type (String or Regular Expression (PCRE)). Type the file paths
that apply to the criteria.

3-9Trend Micro Apex Central™ Widget and Policy Management Guide

Note• Application Control supports the use of the asterisk (*) wildcard when
specifying a String type match. The asterisk character can represent one
or more characters in a subdirectory of the specified string location.
• Application Control does not support the use of environment variables
when specifying file paths for String or Regular Expression (PCRE) typematches.
• You cannot use wildcard characters to indicate the entire contents of theselected storage location.
• You can specify up to 100 file paths.
Table 3-1. Supported Storage Locations
Storage
Location

Environme
nt Variable

Specific path

Notapplicable

Description
Only applies to applications in the exact path specified
Note
Application Control does not check device type whenusing this location type.

3-10

Any built-in
storage$FixedDrives

Only applies to applications in the path specified and stored
on an internal storage device (internal hard disk drive)

Any local
storage$LocalDrives

Only applies to applications in the path specified and stored
on a non-removable local storage device (internal or external
hard disk drive)Any
removable
storage$Removable
DrivesOnly applies to applications in the path specified and stored
on a removable storage device (USB drive, CD/DVD)

Network path

$RemoteDriv
es

Only applies to applications in the path specified and stored
on a shared network resource

Policy Resources

Storage
Location

Environme
nt Variable

Program Files
folder$ProgramFiles

Only applies to applications in the path specified and stored in
the Program Files folders (default folders C:\Program Filesand C:\Program Files (x86))

Systemvolume$SystemDrive

Only applies to applications in the path specified and stored in
the default Windows system drive

Description

File Path Example Usage
Goal
Monitor allusers'

Downloads

folderAllow Rule-

Block Rule
1. Enable
assessment
mode
2. Any local storage
3. String
4. C:\Users\*\Downloads\*

Results
Logs all attempts toaccess applications in
all users' Downloads
folder.
Monitors:• C:\Users\john_doe\Downloads\start.exe• C:\Users\Administrator\Downloads\start.exe

3-11Trend Micro Apex Central™ Widget and Policy Management Guide

Goal
Block allapplications
located in any
folder under
theMyApps
subfolder of
either Program
Files directory

Allow Rule-

Block Rule
1. Program Files
folders
2. String
3. \MyApps*

Results
Blocks:• C:\Program

Files(x86)\MyA
pps\start.exe• C:\Program

Files\MyApps\start.exe• C:\Program

Files(x86)\MyA
pps\bin\start.exe

Allows:• C:\Program

Files(x86)\sta
rt.exeAllow allapplications
located in any
folder under
theMyApps
subfolder of
either Program
Files directory
but Block allotherapplications/folders

1. Program Files
folders
2. String
3. \MyApps*

1. Any local storage
2. String
3. C:\Program
Files\*

Blocks:• C:\Program

Files(x86)\sta
rt.exeAllows:AND
1. Any local storage
2. String
3. C:\Program

Files (x86)\*• C:\Program

Files(x86)\MyA
pps\start.exe• C:\Program

Files\MyApps\start.exe• C:\Program

Files(x86)\MyA
pps\bin\start.exe

3-12Policy Resources

Goal

Allow Rule

Block Rule

Block only
applications
located intheMyApps
subfolder of
either Program
Files directory
but Allow all
otherapplications/folders

1. Allow thesubfolders of the
MyApps directory

1. Program Files
foldersa. Program
Files folders

2. String
3. \MyApps\*

b. String

Results
Blocks:• C:\Program

Files(x86)\MyA
pps\start.exe• C:\Program

Files\MyApps\start.exe

c. \MyApps\*

Allows:\*• C:\Program

Files(x86)\sta
rt.exe• C:\Program

Files(x86)\MyA
pps\bin\start.exe

Block a specificapplication filename in any
folder

-1. Specific path
2. Regularexpression(PCRE)
3. .*\\(?

i)test(?-i)\..*

Blocks:• C:\MyApps\test.exe• C:\Users\guet\AppData\Local\Temp\test.exe• C:\Program

Files(x86)\MyA
pps\test.exe

Certificates
You can configure Application Control to specifically target applications
based on the “trust” level of a certificate and that contain specific certificate
attributes.
Select the type of certificate “trust” level and then specify the required
certificate “Issuer” or “Subject” information.

3-13

Trend Micro Apex Central™ Widget and Policy Management Guide

Note
Application Control supports the use of the asterisk (*) wildcard when
specifying Certificate attributes, although you must use the wildcard in
conjunction with other characters to limit the scope. For example, you cannot
use only the wildcard character in any field.

The following table describes the different “trust” types.
Type

Description

Trusted (valid)

You must have included the certificate in the trusted certificates list and thecertificate must not have expired

Trusted(expired)

You must have added the certificate in the trusted certificates list but thecertificate has already expired

Untrusted

The certificate is unknown or you did not add the certificate to the trusted
certificates list

Note
The “trust” level combinations for Allow and Block criteria differ.

Hash Values
You can configure Application Control to match applications using SHA-1 or
SHA-256 hash value formats. You can choose to manually specify hash values
or import a list of generated values.
Select your Input method and follow the on-screen instructions.
Input Method
Manual

3-14

Description
Allows you to manually specify up to 100 hash values (and descriptions)Policy Resources

Input Method
ImportDescription
Allows you to import a ZIP package containing a properly formatted hashvalue list in CSV format
You can choose to use the Hash Generator tool or manually create the CSV
file using the CSV sample format.
WARNING!
You can only import one file into each set of criteria. If you attempt
to import a new hash value list into the criteria, Application
Control completely overwrites the existing values.
• Hash Generator tool: Download and execute the tool on a target
endpoint that you have installed with all necessary applications. The
tool automatically creates a valid ZIP package containing the hashvalues of all applications found on the endpoint.
• CSV sample format: Download the sample file and follow the
instructions to properly populate the hash value list. Once you havecompleted the list, compress the file in ZIP format before importing
into the set of criteria.
Important
The hash value list cannot contain a mixture of SHA-1 andSHA-256 formats. You must create separate hash value files
and separate Application Control criteria for each type of hashvalue format.

Data Loss Prevention
Data Loss Prevention (DLP) safeguards an organization's confidential andsensitive data-referred to as digital assets-against accidental disclosure andintentional theft. DLP allows you to:• Identify the digital assets to protect• Create policies that limit or prevent the transmission of digital assets
through common channels, such as email and external devices
3-15

Trend Micro Apex Central™ Widget and Policy Management Guide• Enforce compliance to established privacy standards
DLP evaluates data against a set of rules defined in policies. Policies
determine the data that must be protected from unauthorized transmission
and the action that DLP performs when it detects transmission.
Important
Each managed product provides different policy settings that you canconfigure and deploy to policy targets. You can find a complete list of
supported managed products and the policy settings for each in the Apex
Central Widget and Policy Management Guide.
You can download a PDF version of the guide, or view the guide online, using
the following link:
https://docs.trendmicro.com/en-us/enterprise/apex-central.aspx

Data Identifier Types
Digital assets are files and data that an organization must protect against
unauthorized transmission. Administrators can define digital assets using
the following data identifiers:• Expressions: Data that has a certain structure.
For details, see Expressions on page 3-17.
• File attributes: File properties such as file type and file size.
For details, see File Attributes on page 3-21.
• Keyword lists: A list of special words or phrases.
For details, see Keywords on page 3-23.
Note
Administrators cannot delete a data identifier that a DLP template is using.
Delete the template before deleting the data identifier.

3-16

Policy Resources

Expressions
An expression is data that has a certain structure. For example, credit card
numbers typically have 16 digits and appear in the format "nnnn-nnnnnnnn-nnnn", making them suitable for expression-based detections.
Administrators can use predefined and customized expressions.
For details, see Predefined Expressions on page 3-17 and Customized Expressions
on page 3-18.

Predefined Expressions
Data Loss Prevention comes with a set of predefined expressions. These
expressions cannot be modified or deleted.
Data Loss Prevention verifies these expressions using pattern matching andmathematical equations. After Data Loss Prevention matches potentiallysensitive data with an expression, the data may also undergo additionalverification checks.
For a complete list of predefined expressions, see the Data Protection Lists
document at:https://docs.trendmicro.com/en-us/enterprise/data-protection-referencedocuments.aspx.
Viewing Settings for Predefined Expressions
Note
Predefined expressions cannot be modified or deleted.

Procedure
1.

Go to Policies > Policy Resources > DLP Data Identifiers.

2.

Click the Expression tab.

3.

Click the expression name.

3-17

Trend Micro Apex Central™ Widget and Policy Management Guide

4.

View settings in the screen that opens.

Customized Expressions
Create customized expressions if none of the predefined expressions meetthe company's requirements.
Expressions are a powerful string-matching tool. Become comfortable withexpression syntax before creating expressions. Poorly written expressions
can dramatically impact performance.
When creating expressions:• Refer to the predefined expressions for guidance on how to define valid
expressions. For example, when creating an expression that includes adate, refer to the expressions prefixed with "Date".
• Note that Data Loss Prevention follows the expression formats definedin Perl Compatible Regular Expressions (PCRE). For more information
on PCRE, visit the following website:
http://www.pcre.org/• Start with simple expressions. Modify the expressions if they are causing
false alarms or fine tune them to improve detections.
Administrators can choose from several criteria when creating expressions.
An expression must satisfy the chosen criteria before Data Loss Prevention
subjects it to a DLP policy. For details about the different criteria options, see
Criteria for Customized Expressions on page 3-18.
Criteria for Customized Expressions
Table 3-2. Criteria Options for Customized Expressions
Rule

Criteria
None

None

ExampleAll - Names from US Census Bureau• Expression: [^\w]([A-Z][a-z]{1,12}(\s?,\s?|[\s]|\s([A-Z])\.\s)[A-Z][a-z]{1,12})[^\w]

3-18

Policy Resources

Criteria

Rule

Specific characters

An expression must include
the characters you havespecified.
In addition, the number ofcharacters in the expression
must be within the minimum
and maximum limits.

SuffixSuffix refers to the last
segment of an expression. A
suffix must include thecharacters you have specified
and contain a certain numberof characters.
In addition, the number ofcharacters in the expression
must be within the minimum
and maximum limits.

ExampleUS - ABA Routing Number• Expression: [^\d]([0123678]\d{8})[^\d]• Characters: 0123456789• Minimum characters: 9• Maximum characters: 9
All - Home Address• Expression: \D(\d+\s[a-z.]+\s([a-z]+\s){0,2} (lane|ln|street|st|avenue|ave|road|rd|place|pl|drive|dr|circle| cr|
court|ct|boulevard|blvd)\.? [0-9a-z,#\s\.]{0,30}[\s|,][a-z]{2}\ s\d{5}(\d{4})?)[^\d-]• Suffix characters: 0123456789• Number of characters: 5• Minimum characters in theexpression: 25• Maximum characters in theexpression: 80

Single- character
separator

An expression must have twosegments separated by acharacter. The charactermust be 1 byte in length.
In addition, the number ofcharacters left of theseparator must be within theminimum and maximum
limits. The number ofcharacters right of theseparator must not exceed
the maximum limit.

All - Email Address• Expression: [^\w.]([\w\.]{1,20}@[az0-9]{2,20}[\.][a-z]{2,5}[a-z\.]{0,10})[^\w.]• Separator: @• Minimum characters to the left: 3• Maximum characters to the left: 15• Maximum characters to the right: 30

3-19

Trend Micro Apex Central™ Widget and Policy Management Guide

Creating a Customized Expression

Procedure
1.

Go to Policies > Policy Resources > DLP Data Identifiers.

2.

Click the Expression tab.

3.

Click Add.
A new screen displays.

4.

Type a name for the expression. The name must not exceed 100 bytes inlength and cannot contain the following characters:• ><*^|&?\/

5.

Type a description that does not exceed 256 bytes in length.

6.

Type the displayed data.
For example, if you are creating an expression for ID numbers, type asample ID number. This data is used for reference purposes only andwill not appear elsewhere in the product.

7.

Choose one of the following criteria and configure additional settings
for the chosen criteria (see Criteria for Customized Expressions on page3-18):• None• Specific characters• Suffix• Single-character separator

8.

Test the expression against an actual data.
For example, if the expression is for a national ID, type a valid ID
number in the Test data text box, click Test, and then check the result.

9.

3-20

Click Save if you are satisfied with the result.

Policy Resources

Note
Save the settings only if the testing was successful. An expression thatcannot detect any data wastes system resources and may impact
performance.
Importing Customized Expressions

Use this option if you have a properly-formatted .dat file containing theexpressions. You can generate the file by exporting the expressions fromeither the server you are currently accessing or from another server.
Procedure
1.

Go to Policies > Policy Resources > DLP Data Identifiers.

2.

Click the Expression tab.

3.

Click Import and then locate the .dat file containing the expressions.

4.

Click Open.
A message appears, informing you if the import was successful. If an
expression to be imported already exists, it will be skipped.

File Attributes
File attributes are specific properties of a file. You can use two file attributes
when defining data identifiers, namely, file type and file size. For example, asoftware development company may want to limit the sharing of thecompany's software installer to the R&D department, whose members are
responsible for the development and testing of the software. In this case, theApex Central administrator can create a policy that blocks the transmissionof executable files that are 10 to 40 MB in size to all departments except R&D.
By themselves, file attributes are poor identifiers of sensitive files.
Continuing the example in this topic, third-party software installers sharedby other departments will most likely be blocked. Trend Micro therefore
recommends combining file attributes with other DLP data identifiers for amore targeted detection of sensitive files.
3-21

Trend Micro Apex Central™ Widget and Policy Management Guide

For a complete list of supported file types, see the Data Protection Lists
document at:https://docs.trendmicro.com/en-us/enterprise/data-protection-referencedocuments.aspx.

Creating a File Attribute List
Procedure
1.

Go to Policies > Policy Resources > DLP Data Identifiers.

2.

Click the File Attribute tab.

3.

Click Add.
A new screen displays.

4.

Type a name for the file attribute list. The name must not exceed 100
bytes in length and cannot contain the following characters:• ><*^|&?\/

5.

Type a description that does not exceed 256 bytes in length.

6.

Select your preferred true file types.

7.

If a file type you want to include is not listed, select File extensions andthen type the file type’s extension. Data Loss Prevention checks files
with the specified extension but does not check their true file types.
Guidelines when specifying file extensions:• Each extension must start with an asterisk (*), followed by a period(.), and then the extension. The asterisk is a wildcard, which
represents a file’s actual name. For example, *.pol matches
12345.pol and test.pol.
• You can include wildcards in extensions. Use a question mark (?) to
represent a single character and an asterisk (*) to represent two or
more characters. See the following examples:- *.*m matches the following files: ABC.dem, ABC.prm, ABC.sdcm

3-22

Policy Resources- *.m*r matches the following files: ABC.mgdr, ABC.mtp2r,
ABC.mdmr- *.fm? matches the following files: ABC.fme, ABC.fml, ABC.fmp• Be careful when adding an asterisk at the end of an extension as thismight match parts of a file name and an unrelated extension. For
example: *.do* matches abc.doctor_john.jpg andabc.donor12.pdf.
• Use semicolons (;) to separate file extensions. There is no need to
add a space after a semicolon.
8.

Type the minimum and maximum file sizes in bytes. Both file sizes must
be whole numbers larger than zero.

9.

Click Save.

Importing a File Attribute List
Use this option if you have a properly-formatted .dat file containing the fileattribute lists. You can generate the file by exporting the file attribute lists
from either the server you are currently accessing or from another server.
Procedure
1.

Go to Policies > Policy Resources > DLP Data Identifiers.

2.

Click the File Attribute tab.

3.

Click Import and then locate the .dat file containing the file attributelists.

4.

Click Open.
A message appears, informing you if the import was successful. If a fileattribute list to be imported already exists, it will be skipped.

Keywords
Keywords are special words or phrases. You can add related keywords to a
keyword list to identify specific types of data. For example, "prognosis",
3-23

Trend Micro Apex Central™ Widget and Policy Management Guide"blood type", "vaccination", and "physician" are keywords that may appear ina medical certificate. If you want to prevent the transmission of medical
certificate files, you can use these keywords in a DLP policy and thenconfigure Data Loss Prevention to block files containing these keywords.
Commonly used words can be combined to form meaningful keywords. For
example, "end", "read", "if", and "at" can be combined to form keywords
found in source codes, such as "END-IF", "END-READ", and "AT END".
You can use predefined and customized keyword lists. For details, see
Predefined Keyword Lists on page 3-24 and Customized Keyword Lists on page
3-25.

Predefined Keyword Lists
Data Loss Prevention comes with a set of predefined keyword lists. These
keyword lists cannot be modified or deleted. Each list has its own built-in
conditions that determine if the template should trigger a policy violation.
For details about the predefined keyword lists in Data Loss Prevention, see
the Data Protection Lists document at:https://docs.trendmicro.com/en-us/enterprise/data-protection-referencedocuments.aspx

How Keyword Lists Work
Number of Keywords Condition

Each keyword list contains a condition that requires a certain number of
keywords be present in a document before the list triggers a violation.
The number of keywords condition contains the following values:• All: All of the keywords in the list must be present in the document.
• Any: Any one of the keywords in the list must be present in the
document.
• Specific number: There must be at least the specified number of
keywords in the document. If there are more keywords in the document
than the number specified, Data Loss Prevention triggers a violation.
3-24

Policy Resources

Distance Condition

Some of the lists contain a “distance” condition to determine if a violation ispresent. “Distance” refers to the amount of characters between the firstcharacter of one keyword and the first character of another keyword.
Consider the following entry:
First Name:_John_ Last Name:_Smith_
The Forms - First Name, Last Name list has a “distance” condition of fifty(50) and the commonly used form fields of “First Name” and “Last Name”. In
the example above, Data Loss Prevention triggers a violation as the numberof characters between the “F” in First Name and the “L” in Last Name isequal to eighteen (18).
For an example of an entry that does not trigger a violation, consider thefollowing:
The first name of our new employee from Switzerland is John. His last
name is Smith.
In this example, the number of characters between the “f” in “first name”
and the “l” in “last name” is sixty-one (61). This exceeds the distancethreshold and does not trigger a violation.

Customized Keyword Lists
Create customized keyword lists if none of the predefined keyword lists
meets your requirements.
There are several criteria that you can choose from when configuring a
keyword list. A keyword list must satisfy your chosen criteria before Data
Loss Prevention subjects it to a policy. Choose one of the following criteria
for each keyword list:• Any keyword• All keywords• All keywords within <x> characters• Combined score for keywords exceeds threshold

3-25

Trend Micro Apex Central™ Widget and Policy Management Guide

For details regarding the criteria rules, see Customized Keyword List Criteria
on page 3-26.
Customized Keyword List Criteria
Table 3-3. Criteria for a Keyword List
Criteria

Rule

Any keyword

A file must contain at least one keyword in the keyword list.

All keywords

A file must contain all the keywords in the keyword list.

All keywords
within <x>characters

A file must contain all the keywords in the keyword list. In addition, eachkeyword pair must be within <x> characters of each other.
For example, your 3 keywords are WEB, DISK, and USB and the number ofcharacters you specified is 20.
If Data Loss Prevention detects all keywords in the order DISK, WEB, andUSB, the number of characters from the "D" (in DISK) to the "W" (in WEB)and from the "W" to the "U" (in USB) must be 20 characters or less.
The following data matches the criteria: DISK####WEB############USB
The following data does not match the criteria:
DISK*******************WEB****USB(23 characters between "D" and "W")
When deciding on the number of characters, remember that a small
number, such as 10, usually results in a faster scanning time but only covers
a relatively small area. This may reduce the likelihood of detecting sensitive
data, especially in large files. As the number increases, the area covered also
increases but scanning time might be slower.

3-26

Policy Resources

Criteria
Combinedscore forkeywords
exceeds
threshold

Rule
A file must contain one or more keywords in the keyword list. If only one
keyword was detected, its score must be higher than the threshold. If there
are several keywords, their combined score must be higher than thethreshold.
Assign each keyword a score of 1 to 10. A highly confidential word or phrase,such as "salary increase" for the Human Resources department, should havea relatively high score. Words or phrases that, by themselves, do not carrymuch weight can have lower scores.
Consider the scores that you assigned to the keywords when configuring thethreshold. For example, if you have five keywords and three of those
keywords are high priority, the threshold can be equal to or lower than the
combined score of the three high priority keywords. This means that thedetection of these three keywords is enough to treat the file as sensitive.

Creating a Keyword List

Procedure
1.

Go to Policies > Policy Resources > DLP Data Identifiers.

2.

Click the Keyword tab.

3.

Click Add.
A new screen displays.

4.

Type a name for the keyword list. The name must not exceed 100 bytes
in length and cannot contain the following characters:• ><*^|&?\/

5.

Type a description that does not exceed 256 bytes in length.

6.

Choose one of the following criteria and configure additional settings
for the chosen criteria:• Any keyword• All keywords• All keywords within <x> characters
3-27

Trend Micro Apex Central™ Widget and Policy Management Guide• Combined score for keywords exceeds threshold7.

8.

To manually add keywords to the list:a.

Type a keyword that is 3 to 40 bytes in length and specify whether it
is case-sensitive.

b.

Click Add.

To add keywords by using the "import" option:
Note
Use this option if you have a properly-formatted .csv file containing the
keywords. You can generate the file by exporting the keywords fromeither the server you are currently accessing or from another server.

a.

Click Import and then locate the .csv file containing the keywords.

b.

Click Open.
A message appears, informing you if the import was successful. If a
keyword to be imported already exists in the list, it will be skipped.

9.

To delete keywords, select the keywords and click Delete.

10. To export keywords:
Note
Use the "export" feature to back up the keywords or to import them toanother server. All keywords in the keyword list will be exported. It is notpossible to export individual keywords.

a.

Click Export.

b.

Save the resulting .csv file to your preferred location.

11. Click Save.

3-28

Policy Resources

Importing a Keyword List

Use this option if you have a properly-formatted .dat file containing the
keyword lists. You can generate the file by exporting the keyword lists fromeither the server you are currently accessing or from another server.
Procedure
1.

Go to Policies > Policy Resources > DLP Data Identifiers.

2.

Click the Keyword tab.

3.

Click Import and then locate the .dat file containing the keyword lists.

4.

Click Open.
A message appears, informing you if the import was successful. If a
keyword list to be imported already exists, it will be skipped.

Data Loss Prevention Templates
A DLP template combines DLP data identifiers and logical operators (And,Or, Except) to form condition statements. Only files or data that satisfy acertain condition statement will be subject to a DLP policy.
For example, a file must be a Microsoft Word file (file attribute) AND must
contain certain legal terms (keywords) AND must contain ID numbers(expressions) for it to be subject to the "Employment Contracts" policy. This
policy allows Human Resources personnel to transmit the file throughprinting so that the printed copy can be signed by an employee.
Transmission through all other possible channels, such as email, is blocked.
You can create your own templates if you have configured DLP data
identifiers. You can also use predefined templates. For details, see Customized
DLP Templates on page 3-30 and Predefined DLP Templates on page 3-30.
Note
It is not possible to delete a template that is being used in a DLP policy.
Remove the template from the policy before deleting it.

3-29

Trend Micro Apex Central™ Widget and Policy Management Guide

Predefined DLP Templates
Data Loss Prevention comes with the following set of predefined templates
that you can use to comply with various regulatory standards. These
templates cannot be modified or deleted.
• GLBA: Gramm-Leach-Billey Act• HIPAA: Health Insurance Portability and Accountability Act• PCI-DSS: Payment Card Industry Data Security Standard• SB-1386: US Senate Bill 1386
• US PII: United States Personally Identifiable Information
For a detailed list on the purposes of all predefined templates, and examplesof data being protected, see the Data Protection Lists document at:https://docs.trendmicro.com/en-us/enterprise/data-protection-referencedocuments.aspx

Customized DLP Templates
Create your own templates if you have configured data identifiers. A templatecombines data identifiers and logical operators (And, Or, Except) to form
condition statements.
For more information and examples on how condition statements andlogical operators work, see Condition Statements and Logical Operators on page3-30.

Condition Statements and Logical Operators
Data Loss Prevention evaluates condition statements from left to right. Use
logical operators carefully when configuring condition statements. Incorrect
usage leads to an erroneous condition statement that will likely produce
unexpected results.
See the examples in the following table.

3-30

Policy Resources

Table 3-4. Sample Condition Statements
Condition Statement

Interpretation and Example[Data Identifier1] And [Data
Identifier 2] Except [Data
Identifier 3]

A file must satisfy [Data Identifier 1] and [Data Identifier 2] but
not [Data Identifier 3].
For example:
A file must be [an Adobe PDF document] and must contain [anemail address] but should not contain [all of the keywords inthe keyword list].

[Data Identifier 1] Or [Data
Identifier 2]

A file must satisfy [Data Identifier 1] or [Data Identifier 2].
For example:
A file must be [an Adobe PDF document] or [a Microsoft Word
document].

Except [Data Identifier 1]

A file must not satisfy [Data Identifier 1].
For example:
A file must not be [a multimedia file].

As the last example in the table illustrates, the first data identifier in thecondition statement can have the "Except" operator if a file must not satisfy
all of the data identifiers in the statement. In most cases, however, the firstdata identifier does not have an operator.

Creating a Template
Procedure
1.

Go to Policies > Policy Resources > DLP Templates.

2.

Click Add.
A new screen displays.

3.

Type a name for the template. The name must not exceed 100 bytes inlength and cannot contain the following characters:• ><*^|&?\/
3-31

Trend Micro Apex Central™ Widget and Policy Management Guide

4.

Type a description that does not exceed 256 bytes in length.

5.

Select data identifiers and then click the "add" icon.
When selecting definitions:• Select multiple entries by pressing and holding the CTRL key andthen selecting the data identifiers.
• Use the search feature if you have a specific definition in mind. You
can type the full or partial name of the data identifier.
• Each template can contain a maximum of 30 data identifiers.

6.

To create a new expression, click Expressions and then click Add new
expression. In the screen that appears, configure settings for the
expression.

7.

To create a new file attribute list, click File attributes and then click Add
new file attribute. In the screen that appears, configure settings for the
file attribute list.

8.

To create a new keyword list, click Keywords and then click Add new
keyword. In the screen that appears, configure settings for the keyword
list.

9.

If you selected an expression, type the number of occurrences, which isthe number of times an expression must occur before Data Loss
Prevention subjects it to a policy.

10. Choose a logical operator for each definition.
Note
Use logical operators carefully when configuring condition statements.
Incorrect usage leads to an erroneous condition statement that will likely
produce unexpected results. For examples of correct usage, see Condition
Statements and Logical Operators on page 3-30.

11. To remove a data identifier from the list of selected identifiers, click thetrash bin icon.

3-32Policy Resources

12. Below Preview, check the condition statement and make changes if thisis not your intended statement.
13. Click Save.

Importing Templates
Use this option if you have a properly-formatted .dat file containing thetemplates. You can generate the file by exporting the templates from either
the server you are currently accessing or from another server.
Procedure
1.

Go to Policies > Policy Resources > DLP Templates.

2.

Click Import and then locate the .dat file containing the templates.

3.

Click Open.
A message appears, informing you if the import was successful. If atemplate to be imported already exists, it will be skipped.

Intrusion Prevention Rules
The Intrusion Prevention Rules screen displays the Intrusion Prevention
Rules supported by Apex Central Vulnerability Protection. Intrusion
Prevention Rules examine the actual content of network packets (andsequences of packets). Based on the conditions set within the Intrusion
Prevention Rule, various actions are then carried out on these packets. These
actions include replacing specifically defined or suspicious byte sequences,or completely dropping packets and resetting the connection.
• To filter the list of rules, use the Search box to specify full or partial
strings that appear in any of the columns.
• To sort the list of Intrusion Prevention Rules by column data, click acolumn heading.
• To view detailed Intrusion Prevention Rule Properties, click the link in
the Rule Name column of a rule.
3-33

Trend Micro Apex Central™ Widget and Policy Management Guide• To exclude traffic from one or more source endpoints from Vulnerability
Protection scanning, click Configure Exceptions and specify the source
IP addresses.
Note
You can add up to 100 entries to the exception list.
Note
Apex Central automatically imports/updates Intrusion Prevention Rules fromthe Apex One server during manual or scheduled component updates.
Important
Each managed product provides different policy settings that you canconfigure and deploy to policy targets. You can find a complete list of
supported managed products and the policy settings for each in the Apex
Central Widget and Policy Management Guide.
You can download a PDF version of the guide, or view the guide online, using
the following link:
https://docs.trendmicro.com/en-us/enterprise/apex-central.aspx

The following table outlines the rule information that displays on the
Intrusion Prevention Rules screen.
Column3-34

Description

Identifier

The unique identifier tag for the Intrusion Prevention Rule

Rule Name

The name of the Intrusion Prevention Rule

Application TypeThe Application Type this Intrusion Prevention Rule is grouped underPolicy Resources

ColumnSeverity

Description
The severity level that Trend Micro assigns to the rule
Note
The severity of a rule has no effect on how the rule is
implemented or applied. Severity levels can be useful assorting criteria when viewing a list of Intrusion Prevention
Rules.

Mode

The network engine detection mode used by the Intrusion Prevention
module. Click a mode to configure the setting for the rule.

Type

The type of vulnerability detected:• Smart: Known or unknown (for example, zero-day) vulnerability• Exploit: Known exploit (usually signature based) for a known
vulnerability• Vulnerability: Known vulnerability for which one or more
exploits may exist

CVE

The Common Vulnerabilities and Exposures (CVE®) identifier that
MITRE assigns to the vulnerability
For more information, see http://cve.mitre.org/.

Microsoft

The Common Vulnerabilities and Exposures (CVE®) identifier that
Microsoft assigns to the vulnerability

CVSS Score

The Common Vulnerability Scoring System (CVSS) severity score of thevulnerability according the National Vulnerability Database
For more information, see http://nvd.nist.gov/cvss.cfm.

Last Updated

The date and time the rule was last modified

Intrusion Prevention Rule Properties
The Intrusion Prevention Rule Properties screen displays detailed
information about a specific Intrusion Prevention Rule and vulnerability.
Click the General tab or the Vulnerability to view details about the rule.

3-35

Trend Micro Apex Central™ Widget and Policy Management Guide

The following tables describe the information provided on the General tab
and Vulnerability tab.
Table 3-5. General Information
Data

Description

Identifier

The unique identifier tag for the Intrusion Prevention RuleName

The name of the Intrusion Prevention Rule

Description

The description of the Intrusion Prevention Rule
Note
Apex One Vulnerability Protection does not support theconfiguration options available on the standalone version ofTrend Micro Vulnerability Protection.

Application TypeThe Application Type this Intrusion Prevention Rule is grouped underPriority

The priority level of the Intrusion Prevention Rule. Higher priority rules
are applied before lower priority rules.

Severity

The severity level that Trend Micro assigns to the rule
Note
The severity of a rule has no effect on how the rule is
implemented or applied. Severity levels can be useful assorting criteria when viewing a list of Intrusion Prevention
Rules.

Mode

3-36

The network engine detection mode used by the Intrusion Prevention
module. Click a mode to configure the setting for the rule.

Policy Resources

Data
Type

Description
The type of vulnerability detected:• Smart: Known or unknown (for example, zero-day) vulnerability• Exploit: Known exploit (usually signature based) for a known
vulnerability• Vulnerability: Known vulnerability for which one or more
exploits may exist

IssuedThe date the rule was released (not downloaded)

Last Updated

The date and time the rule was last modified

Table 3-6. Vulnerability Information
Data

Description

Severity

The severity level of the vulnerability

CVSS Score

The Common Vulnerability Scoring System (CVSS) severity score of thevulnerability according the National Vulnerability Database
For more information, see http://nvd.nist.gov/cvss.cfm.

Description

The description of the vulnerability

External References

Provides links to external references for more information about thevulnerability

Device Control Allowed Devices
Import or export lists of Device Control Allow Devices that apply to all Apex
One Security Agent policy targets.

3-37

Trend Micro Apex Central™ Widget and Policy Management Guide

Note• Only Security Agents with Data Protection enabled override the “Block”
or “Read” action on devices added to the Device Control Allowed Devices
list.
• The Device Control Allowed Devices list does not apply to Security Agents
without Data Protection and Security Agents with Device Control
permission not set to “Block” or “Read”.
Item
ImportDescription
Select a properly formatted CSV file containing a list of all the devices
you want to allow on all Apex One Security Agent endpoints.
Important
Importing a new list overwrites the previous list completely.
To retain the existing list, export the list before importing a
new CSV file.

3-38

Last imported

The date/time the server imported the current list

Total allowed devices

The total number of allowed devices in the currently applied list

ExportExports the current allowed list in CSV format

Part II
Apex Central Widgets

Chapter 4

Apex Central Dashboard Widgets
This section contains help topics for the dashboard widgets specific to theApex Central management console dashboard.
Topics include:

4-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Apex Central Top File-based Threats Widgets
This widget tracks the distribution of the top malicious files detected on
endpoints across the network and displays the product-detected distribution
as one of the top 10/25/50 file-based threats (viruses and spyware/grayware).
Click any node in the graph to open a screen that displays detailed
information. Apex Central performs log query to provide the detailed
information.
Specify the date range for the data that the widget displays:• Today• 1 Week• 2 Weeks• 1 Month
Specify the threat for the widget to display. The widget can display data for
only one file-based threat at a time. By default the widget displays data fromall the managed products that a user's account privileges allow.
Click the widget settings icon on the widget to access additional settings.
Setting

Description

Title

Specify a new and meaningful title for the widget in the field.

ScopeSpecify the data scope displayed by the widget.
The scope determines the products which the widget uses to display
data.

Top ThreatsSpecify the number of threats to display.

Click Save to apply changes and update the widget data.

Endpoint Protection Verification Widget
This widget displays the Apex One and Deep Security protection status ofendpoints from an integrated Active Directory structure.
4-2

Apex Central Dashboard Widgets

Important
Before using this widget:• Synchronize the Apex One client tree with the Active Directory tree.
Refer to the Apex One documentation for further instructions.
• Go to Administration > Settings > Endpoint Protection Verification to
enable the widget and configure Active Directory server, Apex One server,and Deep Security server connection settings.

Click the settings icon (>) to configure the following:• Apex One servers: Click the browse button (servers that contribute data for the widget.

) to specify the Apex One• Deep Security servers: Click the browse button ( ) to specify the Deep
Security servers that contribute data for the widget.
• Columns: Specify the columns for the widget to display in the data table.
Click an organization unit in the Active Directory structure to view thefollowing the information.
Description

ColumnComputer

Displays the endpoint name

Apex One

Displays whether the endpoint is protected by an Apex One or VDI
clientDeep Security

Displays whether the endpoint is protected by a Deep Security agent

Physical Host

Displays the physical server where virtual endpoints reside

Pattern

Displays the version of the pattern file that the Apex One or VDI client
uses

Scan Engine

Displays the version of the scan engine that the Apex One or VDI client
uses

Client Version

Displays the client program version

4-3

Trend Micro Apex Central™ Widget and Policy Management Guide

ColumnDescription

Deep Security Profile

Displays the Deep Security profile in use

Server Name

Displays the Apex One and/or Deep Security server with which theendpoints connect

Hosts with C&C Callback Attempts Widget
This widget displays the total unique compromised hosts and groups them by
C&C list source.
The default view displays data for the current day.
Use the Range drop-down to select the time period for the data that displays.
You can view data for Today, 1 week, 2 weeks, or 1 month.
Data

Description

Hosts matched with Global Intelligence

C&C callbacks detected by Trend Micro Global
Intelligence network, including SmartProtection Network.

Hosts matched with dynamic analyzers

C&C callbacks detected by dynamic analyzers,
including Virtual Analyzer and the Network
Content Inspection Engine.
Analyzers are built in to products such as
Deep Discovery Inspector and Apex One.

Hosts matched with user-defined lists inmanaged products

C&C callbacks detected by products using auser-defined list.
An example of a user-defined list is the Deny
List in Deep Discovery Inspector.

Policy Status
This widget displays the deployment status of your policies.
Clicking the name of a policy or the number of targets opens a new Log
Query screen to provide detailed information.

4-4

Apex Central Dashboard Widgets

Data

Description

Policy

Displays the name of the policy

Deployment Status

Displays the percentage of targets that comply with the policy settings

Deployed

Displays the number of targets that have applied the policy settings orhave unactivated product services

Pending

Displays the number of targets that have not applied the policy
settings
Note
If Hotfix 2575 is not installed, the Pending column includes
the number of targets that have offline agents.

Offline

Displays the number of targets that have offline agents
Important
This feature requires installing Hotfix 2575. Otherwise, thePending column includes the number of targets that haveoffline agents and the Offline column does not display.

With Issues

Displays the number of targets that have not applied the policy
settings due to unsupported policy deployment, no policy
configuration, system errors, endpoint communication errors with the
product server, unsupported endpoints, locally changed settings,
disabled product services, or partial deployment

Endpoints/Products
without policies

Displays the number of endpoints or managed products with no policy
appliedTotal endpoints/
products

Displays the number of endpoints or managed products theadministrator can manage

Quick LaunchThis widget displays shortcuts to the Product Directory and Policy
Management.

4-5

Trend Micro Apex Central™ Widget and Policy Management Guide

Unique Compromised Hosts Over Time Widget
This widget displays the unique compromised hosts logged by managed
products within the last 30 days.
This widget groups and displays the unique compromised hosts as circles.
The circle size relatively represents the number of compromised hosts.
• Small: 1 to 5
• Medium: 6 to 10• Large: 11 or more
Mouse-over a computer icon or host name to display additional
compromised hosts.
Use the Callback address drop-down to display compromised hosts that had
callback attempts to the selected callback address.
Note
The Callback address drop-down contains the top 25 callback addresses.
The widget only displays the first callback attempt from a compromised hostto the selected callback address.

Change the managed products that the widget uses as its source by clicking
the settings icon ( > ). In the dialog box that appears, specify the Scopeby clicking
and selecting the managed products to use as the source.

4-6

Part III
Apex One Widgets

Chapter 5

Apex One Dashboard Widgets
This section describes the available Apex One dashboard widgets in Apex
Central.
Topics include:

5-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Attack Discovery Detections Widget
This widget displays the detection logs generated by the Endpoint Sensor
Attack Discovery feature based on the risk level for the specified period.
Important
This feature requires that you have valid Endpoint Sensor policies deployed to
endpoints.

Click the Rule Name to display a detailed view of the detection and all the
related objects. You can trigger a Historical Investigation on all related
objects by clicking the Assess Impact button.
Note
A Historical Investigation can only perform an assessment based on specificcriteria types. If you perform a Historical Investigation from the Attack
Discovery Detections Widget, the investigation disregards objects for which nodata is available.

Quick Investigation Widget
This widget allows you to start a basic Historical Investigation across yournetwork using a single criterion type.
Important
This feature requires that you have valid Endpoint Sensor policies deployed to
endpoints.

Select the type of criteria, specify the value, and click Assess Impact. The
Historical Investigation screen appears with the assessment results.

5-2

Apex One Dashboard Widgets

Note
To perform a more complicated assessment, use the Historical Investigation
or Live Investigation screens.

Top Blocked Applications
This widget provides an overview of the top applications that users
attempted to access in violation of an Application Control policy.
Use the settings button to change the default number of applications that
display.

Top Endpoints Affected by IPS Events Widget
This widget provides information about the endpoints affected by the most
IPS events detected. IPS events are triggered by Intrusion Prevention Rules
for Vulnerability Protection.
Use the Period drop-down to select the time range for the data that displays.
Use the settings icon (endpoints to display.

>) to change the default number of affected
Description

Data
Endpoint

The name of the endpoint

IP Address

The IP address of the endpoint

Detections

The number of IPS events detected on the endpointTop IPS Attack Sources
This widget provides information about the top attack sources for IPS events
detected on your network. IPS events are triggered by Intrusion Prevention
Rules for Vulnerability Protection.
Use the Period drop-down to select the time range for the data that displays.

5-3

Trend Micro Apex Central™ Widget and Policy Management Guide

Use the settings icon (sources to display.
Data>) to change the default number of attack
Description

Attack Source

The IP address of the known attack source

Location

The location of the attack source

Detections

The number of IPS events detected on the endpointTop IPS Events
This widget provides information about the Intrusion Prevention Rules
triggering the most IPS events on your network. IPS events are triggered by
Intrusion Prevention Rules for Vulnerability Protection.
Use the Period drop-down to select the time range for the data that displays.
You can also use the second drop-down to display only the top Detected orPrevented IPS events.
Use the settings icon ( > ) to change the default number of triggered
Intrusion Prevention Rules to display.
Data

Description

Rule Name

The name of the Intrusion Prevention Rule

Severity

The severity level that Trend Micro assigns to the rule

Total

The number of IPS events triggered by the Intrusion
Prevention Rule

Top Violated Application Control Criteria
This widget provides an overview of the top Application Control criteria thatusers triggered while attempting to access unauthorized applications.
Use the settings button to change the default number of matches that display.

5-4Part IV
Apex One Server Policy Settings
This section describes how you can manage Apex One server policy settings.

Chapter 6

Apex One Server Policy Settings
This section describes how you can manage Apex One server policy settings.

6-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Configuring Endpoint Sensor Server Settings
Important• The Endpoint Sensor feature requires special licensing and additional
system requirements. Ensure that you have the correct license before
deploying Endpoint Sensor policies to endpoints. For more information
on how to obtain licenses, contact your support provider.
• Server policies only apply to on-premises Apex One servers.

Procedure1.

Select Apex One Server as the Product.

2.

Create or Edit a policy.

3.

a.

To create a policy, click Create.

b.

To edit a policy, click a policy name in the Policy column.

Configure Endpoint Sensor settings.
OptionDescription

Maximum metadatastorageSpecify the maximum size allowed for metadata storage.
Specify a size between 20 to 20480 GB. The default storage sizeis 1024 GB (1 TB). Once the metadata storage reaches this size,
the server purges old records to accommodate new ones.
Note
For Apex One with Critical Patch 9601 (or later
versions), the default storage size is 400 GB.

6-2

Apex One Server Policy Settings

OptionMaximum memory
allocation

Description
Specify the maximum amount of memory allocated to themetadata cache. Specify a size between 4 GB and 48 GB. The
new size specified must be higher than the current size. The
default allocation size is 4 GB.
Note
Memory size affects the performance of data uploads
and investigation speed. To improve performance,increase the memory size of the affected server.

4.

Click Deploy or Save.

6-3

Part V
Apex One Security Agent Policies

Chapter 7

Security Agent Program Settings
This section describes how you can manage the Security Agent program
installed on endpoints.
Topics include:• Additional Service Settings on page 7-2• Privileges and Other Settings on page 7-4• Update Agents on page 7-19

7-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Additional Service Settings
The Security Agent program requires that you enable additional services inorder to allow certain features to function properly. The following table
describes the available services and the features that require each service.
Service

Description

Unauthorized Change
Prevention Service(TMBMSRV.exe)

Regulates application
behavior and verifies
programtrustworthinessFeatures• Predictive Machine Learning• Behavior Monitoring• Device Control• Certified Safe Software Service• Agent Self-protection

Firewall Service(TmPfw.exe)

Regulates network
connection accesspermissions• Apex One Firewall

Suspicious
Connection Service

Provides advanced
protection against
C&C callbacks• User-defined IP Approved and Blocked
Lists• Global C&C IP List (Network Content
Inspection Engine)• Malware network fingerprinting(Relevance Rule Pattern)

7-2

Data Protection
Service(dsagent.exe)

Provides advanced
monitoring ofsensitive data andrestricts device
access on endpoints• Data Loss Prevention

Advanced Protection
Service(TMCCSF.exe))

Facilitates advanced
scanning andprotection features• Predictive Machine Learning• Device Control (Block access)• Data Discovery (managed using the Apex
Central console)• Browser Exploit Prevention• Behavior Monitoring

Security Agent Program Settings

Configuring Additional Security Agent Services
Procedure1.

Select to enable the required service on Windows desktops or Windows
Server platforms in the following sections:• Unauthorized Change Prevention Service• For Windows Server platforms, select Only enable services
required by Security Agent Self-protection features to ensurethat the Security Agent program stays protected without
affecting server performance.
ImportantSelecting Only enable services required by Security Agent
Self-protection features ensures that the service related to
Behavior Monitoring, Device Control, Predictive Machine
Learning (process detections), and the Certified Safe Software
Service do not run. If you want to use any of the scanningfeatures, do not enable this feature.

• Firewall Service
Important
Enabling or disabling the service temporarily disconnects endpoints
from the network. Ensure that you change the settings only during
non-critical hours to minimize connection disruptions.

• Suspicious Connection Service• Data Protection Service
Important
Enabling or disabling the service temporarily disconnects endpoints
from the network. Ensure that you change the settings only during
non-critical hours to minimize connection disruptions.

7-3

Trend Micro Apex Central™ Widget and Policy Management Guide• Advanced Protection Service
Important
Enabling additional services on Windows Server platforms may affectserver performance. After enabling a service on a Windows Server
platform, Trend Micro recommends that you monitor the server forsome time to ensure that no performance impact occurred.

Privileges and Other Settings
Configure Security Agents to grant users rights to configure personalized
settings, to display notification messages, and to protect critical Security
Agent files and services.

Configuring Agent Privileges
Procedure
1.

Configure settings as required.
SectionIndependent
Mode

Settings
Enable Independent mode: Allows users to disable the following
features on the Security Agent to prevent the Security Agent fromadversely affecting system performance:• The Security Agent does not accept policy settings from the server• The Security Agent does not initiate scan commands from theserver• The Security Agent does not send logs to the server
End users can manually initiate scans and updates on agents in
Independent mode.

7-4

Security Agent Program Settings

SectionScans

Settings• Configure Manual Scan: Allows users to configure the Manual
Scan settings on the Security Agent console• Configure Real-time Scan: Allows users to configure the Realtime Scan settings on the Security Agent console• Configure Scheduled Scan: Allows users to configure theScheduled Scan settings on the Security Agent console

Scheduled
Scans• Postpone Scheduled Scan: Allows users to postpone a
Scheduled Scan before the scan starts or stop a currently runningscan for a specified period
Note
Users can only stop a running scan once. Once the scan
restarts, the Security Agent rescans all files on theendpoint.
• Skip and stop Scheduled Scan: Allows users to skip or stop arunning Scheduled Scan one time
Note
Users cannot skip or stop a Scheduled Scan more than
one time. Even after a system restart, Scheduled Scan
resumes scanning based on the next scheduled time.

7-5

Trend Micro Apex Central™ Widget and Policy Management Guide

SectionFirewallSettings• Display the Firewall settings on the Security Agent console:
Allows users to configure the Firewall settings on the Security
Agent console• Allow users to enable/disable the firewall, Intrusion
Detection System, and the firewall violation notification
message: Displays the Enable/Disable Firewall and Enable/
Disable IDS Mode menu options on the Security Agentsystem tray icon
Note
The Apex One Firewall protects agents and servers
on the network using stateful inspection, highperformance network virus scanning, andelimination. If you grant users the privilege to enable
or disable the firewall and its features, warn themnot to disable the firewall for an extended period oftime to avoid exposing the endpoint to intrusions
and hacker attacks.
• Allow Security Agents to send firewall logs to the Apex One
server: Configures the Security Agent to send Firewall logs to theserver, allowing you to analyze network traffic

Behavior
Monitoring

Display the Behavior Monitoring settings on the Security Agentconsole: Allows users to configure the Behavior Monitoring settings
on the Security Agent console

Trusted
Program List

Display the Trusted Program List on the Security Agent console:
Allows users to configure the Trusted Program List on the Security
Agent console

Mail Scan

Display the Mail Scan settings on the Security Agent console:
Allows users to configure the Mail Scan settings on the Security AgentconsoleIf enabled, Real-time Scan can detect and take action on POP3 email
messages retrieved from the mail server that contain malicious
threats.

7-6

Security Agent Program Settings

SectionProxy Settings

Settings
Allow users to configure proxy settings: Allows users to use userconfigured proxy settings only in the following instances:• When Security Agents perform "Update Now".
• When users disable, or the Security Agent cannot detect,
automatic proxy settings.
WARNING!
Incorrect user-configured proxy settings can cause update
problems. Exercise caution when allowing users to configure
their own proxy settings.

Component
Updates• Perform "Update Now": Displays the Update Now menu option
on the Security Agent system tray icon
• Enable/Disable schedule-based updates: Displays the Enable/
Disable Schedule-based Updates menu option on the Security
Agent system tray icon
NoteAdministrators must first select the Enable schedulebased updates on Security Agents setting on the Other
Settings tab before the menu item appears on the
Security Agent menu.

7-7Trend Micro Apex Central™ Widget and Policy Management Guide

Section
Unload andUnlockSettings
The Security Agent unloading and unlocking privilege allows users to
temporarily stop the Security Agent or gain access to advanced web
console features with or without a password.
• Does not require a password• Requires a password: Type the required password andconfirmation password
Note
Passwords must meet the following complexity
requirements:• Length of 8 to 32 characters• At least one of each: uppercase (A-Z), lowercase (az), numeric (0-9), and special character• Cannot contain non-printable ASCII characters
Important
If you select Requires a password and do not specify apassword, Apex Central applies the following default
password:• For Apex One on-premises: The password provided
during server installation• For Apex One as a Service: The account name used toprovision the console

7-8Security Agent Program Settings

SectionSettings

Uninstallation

The Security Agent uninstallation privilege allows users to uninstall the
Security Agent program on local endpoints.
• Does not require a password• Requires a password: Type the required password andconfirmation password
Note
Passwords must meet the following complexity
requirements:• Length of 8 to 32 characters• At least one of each: uppercase (A-Z), lowercase (az), numeric (0-9), and special character• Cannot contain non-printable ASCII characters
Important
If you select Requires a password and do not specify apassword, Apex Central applies the following default
password:• For Apex One on-premises: The password provided
during server installation• For Apex One as a Service: The account name used toprovision the console

Configuring Other Agent Settings
Procedure
1.

Configure settings as required.

7-9

Trend Micro Apex Central™ Widget and Policy Management Guide

SectionSettings

Coexist Mode
Conversion

Permanently convert Security Agents using coexist mode into
fully-functional Security Agents: Activates all functions on Security
Agents installed in “Co-exist mode”
Important
You cannot undo this action. After converting coexist mode
Security Agents into fully-functional Security Agents, theagent program attempts to uninstall any incompatible thirdparty security software on the endpoint. After the conversion
completes, Apex One enables all necessary services andfunctions related to normal Security Agent functionality.
If you need to use a coexist mode Security Agent on aconverted endpoint, you must unistall the Security Agent
program and reinstall a coexist mode Security Agent.

UpdateSettings• Security Agents download updates from the Trend Micro
ActiveUpdate Server: Configures Security Agents that cannot
connect to the specified update source to attempt to update fromthe Trend Micro ActiveUpdate server• Enable schedule-based updates on Security Agents: Configures
all Security Agents to enable schedule-based updates by default• Security Agents only update the following components:
Controls how component updates proceed on the Security Agents• All components (including hotfixes and the agent
program): Security Agents update all components• Pattern files, engines, drivers: Security Agents do not
upgrade the Security Agent program or deploy hotfixes• Pattern files: Security Agents do not upgrade the Security
Agent program, deploy hotfixes, or update engines anddrivers

Web
Reputation
Settings

7-10

Display a notification when a website is blocked: Displays anotification message on the Security Agent after blocking a URL that
violates a Web Reputation policySecurity Agent Program Settings

SectionSettings

Behavior
Monitoring
Settings

Display a notification when a program is blocked: Displays anotification message on the Security Agent after blocking a programthat violates a Behavior Monitoring policy

C&C Contact
Alert Settings

Display a notification when a C&C callback is detected: Displays anotification message on the Security Agent after detecting a C&C
callback

CentralQuarantine
RestoreSettings

Display a notification when a quarantined file is Restored: Displays
a notification message on the Security Agent after restoring aquarantined file

Predictive
MachineLearning
Settings

Display a notification when a threat is detected: Displays anotification message on the Security Agent after Predictive Machine
Learning detects an unknown threat

Security Agent
Selfprotection• Protect Security Agent services: Prevents users or applications
from terminating Security Agent services• Protect files in the Security Agent installation folder: Preventsusers or applications from modifying or deleting files in the
Security Agent installation folder• Protect Security Agent registry keys: Prevents users orapplications from modifying, deleting, or adding registry values
used by the Security Agent program• Protect Security Agent processes: Prevents users orapplications from terminating Security Agent processes
For more information, see Security Agent Self-protection on page 7-12.

Scheduled
Scan Settings

Display a notification before a scheduled scan occurs: Displays anotification message on the Security Agent before a configured
Scheduled Scan starts

7-11

Trend Micro Apex Central™ Widget and Policy Management Guide

SectionSettings

Cache Settings
for Scans• Enable the digital signature cache: Configures the Security
Agent to use the Behavior Monitoring Digital Signature Pattern to
exclude files from Manual Scans, Scheduled Scans, and Scan Now• Enable the on-demand scan cache: Configures the Security
Agent to maintain a local on-demand scan cache to exclude fileduring Manual Scan, Scheduled Scan, and Scan Now to improvescan performance
For more information, see Cache Settings for Scans on page 7-15.

POP3 EmailScan Settings
Security Agent
AccessRestriction

Scan POP3 email: Enables POP3 mail scanning on the Security Agent
For more information, see POP3 Mail Scan on page 7-18.
Do not allow users to access the Security Agent console from thesystem tray or Windows Start menu: Disables user access to the
Security Agent console using the system tray or Windows Start menu
NoteThis setting does not disable the Security Agent. The Security
Agent runs in the background and continues to provide
protection from security risks.

RestartNotification

Display a notification if the endpoint needs to restart to finish
cleaning infected files: Displays a notification message on the
Security Agent if the user needs to restart the endpoint to finish
cleaning a malicious file

Security Agent Self-protection
Security Agent self-protection provides ways for the Security Agent to protect
the processes and other resources required to function properly. Security
Agent self-protection helps thwart attempts by programs or actual users todisable anti-malware protection.

7-12

Security Agent Program Settings

Protect Security Agent Services
Apex One blocks all attempts to terminate the following Security Agent
services:• Apex One NT Listener (TmListen.exe)• Apex One NT RealTime Scan (NTRtScan.exe)• Apex One NT Firewall (TmPfw.exe)• Trend Micro Apex One Data Protection Service (dsagent.exe)• Trend Micro Unauthorized Change Prevention Service (TMBMSRV.exe)
Note
If this option is enabled, the Security Agent may prevent third-party
products from installing successfully on endpoints. If you encounter thisissue, you can temporarily disable the option and then re-enable it after
the installation of the third-party product.

• Apex One Common Client Solution Framework (TmCCSF.exe)

Protect Files in the Security Agent Installation Folder
To prevent other programs and even the user from modifying or deleting
Security Agent files, Apex One locks the following files in the root <Agent
installation folder>:• All digitally-signed files with .exe, .dll, and .sys extensions• Some files without digital signatures, including:

7-13

Trend Micro Apex Central™ Widget and Policy Management Guide• bspatch.exe• OfceSCV.dll• bzip2.exe• OFCESCVPack.exe• INETWH32.dll• patchbld.dll• libcurl.dll• patchw32.dll• libeay32.dll• patchw64.dll• libMsgUtilExt.mt.dll• PiReg.exe• msvcm80.dll• ssleay32.dll• MSVCP60.DLL• Tmeng.dll• msvcp80.dll• TMNotify.dll• msvcr80.dll• zlibwapi.dll

Protect Security Agent Registry Keys
The Security Agent blocks all attempts to modify, delete, or add new entries
under the following registry keys and subkeys:• HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion• HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\NSC• HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\Osprey• HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\AMSP

Protect Security Agent Processes
The Security Agent blocks all attempts to terminate the processes in thefollowing table.
Process

7-14

Description

TmListen.exe

Receives commands and notifications from the Apex One server andfacilitates communication from the Security Agent to the server

NTRtScan.exe

Performs Real-time, Scheduled, and Manual Scan on Security Agents

Security Agent Program Settings

Process

Description

TmPfw.exe

Provides packet level firewall, network virus scanning, and intrusion
detection capabilities

TMBMSRV.exe

Regulates access to external storage devices and prevents
unauthorized changes to registry keys and processes

DSAgent.exe

Monitors the transmission of sensitive data and controls access todevices

PccNTMon.exe

This process is responsible for starting the Security Agent console

TmCCSF.exe

Performs Browser Exploit Prevention and memory scanning

The Security Agent can also protect against the addition of processes in theMicrosoft Software Restriction Policies (SRP). Software Restriction Policies
prevent the listed applications from running on the endpoint. To prevent theaddition of Security Agent processes in the Software Restriction Policies list:
1. Enable Protect Security Agent processes.
2. Enable the Unauthorized Change Prevention Service.

Cache Settings for Scans
The Security Agent can build the digital signature and on-demand scan cache
files to improve its scan performance. When an on-demand scan runs, theSecurity Agent first checks the digital signature cache file and then the ondemand scan cache file for files to exclude from the scan. Scanning time is
reduced if a large number of files are excluded from the scan.

Digital Signature Cache
The digital signature cache file is used during Manual Scan, Scheduled Scan,
and Scan Now. Agents do not scan files whose signatures have been added tothe digital signature cache file.
The Security Agent uses the same Digital Signature Pattern used for Behavior
Monitoring to build the digital signature cache file. The Digital Signature
Pattern contains a list of files that Trend Micro considers trustworthy andtherefore can be excluded from scans.
7-15

Trend Micro Apex Central™ Widget and Policy Management Guide

Note
Behavior Monitoring is automatically disabled on Windows server platforms.
If the digital signature cache is enabled, Security Agents on these platforms
download the Digital Signature Pattern for use in the cache and do not
download the other Behavior Monitoring components.

Agents build the digital signature cache file according to a schedule, which is
configurable from the web console. Agents do this to:• Add the signatures of new files that were introduced to the system since
the last cache file was built• Remove the signatures of files that have been modified or deleted fromthe system
During the cache building process, agents check the following folders fortrustworthy files and then adds the signatures of these files to the digital
signature cache file:• %PROGRAMFILES%• %WINDIR%
The cache building process does not affect the endpoint's performance
because agents use minimal system resources during the process. Agents arealso able to resume a cache building task that was interrupted for somereason (for example, when the host machine is powered off or when awireless endpoint's AC adapter is unplugged).

On-demand Scan Cache
The on-demand scan cache file is used during Manual Scan, Scheduled Scan,
and Scan Now. Security Agents do not scan files whose caches have been
added to the on-demand scan cache file.
Each time scanning runs, the Security Agent checks the properties of threatfree files. If a threat-free file has not been modified for a certain period oftime (the time period is configurable), the Security Agent adds the cache of
the file to the on-demand scan cache file. When the next scan occurs, the file
will not be scanned if its cache has not expired.
7-16

Security Agent Program Settings

The cache for a threat-free file expires within a certain number of days (thetime period is also configurable). When scanning occurs on or after thecache expiration, the Security Agent removes the expired cache and scans
the file for threats. If the file is threat-free and remains unmodified, thecache of the file is added back to the on-demand scan cache file. If the file isthreat-free but was recently modified, the cache is not added and the file will
be scanned again on the next scan.
The cache for a threat-free file expires to prevent the exclusion of infected
files from scans, as illustrated in the following examples:• It is possible that a severely outdated pattern file may have treated an
infected, unmodified file as threat-free. If the cache does not expire, theinfected file remains in the system until it is modified and detected by
Real-time Scan.
• If a cached file was modified and Real-time Scan is not functional during
the file modification, the cache needs to expire so that the modified filecan be scanned for threats.
The number of caches added to the on-demand scan cache file depends on
the scan type and its scan target. For example, the number of caches may beless if the Security Agent only scanned 200 of the 1,000 files in the endpoint
during Manual Scan.
If on-demand scans are run frequently, the on-demand scan cache file
reduces the scanning time significantly. In a scan task where all caches are
not expired, scanning that usually takes 12 minutes can be reduced to 1
minute. Reducing the number of days a file must remain unmodified andextending the cache expiration usually improve the performance. Since files
must remain unmodified for a relatively short period of time, more caches
can be added to the cache file. The caches also expire longer, which meansthat more files are skipped from scans.
If on-demand scans are seldom run, you can disable the on-demand scancache since caches would have expired when the next scan runs.

7-17Trend Micro Apex Central™ Widget and Policy Management Guide

POP3 Mail Scan
When Security Agents have the mail scan privileges, the Mail Scan option
displays on the Security Agent console. The Mail Scan option shows the POP3
mail scan.
The following table describes the POP3 mail scan program.
Table 7-1. Mail Scan Programs
Details
PurposePrerequisites

Description
Scans POP3 email messages for viruses/malware• Must be enabled by administrators from the web console
before users can use it
Note
You must enable the Display the Mail Scan settings
on the Security Agent console privilege to enable
POP3 mail scanning.
For more information, see Configuring Agent
Privileges on page 7-4.
• Action against viruses/malware configurable from the
Security Agent console but not from the web console

Scan types supported

Real-time Scan
Scanning is done as email messages are retrieved from the POP3
mail server.

Scan results• Information about detected security risks available afterscanning is complete• Scan results not logged on the Security Agent console's Logs
screen• Scan results not sent to the server

7-18

Security Agent Program Settings

Update Agents
To distribute the task of deploying components, domain settings, or agent
programs and hotfixes to Security Agents, assign some Security Agents to act
as Update Agents, or update sources for other Security Agents. This helps
ensure that Security Agents receive updates in a timely manner without
directing a significant amount of network traffic to the Apex One server.
If the network is segmented by location and the network link between
segments experiences a heavy traffic load, assign at least one Update Agenton each location.
Note
Security Agents assigned to update components from an Update Agent only
receive updated components and settings from the Update Agent. All Security
Agents still report their status back to the Apex One server.

Assigning Security Agents as Update Agents
Procedure1.

Select the items that Update Agents can share.
• Component updates• Domain settings• Security Agent programs and hot fixes

7-19

Chapter 8

Application Control Policy Settings
This section discusses how to configure Application Control policies on
Security Agents.
Topics include:• Application Control on page 8-2

8-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Application Control
Application Control provides you with the ability to control which users haveaccess to specific applications on certain endpoints. You have the option ofcreating an overall endpoint-based policy or, if integrated with Active
Directory, very granular user-based policies per endpoint.
After determining the scope of the policy, you can create application
matching criteria that define which applications to allow, block, or monitor.
For experienced users, you can create “Lockdown” criteria that only allow
trusted applications to execute and block all applications not explicitly
allowed by the rules.

Configuring Application Control Settings (Agent)
Before configuring an Application Control policy, ensure that you define all
required Application Control criteria. Application Control policies require
the use of preconfigured criteria that define which applications you want to“Allow” or “Block” on an endpoint or for a particular user.
For more information, see Application Control Criteria on page 3-2.
Procedure1.

Select Enable Application Control.

2.

In the User-defined Rules section, assign rules to the endpoint based on
the logged on user account.
Important• User-based Application Control is only available if you haveintegrated Active Directory. If you do not have Active Directory
integration, you can only assign criteria to the default All user
accounts rule.
• You cannot delete the default All user accounts rule.

a.
8-2

Add a new rule or modify an existing rule.

Application Control Policy Settings• To add a new rule, click Assign Rule.
• To modify an existing rule, click the value in the User Accounts
column of the table.
The Assign Rule screen appears.
b.

Specify the User Accounts to which you want to apply specific
Application Control criteria.
Important• User-based Application Control is only available if you haveintegrated Active Directory. If you do not have Active Directory
integration, you can only assign rules to the default All user
accounts rule.
• You can only assign 30 users or groups per rule. Create
additional rules if you need to assign a greater number of users
to a policy.

c.

Move the necessary criteria to the Selected criteria table by clicking
the criteria Name.

d.

Click Save.
Note
To change the Priority order of rules, select and drag rules to different
locations in the list. Application Control applies a first match rule tousers included in multiple rules.

3.

In the Additional Actions section, specify the action Application Control
takes when a user attempts to execute an application that does notmatch any of the User-defined Rule criteria.
• Allow: All other applications can execute: Application Control
takes no action on applications that do not match any of the Userdefined Rule criteria. Choose when using Application Control toblock or monitor application usage.
8-3

Trend Micro Apex Central™ Widget and Policy Management Guide• Lockdown: Block all applications not identified during the last
inventory scan: After endpoints receive this command, Application
Control takes the following actions:a. Application Control scans the endpoint and creates a complete
application inventory.
b. Application Control “locks down” the endpoint and does not
permit access to:• Any application that does not specifically match Allow
criteria defined in the User-defined Rule table• Any application that does not specifically matchassessment criteria defined in the User-defined Rule table• Any application not found in the inventory scan results forthat particular endpoint• Exclude applications by Trend Micro trusted vendors: Selectto automatically allow all applications that Trend Micro threat
experts have determined come from trusted vendors• Enable assessment mode: Select to log access to applications
not specifically allowed to execute during Lockdown but do notblock the applications
Tip
Use assessment mode to determine which applications users
may require before you completely block access to allapplications you did not add to Allow Rules.

4.

In the Agent Notifications section, select Display a notification when an
application is blocked to display a notification on the endpoint when
Application Control blocks an application.

5.

In the Log Maintenance section:• Maximum log age (in days): Specify the maximum number of days
that the endpoint should keep log data

8-4

Application Control Policy Settings• Maximum number of logs a Security Agent can send each hour
per criteria: Specify the maximum number of logs each Security
Agent can send to the Apex One server every hour for each criteria
rule
Note
Depending on the number of Security Agents and your network
settings, the amount of network traffic that the server receives may
cause performance issues.
Important
You must remember to Deploy or Save your Apex One Security Agent
policy before leaving the screen. If you do not save the entire policy, youlose all changes.

8-5Chapter 9

Behavior Monitoring Policy Settings
This section describes how to configure Behavior Monitoring policies on
Security Agents.
Topics include:• Behavior Monitoring on page 9-2• Configuring Behavior Monitoring Rules and Exceptions on page 9-15

9-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Behavior Monitoring
Behavior Monitoring constantly monitors endpoints for unusual
modifications to the operating system or on installed software. Behavior
Monitoring protects endpoints through Malware Behavior Blocking andEvent Monitoring. Complementing these two features are a user-configured
exception list and the Certified Safe Software Service.
Important
By default, Behavior Monitoring is disabled on all versions of Windows Server
platforms.

Malware Behavior Blocking
Malware Behavior Blocking provides a necessary layer of additional threatprotection from programs that exhibit malicious behavior. It observes
system events over a period of time. As programs execute different
combinations or sequences of actions, Malware Behavior Blocking detects
known malicious behavior and blocks the associated programs. Use thisfeature to ensure a higher level of protection against new, unknown, andemerging threats.
Malware Behavior Monitoring provides the following threat-level scanning
options:• Known threats: Blocks behaviors associated with known malware
threats• Known and potential threats: Blocks behavior associated with known
threats and takes action on behavior that is potentially malicious
After blocking a program with notifications enabled, the Security Agent
displays a notification on the endpoint.

Ransomware Protection
Ransomware Protection prevents the unauthorized modification or
encryption of files on agents by “ransomware” threats. Ransomware is a type9-2

Behavior Monitoring Policy Settingsof malware which restricts access to files and demands payment to restore
the affected files.
Apex One provides the following methods to protect your environment fromransomware threats.
Note
To reduce the chance of the Security Agent detecting a safe process as
malicious, ensure that the agent has Internet access to perform additionalverification processes using Trend Micro servers.

9-3

Trend Micro Apex Central™ Widget and Policy Management Guide

OptionDescription

Protect documents
againstunauthorizedencryption or
modification

You can configure Behavior Monitoring to detect a specific sequenceof events that may indicate a ransomware attack. After Behavior
Monitoring matches all of the following criteria, the Security Agentterminates and attempts to quarantine malicious programs:
1. A process not recognized as safe attempts to modify, delete, or
rename three files within a certain time interval.
2. The process attempted to modify a protected file extension type
Additionally enable Automatically back up files changed bysuspicious programs to create copies of files being encrypted on
endpoints. After the encryption process completes and Apex One
detects a ransomware threat, Apex One prompts end users to restore
the affected files without suffering any loss of data.
Note
Automatic file backup requires at least 100 MB of disk spaceon the agent endpoint and only backs up files that are lessthan 10 MB in size.
The backup folder location on agent endpoints is: <Agent
installation folder>\CCSF\module\DRE\data.
WARNING!
If Automatically back up files changed by suspicious
programs is not enabled, Apex One cannot recover the first
files affected by a ransomware threat.

Block processes
commonlyassociated withransomware

9-4

Ransomware commonly distributes executable files in specificlocations on endpoints before attempting to hijack files. Blocking theprocesses started from these locations can help prevent theransomware from being able to hijack files.

Behavior Monitoring Policy Settings

OptionDescription

Enable program
inspection to detectand blockcompromised
executable files

Program inspection monitors processes and performs API hooking todetermine if a program is behaving in an unexpected manner.
Although this procedure increases the overall detection ratio ofcompromised executable files, it may result in decreased system
performance.
Tip
Program inspection provides increased security if you selectKnown and potential threats in the Threats to block dropdown.

Anti-Exploit Protection
Anti-exploit protection works in conjunction with program inspection tomonitor the behavior of programs and detect abnormal behavior that may
indicate that an attacker has exploited a program vulnerability. Once
detected, Behavior Monitoring terminates the program processes.
ImportantAnti-exploit Protection requires that you select Enable program inspection to
detect and block compromised executable files.

Newly Encountered Program Protection
Behavior Monitoring works in conjunction with Web Reputation Services andReal-time Scan to verify the prevalence of files downloaded through web
channels, email applications, or Microsoft Office macro scripts. After
detecting a "newly encountered" file, administrators can choose to prompt
users before executing the file. Trend Micro classifies a program as newly
encountered based on the number of file detections or historical age of thefile as determined by the Smart Protection Network.
Behavior Monitoring scans the following file types for each channel:• Web (HTTP/HTTPS): Scans .exe files.

9-5Trend Micro Apex Central™ Widget and Policy Management Guide• Email applications: Scans .exe, and compressed .exe files in
unencrypted .zip and .rar files.
Note• Administrators must enable Web Reputation Services on the agent toallow the Security Agent to scan HTTP or HTTPS traffic before thisprompt can display.
• The Security Agent matches the file names downloaded through email
applications during the execution process. If the file name has beenchanged, the user does not receive a prompt.

Event Monitoring
Event Monitoring provides a more generic approach to protecting against
unauthorized software and malware attacks. It monitors system areas forcertain events, allowing administrators to regulate programs that trigger
such events. Use Event Monitoring if you have specific system protection
requirements that are above and beyond what is provided by Malware
Behavior Blocking.
The following table provides a list of monitored system events.
Table 9-1. Monitored System Events

9-6

EventsDescription

Duplicated System
File

Many malicious programs create copies of themselves or othermalicious programs using file names used by Windows system files.
This is typically done to override or replace system files, avoid
detection, or discourage users from deleting the malicious files.

Hosts File
Modification

The Hosts file matches domain names with IP addresses. Many
malicious programs modify the Hosts file so that the web browser isredirected to infected, non-existent, or fake websites.

Suspicious Behavior

Suspicious behavior can be a specific action or a series of actions thatis rarely carried out by legitimate programs. Programs exhibiting
suspicious behavior should be used with caution.

Behavior Monitoring Policy Settings

EventsDescription

New Internet Explorer
PluginSpyware/grayware programs often install unwanted Internet Explorer
plugins, including toolbars and Browser Helper Objects.

Internet Explorer
Setting Modification

Malware programs may change Internet Explorer settings, including
the home page, trusted websites, proxy server settings, and menu
extensions.

Security Policy
Modification

Modifications in Windows Security Policy can allow unwanted
applications to run and change system settings.

Program Library
Injection

Many malicious programs configure Windows so that all applications
automatically load a program library (DLL). This allows the malicious
routines in the DLL to run every time an application starts.

Shell Modification

Many malicious programs modify Windows shell settings to associatethemselves to certain file types. This routine allows malicious
programs to launch automatically if users open the associated files in
Windows Explorer. Changes to Windows shell settings can also allow
malicious programs to track the programs used and start alongsidelegitimate applications.

New Service

Windows services are processes that have special functions andtypically run continuously in the background with full administrative
access. Malicious programs sometimes install themselves as services
to stay hidden.

System File
Modification

Certain Windows system files determine system behavior, including
startup programs and screen saver settings. Many malicious programs
modify system files to launch automatically at startup and control
system behavior.

Firewall Policy
Modification

The Windows Firewall policy determines the applications that haveaccess to the network, the ports that are open for communication, andthe IP addresses that can communicate with the computer. Many
malicious programs modify the policy to allow themselves to access tothe network and the Internet.

System Process
Modification

Many malicious programs perform various actions on built-in
Windows processes. These actions can include terminating or
modifying running processes.

9-7Trend Micro Apex Central™ Widget and Policy Management Guide

EventsDescription

New Startup Program

Malicious applications usually add or modify autostart entries in the
Windows registry to automatically launch every time the computer
starts.

When Event Monitoring detects a monitored system event, it performs theaction configured for the event.
The following table lists possible actions that administrators can take onmonitored system events.
Table 9-2. Actions on Monitored System Events
ActionAssessDescription
The Security Agent always allows programs associated with an event to
run and logs the event for assessment.
This is the default action for all monitored system events.
Note
This option is not supported for the Program Library Injection(DLL injection) event on 64-bit systems.

Allow

The Security Agent always allows programs associated with an event torun.

Ask when necessary

The Security Agent prompts users to allow or deny programs
associated with an event from running and adds the programs to the
exception list
If the user does not respond within a certain time period, the Security
Agent automatically allows the program to run. The default time period
is 30 seconds.
NoteThis option is not supported for the Program Library Injection(DLL injection) event on 64-bit systems.

9-8

Behavior Monitoring Policy Settings

ActionDeny

Description
The Security Agent always blocks programs associated with an eventfrom running and logs the event.
After blocking a program with notifications enabled, the Security Agent
displays a notification on the endpoint.

Behavior Monitoring Exception List
The Behavior Monitoring exception list contains programs that the Security
Agent does not monitor using Behavior Monitoring.
• Approved Programs: The Security Agent allows all programs in the
Approved Programs list to pass Behavior Monitoring scanning.
Note
Although Behavior Monitoring does not take action on programs added
to the Approved Programs list, other scan features (such as file-based
scanning) continue to scan the program before allowing the program torun.

• Blocked Programs: The Security Agent blocks all programs in the
Blocked Programs list. To configure the Blocked Programs list, enable
Event Monitoring.
Configure the exception list from the web console. You can also grant users
the privilege to configure their own exception list from the Security Agentconsole.
For more information, see Configuring Agent Privileges on page 7-4.

Exception List Wildcard Support
The Behavior Monitoring Approved List supports the use of wildcard
characters when defining file path, file name, and file extension exception
types. Use the following tables to properly format your exception lists toensure that Apex One excludes the correct files and folders from scanning.
Supported wildcard characters:
9-9Trend Micro Apex Central™ Widget and Policy Management Guide• Asterisk (*): Represents any character or string of characters• Question mark (?): Represents a single character
Important• The Behavior Monitoring Approved List does not support the use of
wildcard characters to replace system drive designations or UNC
addresses.
• The Behavior Monitoring Block List does not support the use of wildcard
characters to replace folders.
Exception TypeDirectories

Specific
files undera specificfolder layer

9-10

Wildcard Usage

MatchedNot MatchedC:\*• C:\sample.exe• D:\sample.exe

Excludes all files andfolders on the specified
drive• C:\folder• E:\folder

C:\*\Sample.exe• C:\files• C:\sample.exe

Excludes the

Sample.exe file only if

the file is located in any
subfolder of the C:\
directory\test.doc\Sample.exe• C:\temp\files\Sample.exe\test.doc

Behavior Monitoring Policy Settings

Exception TypeUNC paths

Wildcard Usage\\<UNC path>\*\Sample.exe

Excludes the

Sample.exe file only if

the file is located in any
subfolder of thespecified UNC path

Matched• \\<UNC path>\files\Sample.exe• \\<UNC path>\temp\files\Sample.exe

Not Matched• R:\files\Sample.exe

Reason: Mapped
drives are notsupported.
• \\<UNC path>\Sample.exe

Reason: The filedoes not exist
within a subfolderof the UNC path.
File names
andextensions

C:\*.*• C:\Sample.exe• D:\sample.exe

Excludes all files withextensions in all folders
and subfolders of the
C:\ directory• C:\temp• C:\Sample\Sample.exe• C:\test.doc

Note
C:\Sample

does nothave a fileextensionand istherefore
notexcludedfromscanning.

9-11

Trend Micro Apex Central™ Widget and Policy Management Guide

Exception TypeFile names

Wildcard Usage

MatchedNot Matched

C:\*.exe• C:\Sample.exe• C:\Sample.doc

Excludes all files withthe .exe extension in all
folders and subfolders of
the C:\ directory• C:\temp• C:\temp\test.exe\test.bat• C:\Sample
Note
C:\Sample

does nothave a fileextensionand istherefore
notexcludedfromscanning.

9-12

Behavior Monitoring Policy Settings

Exception TypeFileextensions

Wildcard Usage
C:\Sample.*

MatchedNot Matched• C:\Sample.exe• C:\Sample1.doc• C:\temp

Excludes all files with thename Sample and any
extension in the C:\
directory\Sample.bat• C:\Sample
Note
C:\Sample

does nothave a fileextensionand istherefore
notexcludedfromscanning.
Files in
specific
directory
structures

C:\*\*\Sample.exe

Excludes all files locatedwithin the second
subfolder layer or any
subsequent subfoldersof the C:\ directory withthe file name andextension Sample.exe• C:\files\temp\Sample.exe• C:\files\temp\test\Sample.exe• C:\Sample.exe• C:\temp\Sample.exe• C:\files\temp\Sample.doc

9-13

Trend Micro Apex Central™ Widget and Policy Management Guide

Exception TypeComplexpaths orfile names

Wildcard Usage

MatchedNot Matched

C:\Sam*e??.exe• C:\Sample12.exe• C:\SaSmple12.exExcludes all files withnames that satisfy thefollowing conditions:• C:\SamSamSample
12.exee

Reason: Does notstart with "Sam"• Begin with thecharacters "Sam"• C:\SamSamSam12.

• The third last
character of the filename must be "e"Reason: Does notcontain "e" as thethird last character• At least 1 character
exists between the
opening "Sam"string and closing"e??" string of thefile name• Exactly 2 characters
exist before the fileextension and afterthe "e" in the filename
• The file extension
is .exe
If a file meets all therequired conditions andis located the C:\
directory, Behavior
Monitoring excludes thefile from scans.

exe• C:\Same12.exe
Reason: Does notinclude characters
between thestarting "Sam"string and third last"e" character• C:\Sample1.exe
Reason: Does notinclude 2 characters
before the extension
and after the "e"• C:\Sample12.doc
Reason: Incorrect
extension

Exception List Environment Variable Support
The following table lists the environment variables you can use when adding
a file or folder path to the list.

9-14

Behavior Monitoring Policy Settings

Environment
Variable

ExampleEquivalent Path$allappdata$$allappdata$\test\sample.exe

C:\ProgramData\test\sample.exe$allprograms$$allprograms$\test\sample.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\test\sample.exe$programdir$$programdir$\test\sample.exe

C:\Program Files\test\sample.exe$programdirx86$$programdirx86$\test\sample.exe

C:\Program Files (x86)\test\sample.exe$rootdir$$rootdir$\test\sample.exe

C:\test\sample.exe$systemdir$$systemdir$\test\sample.exe

C:\Windows\System32\test\sample.exe$systemdirx86$$systemdirx86$\test\sample.exe

C:\Windows\SysWOW64\test\sample.exe$tempdir$$tempdir$\test\sample.exe

C:\Windows\Temp\test\sample.exe$userprofile$$userprofile$\test\sample.exe

C:\user\{current_user_account}\test\sample.exe$windir$$windir$\test\sample.exe

C:\Windows\test\sample.exe

Configuring Behavior Monitoring Rules andExceptions
Configure Behavior Monitoring policies to protect endpoints against
ransomware, exploit attacks, and emerging threats. Use the Event
Monitoring feature to assess or block behaviors commonly associated withmalware threats.
Note
By default, Behavior Monitoring is disabled on all versions of Windows Server
platforms.

9-15

Trend Micro Apex Central™ Widget and Policy Management Guide

Procedure1.

In the Malware Behavior Blocking section:a.

Select Enable Malware Behavior Blocking and specify the types of
threats to block:• Known threats: Blocks behaviors associated with known
malware threats• Known and potential threats: Blocks behaviors associated withknown threats and takes action on behavior that is potentiallymaliciousb.

Select which Ransomware Protection features you want to enable toprotect against ransomware threats.
• Protect documents against unauthorized encryption or
modification: Stops potential ransomware threats fromencrypting or modifying the contents of documents• Automatically back up and restore files changed bysuspicious programs: Creates backup copies of files being
encrypted on endpoints to prevent any loss of data after
detecting a ransomware threat
Note
Automatic file backup requires at least 100 MB of disk
space on the agent endpoint and only backs up files thatare less than 10 MB in size.

• Block processes commonly associated with ransomware:
Blocks processes associated with known ransomware threats
before any encryption or modification of documents can occur• Enable program inspection to detect and block compromised
executable files: Program inspection monitors processes andperforms API hooking to determine if a program is behaving inan unexpected manner. Although this procedure increases the

9-16Behavior Monitoring Policy Settings

overall detection ratio of compromised executable files, it may
result in decreased system performance.
Tip
Program inspection provides increased security if you selectKnown and potential threats in the Threats to block dropdown.

For details, see Ransomware Protection on page 9-2.
c.

Under Anti-exploit Protection, enable Terminate programs thatexhibit abnormal behavior associated with exploit attacks toprotect against potentially exploited programs.
NoteAnti-exploit Protection requires that you select Enable program
inspection to detect and block compromised executable files.
For details, see Anti-Exploit Protection on page 9-5.
ImportantAnti-exploit Protection works in conjunction with Real-time Scan
(Quarantine malware variants detected in memory) to provide
enhanced protection against Fileless Attacks.
For more information, see Real-time Scan: Target Tab on page 10-13.

2.

In the Newly Encountered Programs section, enable Monitor newly
encountered programs downloaded through web or email application
channels and select whether to Prompt user before executing thedownloaded program or to have Apex One log the detections only.

3.

In the Event Monitoring section:a.

Select Enable Event Monitoring.

b.

Click Specify detailed settings to select the types of events tomonitor.
9-17

Trend Micro Apex Central™ Widget and Policy Management Guidec.

Choose the system events to monitor and select an action for eachof the selected events.
For information about monitored system events and actions, seeEvent Monitoring on page 9-6.

4.

Click the Exceptions tab to configure the exception lists.
a.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policy
Note
If your child policies Extend from parent, you can also
configure Child Policy Restrictions. Restrictions prevent thechild policy from adding specific objects to the list.

b.

Type the full program path in the available text field.
Note• Separate multiple entries with semicolons (;).
• Use the Import and Export buttons to share the list withdifferent policies.
• The Approved List supports the use of wildcard characters.
For more information, see Exception List Wildcard Support on
page 9-9.

9-18

c.

Click Add.

d.

To remove a blocked or approved program from the list, click thetrash bin icon ( ) next to the program.

Behavior Monitoring Policy Settings

Note
Apex One accepts a maximum combined total of 1024 approved
programs and blocked programs.

9-19

Chapter 10

Anti-malware Policy Settings
This section describes how to configure anti-malware scanning on Security
Agents.
Topics include:• Scan Method Types on page 10-2
• Manual Scan on page 10-4
• Real-time Scan on page 10-12• Scan Now on page 10-21• Scheduled Scan on page 10-29• Scan Actions on page 10-38• Scan Exclusion Support on page 10-47

10-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Scan Method Types
Security Agents can use one of two scan methods when scanning for security
risks. The scan methods are smart scan and conventional scan.
• Smart Scan
Security Agents that use smart scan are referred to as smart scan agentsin this document. Smart scan agents benefit from local scans and in-thecloud queries provided by File Reputation Services.
• Conventional Scan
Agents that do not use smart scan are called conventional scan agents.
A conventional scan agent stores all Security Agent components on theendpoint and scans all files locally.

Guidelines for Switching Scan Methods
The following table outlines some considerations you should be aware of
before switching the scan method that Security Agents use.
Table 10-1. Considerations When Switching to Smart Scan
Consideration

Details

Product license

Ensure that you have activated all required licenses for the newscan method.

Apex One server

Ensure that agents can connect to the Apex One server. Apex One
only notifies online agents to switch scan methods. Offline agents
get notified when they become online. Independent agents arenotified when they become online or, if the agent has scheduled
update privileges, when scheduled update runs.
Also verify that the Apex One server has the latest components toensure that Security Agents can download the correct patterns
from the server.

Number of Security
Agents to switch

10-2

Switching a relatively small number of Security Agents at a timeallows efficient use of the Apex One server and Smart Protection
Server resources. These servers can perform other critical tasks
while Security Agents change scan methods.

Anti-malware Policy Settings

Consideration
Timing

Details
When switching scan methods, Security Agents need to download
full versions of the required pattern files for the new scan method.
Consider switching during off-peak hours to minimize the impact
to network bandwidth and interruption to end user daily
operations. Trend Micro recommends disabling "Update Now" on
Security Agents during the conversion process.

IPv6 support
Important
Only available
for Security
Agents reportingto an onpremises Apex
One server.

Smart scan agents send scan queries to smart protection sources.
A pure IPv6 smart scan agent cannot send queries directly to pure
IPv4 sources, such as:• Smart Protection Server 2.0 (integrated or standalone)
Note
IPv6 support for Smart Protection Server starts inversion 2.5.
• Trend Micro Smart Protection Network
Similarly, a pure IPv4 smart scan agent cannot send queries topure IPv6 Smart Protection Servers.
A dual-stack proxy server that can convert IP addresses, such as
DeleGate, is required to allow smart scan agents to connect to thesources.

Smart Protection
Services

If you are switching Security Agents from conventional scan tosmart scan, ensure that you have set up Smart Protection
Services.

Important
Only available
for Security
Agents reportingto an onpremises Apex
One server.

10-3

Trend Micro Apex Central™ Widget and Policy Management Guide

Manual Scan
Manual Scan is an on-demand scan and starts immediately after a user runs
the scan on the Security Agent console. The time it takes to complete
scanning depends on the number of files to scan and the Security Agent
endpoint's hardware resources.
Configure and apply Manual Scan settings to one or several agents anddomains, or to all agents that the server manages.

Configuring Manual Scan Settings
Configure Manual Scan settings using the following tabs:• Manual Scan: Target Tab on page 10-4
• Manual Scan: Action Tab on page 10-6
• Manual Scan: Scan Exclusion Tab on page 10-9

Manual Scan: Target Tab
Procedure1.

In the Files to Scan section, select from the following:• All scannable files: Includes all scannable files. Unscannable files
are password protected files, encrypted files, or files that exceed theuser-defined scanning restrictions.
Note
This option provides the maximum security possible. However,scanning every file requires a lot of time and resources and might
be redundant in some situations. Therefore, you might want to limit
the amount of files the agent includes in the scan.

• File types scanned by IntelliScan: Scans files based on true-file
type.
10-4

Anti-malware Policy Settings• Files with the following extensions (use commas to separate
entries): Manually specify the files to scan based on theirextensions. Separate multiple entries with commas.
Note
When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policy

2.

In the Scan Settings section, configure the required settings.
Setting

Description

Scan hidden
folders

Allows the Security Agent to detect and then scan hidden folders
on the endpoint

Scan network
drive

Scans directories physically located on other endpoints, butmapped to the local endpoint

Scan compressed
files

Scans the specified number of compression layers within anarchived file
Note
Scanning through more layers may detect malware
intentionally buried within a compressed archive,
however, the scan may affect system performance.

10-5Trend Micro Apex Central™ Widget and Policy Management Guide

Setting
Scan OLE objects

Description
Scans the specified number of Object Linking and Embedding(OLE) layers in a file
Detect exploit code in OLE files: OLE Exploit Detection
heuristically identifies malware by checking Microsoft Office files
for exploit code.
Note
The specified number of layers is applicable to both the
Scan OLE objects and Detect exploit code in OLE files
options.

Scan boot area

3.

Scans the boot sector of the hard disk on the endpoint for virus/
malwareIn the CPU Usage section, select from the following:• High: No pausing between scans• Medium: Pause between file scans if CPU consumption is higher
than 50%, and do not pause if 50% or lower• Low: Pause between file scans if CPU consumption is higher than
20%, and do not pause if 20% or lower

Manual Scan: Action Tab
Procedure1.

In the Virus/Malware section, configure the required settings.
a.

Select the type of action that the Security Agent takes after detecting
a security threat.
• Use ActiveAction: Select to use a set of pre-configured scanactions for viruses/malware
For more information, see ActiveAction on page 10-39.

10-6Anti-malware Policy Settings• Customize action for probable virus/malware: Select andspecify the action that the Security Agent takes on
probable malware threats• Use the same action for all virus/malware types: Specify theaction that the Security Agent takes on all malware threats• Use a specific action for each virus/malware type: Specify theaction that the Security Agent takes on specific security threats
For more information, see Custom Scan Actions on page 10-40.
b.

Select Back up files before cleaning to create an encrypted copy of
the infected file on the endpoint in the <Agent installation
folder>\Backup folder.
Creating a backup copy of the file allows you to restore the original
version of the file if necessary.

c.

Specify the location of the quarantine directory.
• Quarantine to the Security Agent's managing server: The
Security Agent sends an encrypted copy of all quarantined files
to the managing Apex One server• Quarantine directory: The Security Agent sends an encrypted
copy of all quarantined files to the specified location
For more information, see Quarantine Directory on page 10-41.

d.

In the Damage Cleanup Services section, configure the following:• Cleanup type
• Standard cleanup: The Security Agent performs any of thefollowing actions during standard cleanup:• Detects and removes live Trojans• Kills processes that Trojans create• Repairs system files that Trojans modify• Deletes files and applications that Trojans drop

10-7Trend Micro Apex Central™ Widget and Policy Management Guide• Advanced cleanup: In addition to the standard cleanup
actions, the Security Agent stops activities by rogue
security software (also known as FakeAV) and certain
rootkit variants.
• Run cleanup when probable virus/malware is detected:
Performs the configured cleanup type on probable malware
threats
Note
You can only select this option if the action on probable virus/
malware is not Pass or Deny Access.

2.

In the Spyware/Grayware section, select the action the Security Agent
takes after detecting spyware or grayware programs.
• Clean: Terminates all related processes and deletes associatedregistry values, files, cookies and shortcuts
Note
After cleaning spyware/grayware, Security Agents back up spyware/
grayware data, which you can restore if you consider the spyware/
grayware safe to access.

• Pass: Logs the detection but allows the program to execute3.

In the Advanced Malware Detection section, select an option andconfigure the required setting.
• Use ActiveAction: Select to use a set of pre-configured scan actions
on detected portable executable files. This is the recommended
option.
For more information, see ActiveAction on page 10-39.
• Use the same action for all portable executable files with threats:
Select to apply one of the following actions on detected portable
executable files.

10-8Anti-malware Policy Settings• Quarantine: The system automatically quarantines thedetected portable executable files.
• Pass: The system generates a detection log but does not apply
any action on detected portable executable files.
Note
If a detected portable executable file is in the Scan Exclusion list, thesystem does not apply any action on the file.

Manual Scan: Scan Exclusion Tab
Procedure1.

Select Enable scan exclusion.

2.

In the Scan Exclusion List (Directories) section, configure the required
settings.
a.

Select Exclude directories where Trend Micro products are
installed to automatically exclude directories associated with otherTrend Micro products.
For more information, see Trend Micro Product Directory Exclusions
on page 10-47.

b.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policy
Note
If your child policies Extend from parent, you can also
configure Child Policy Restrictions. Restrictions prevent thechild policy from adding specific objects to the list.

10-9Trend Micro Apex Central™ Widget and Policy Management Guidec.

Type a directory path to exclude from scans and click the + button.
The Security Agent does not scan files located in the specified
directory (and sub-directories).
Note• You can specify a maximum of 256 directories to exclude fromscanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• Directory exclusions support the use of wildcard characters.
For more information, see Wildcard Exceptions on page 10-47.

3.

In the Scan Exclusion List (Files) section, configure the required
settings.
a.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policy

b.

10-10

Type a file name or the file name with full directory path to exclude
from scans and click the + button.

Anti-malware Policy Settings

Note• You can specify a maximum of 256 files to exclude fromscanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• File exclusions support the use of wildcard characters.
For more information, see Wildcard Exceptions on page 10-47.

4.

In the Scan Exclusion List (File Extensions) section, configure therequired settings.
a.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policyb.

Select or type a file extension to exclude from scans and click the
Add > button.

10-11

Trend Micro Apex Central™ Widget and Policy Management Guide

Note• You can specify a maximum of 256 file extensions to exclude
from scanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• For Manual Scan, Scheduled Scan, and Scan Now, use aquestion mark (?) to replace a single character or an asterisk (*)
to replace multiple characters as wildcard characters. For
example, if you do not want to scan all files with extensions
starting with D, such as DOC, DOT, or DAT, type D* or D??.

Real-time Scan
Real-time Scan is a persistent and ongoing scan. Each time a file is received,
opened, downloaded, copied, or modified, Real-time Scan scans the file forsecurity risks. If the Security Agent does not detect a security risk, users canproceed to access the file. If the Security Agent detects a security risk or aprobable virus/malware, a notification message displays indicating the nameof the infected file and the specific security risk.
Real-time Scan maintains a persistent scan cache which reloads each time
the Security Agent starts. The Security Agent tracks any changes to files orfolders that occurred since the Security Agent unloaded and removes thesefiles from the cache.

Configuring Real-time Scan Settings
Procedure1.

Select the following options:• Enable virus/malware scan
• Enable spyware/grayware scan

10-12Anti-malware Policy Settings

Note
You must enable virus/malware scanning before you can enablespyware/grayware scanning. During a virus outbreak, the Security
Agent automatically enables Real-time Scan and you cannot disable
scanning until the outbreak ends. Real-time Scan helps prevent thevirus from modifying or deleting files and folders on endpoints.

2.

Configure the Target settings.
For more information, see Real-time Scan: Target Tab on page 10-13.

3.

Configure the Action settings.
For more information, see Real-time Scan: Action Tab on page 10-16.

4.

Configure the Scan Exclusion settings.
For more information, see Real-time Scan: Scan Exclusion Tab on page
10-19.

Real-time Scan: Target Tab
Procedure1.

In the User Activity on Files section, select which file operations trigger
scanning from the Scan files being drop-down.
• created/modified and retrieved: Scans all files created, modified,or opened on the endpoint• created/modified: Scans all files created or modified on theendpoint• retrieved: Scans all files opened on the endpoint2.

In the Files to Scan section, select from the following:• All scannable files: Includes all scannable files. Unscannable files
are password protected files, encrypted files, or files that exceed theuser-defined scanning restrictions.
10-13

Trend Micro Apex Central™ Widget and Policy Management Guide

Note
This option provides the maximum security possible. However,scanning every file requires a lot of time and resources and might
be redundant in some situations. Therefore, you might want to limit
the amount of files the agent includes in the scan.

• File types scanned by IntelliScan: Scans files based on true-file
type.
• Files with the following extensions (use commas to separate
entries): Manually specify the files to scan based on theirextensions. Separate multiple entries with commas.
Note
When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policy

3.

In the Scan Settings section, configure the required settings.
Setting

10-14

Description

Scan floppy disks
during shutdown

Scans floppy disks during shutdown

Scan network
drive

Scans directories physically located on other endpoints, butmapped to the local endpoint

Scan the bootsector of the USB
storage device
after plugging in

Automatically scans only the boot sector of a USB storage device
every time the user plugs it inAnti-malware Policy Settings

Setting

Description

Scan all files inremovable storage
devices afterplugging in

Automatically scans all files on a USB storage device every time
the user plugs it in

Quarantine
malware variants
detected inmemoryBehavior Monitoring scans the system memory for suspicious
processes and Real-time Scan maps the process and scans it for
malware threats. If a malware threat exists, Real-time scan
quarantines the process and/or file.
Note
Memory scanning works in conjunction with Anti-exploit
Protection in Behavior Monitoring to provide enhanced
protection against Fileless Attacks.
For more information, see Configuring Behavior
Monitoring Rules and Exceptions on page 9-15.

Scan compressed
files

Scans the specified number of compression layers within anarchived file
Note
Scanning through more layers may detect malware
intentionally buried within a compressed archive,
however, the scan may affect system performance.

10-15

Trend Micro Apex Central™ Widget and Policy Management Guide

Setting
Scan OLE objects

Description
Scans the specified number of Object Linking and Embedding(OLE) layers in a file
Detect exploit code in OLE files: OLE Exploit Detection
heuristically identifies malware by checking Microsoft Office files
for exploit code.
Note
The specified number of layers is applicable to both the
Scan OLE objects and Detect exploit code in OLE files
options.

Enable IntelliTrap

Detects malicious code, such as bots, in compressed files

Enable CVE exploit
scanning for files
downloaded
through web andemail channels

Blocks processes that attempt to exploit known vulnerabilities incommercially available products based on the Common
Vulnerabilities and Exposures (CVE) system

Real-time Scan: Action Tab
Procedure1.

In the Virus/Malware section, configure the required settings.
a.

Select the type of action that the Security Agent takes after detecting
a security threat.
• Use ActiveAction: Select to use a set of pre-configured scanactions for viruses/malware
For more information, see ActiveAction on page 10-39.
• Customize action for probable virus/malware: Select andspecify the action that the Security Agent takes on
probable malware threats

10-16

Anti-malware Policy Settings• Use the same action for all virus/malware types: Specify theaction that the Security Agent takes on all malware threats• Use a specific action for each virus/malware type: Specify theaction that the Security Agent takes on specific security threats
For more information, see Custom Scan Actions on page 10-40.
b.

Select the types of notification that display to end users.
• Display a notification when virus/malware is detected: Selectto display a notification informing the Security Agent userwhen a malware detection occurs• Display a notification when probable virus/malware is
detected: Select to display a notification informing the Security
Agent user when a probable malware detection occursc.

Select Back up files before cleaning to create an encrypted copy of
the infected file on the endpoint in the <Agent installation
folder>\Backup folder.
Creating a backup copy of the file allows you to restore the original
version of the file if necessary.

d.

Specify the location of the quarantine directory.
• Quarantine to the Security Agent's managing server: The
Security Agent sends an encrypted copy of all quarantined files
to the managing Apex One server• Quarantine directory: The Security Agent sends an encrypted
copy of all quarantined files to the specified location
For more information, see Quarantine Directory on page 10-41.

e.

In the Damage Cleanup Services section, configure the following:• Run cleanup when probable virus/malware is detected:
Performs the configured cleanup type on probable malware
threats

10-17

Trend Micro Apex Central™ Widget and Policy Management GuideNote
You can only select this option if the action on probable virus/
malware is not Pass or Deny Access.

2.

In the Spyware/Grayware section, select the action the Security Agent
takes after detecting spyware or grayware programs.
• Clean: Terminates all related processes and deletes associatedregistry values, files, cookies and shortcuts
Note
After cleaning spyware/grayware, Security Agents back up spyware/
grayware data, which you can restore if you consider the spyware/
grayware safe to access.

• Deny access: Prevents the end user from opening or copying the
spyware or grayware components• Display a notification on endpoints when spyware/grayware is
detected: Select to display a notification informing the Security
Agent user when a spyware/grayware detection occurs
3.

In the Advanced Malware Detection section, select an option andconfigure the required setting.
• Use ActiveAction: Select to use a set of pre-configured scan actions
on detected portable executable files. This is the recommended
option.
For more information, see ActiveAction on page 10-39.
• Use the same action for all portable executable files with threats:
Select to apply one of the following actions on detected portable
executable files.
• Quarantine: The system automatically quarantines thedetected portable executable files.
• Pass: The system generates a detection log but does not apply
any action on detected portable executable files.

10-18

Anti-malware Policy Settings

Note
If a detected portable executable file is in the Scan Exclusion list, thesystem does not apply any action on the file.

Real-time Scan: Scan Exclusion Tab
Procedure1.

Select Enable scan exclusion.

2.

In the Scan Exclusion List (Directories) section, configure the required
settings.
a.

Select Exclude directories where Trend Micro products are
installed to automatically exclude directories associated with otherTrend Micro products.
For more information, see Trend Micro Product Directory Exclusions
on page 10-47.

b.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policy
Note
If your child policies Extend from parent, you can also
configure Child Policy Restrictions. Restrictions prevent thechild policy from adding specific objects to the list.

c.

Type a directory path to exclude from scans and click the + button.
The Security Agent does not scan files located in the specified
directory (and sub-directories).
10-19

Trend Micro Apex Central™ Widget and Policy Management Guide

Note• You can specify a maximum of 256 directories to exclude fromscanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• Directory exclusions support the use of wildcard characters.
For more information, see Wildcard Exceptions on page 10-47.

3.

In the Scan Exclusion List (Files) section, configure the required
settings.
a.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policyb.

Type a file name or the file name with full directory path to exclude
from scans and click the + button.
Note• You can specify a maximum of 256 files to exclude fromscanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• File exclusions support the use of wildcard characters.
For more information, see Wildcard Exceptions on page 10-47.

4.

10-20

In the Scan Exclusion List (File Extensions) section, configure therequired settings.

Anti-malware Policy Settingsa.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policyb.

Select or type a file extension to exclude from scans and click the
Add > button.
Note• You can specify a maximum of 256 file extensions to exclude
from scanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• Real-time Scan does not support the use of wildcard charactersfor file extension exclusions.

Scan Now
Scan Now is initiated remotely by administrators through the web console
and can be targeted to one or several Security Agent endpoints.
Configure and apply Scan Now settings to one or several Security Agents anddomains, or to all Security Agents that the server manages.

Configuring Scan Now Settings
Procedure1.

Select the following options:• Enable virus/malware scan
10-21

Trend Micro Apex Central™ Widget and Policy Management Guide• Enable spyware/grayware scan
Note
You must enable virus/malware scanning before you can enablespyware/grayware scanning.

2.

Configure the Target settings.
For more information, see Scan Now: Target Tab on page 10-22.

3.

Configure the Action settings.
For more information, see Scan Now: Action Tab on page 10-24.

4.

Configure the Scan Exclusion settings.
For more information, see Scan Now: Scan Exclusion Tab on page 10-27.

Scan Now: Target Tab
Procedure1.

In the Files to Scan section, select from the following:• All scannable files: Includes all scannable files. Unscannable files
are password protected files, encrypted files, or files that exceed theuser-defined scanning restrictions.
Note
This option provides the maximum security possible. However,scanning every file requires a lot of time and resources and might
be redundant in some situations. Therefore, you might want to limit
the amount of files the agent includes in the scan.

• File types scanned by IntelliScan: Scans files based on true-file
type.

10-22

Anti-malware Policy Settings• Files with the following extensions (use commas to separate
entries): Manually specify the files to scan based on theirextensions. Separate multiple entries with commas.
Note
When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policy

2.

In the Scan Settings section, configure the required settings.
Setting
Scan compressed
files

Description
Scans the specified number of compression layers within anarchived file
Note
Scanning through more layers may detect malware
intentionally buried within a compressed archive,
however, the scan may affect system performance.

Scan OLE objects

Scans the specified number of Object Linking and Embedding(OLE) layers in a file
Detect exploit code in OLE files: OLE Exploit Detection
heuristically identifies malware by checking Microsoft Office files
for exploit code.
Note
The specified number of layers is applicable to both the
Scan OLE objects and Detect exploit code in OLE files
options.

10-23

Trend Micro Apex Central™ Widget and Policy Management Guide

Setting
Scan boot area

3.

Description
Scans the boot sector of the hard disk on the endpoint for virus/
malwareIn the CPU Usage section, select from the following:• High: No pausing between scans• Medium: Pause between file scans if CPU consumption is higher
than 50%, and do not pause if 50% or lower• Low: Pause between file scans if CPU consumption is higher than
20%, and do not pause if 20% or lower

Scan Now: Action Tab
Procedure1.

In the Virus/Malware section, configure the required settings.
a.

Select the type of action that the Security Agent takes after detecting
a security threat.
• Use ActiveAction: Select to use a set of pre-configured scanactions for viruses/malware
For more information, see ActiveAction on page 10-39.
• Customize action for probable virus/malware: Select andspecify the action that the Security Agent takes on
probable malware threats• Use the same action for all virus/malware types: Specify theaction that the Security Agent takes on all malware threats• Use a specific action for each virus/malware type: Specify theaction that the Security Agent takes on specific security threats
For more information, see Custom Scan Actions on page 10-40.

10-24Anti-malware Policy Settingsb.

Select Back up files before cleaning to create an encrypted copy of
the infected file on the endpoint in the <Agent installation
folder>\Backup folder.
Creating a backup copy of the file allows you to restore the original
version of the file if necessary.

c.

Specify the location of the quarantine directory.
• Quarantine to the Security Agent's managing server: The
Security Agent sends an encrypted copy of all quarantined files
to the managing Apex One server• Quarantine directory: The Security Agent sends an encrypted
copy of all quarantined files to the specified location
For more information, see Quarantine Directory on page 10-41.

d.

In the Damage Cleanup Services section, configure the following:• Cleanup type
• Standard cleanup: The Security Agent performs any of thefollowing actions during standard cleanup:• Detects and removes live Trojans• Kills processes that Trojans create• Repairs system files that Trojans modify• Deletes files and applications that Trojans drop
• Advanced cleanup: In addition to the standard cleanup
actions, the Security Agent stops activities by rogue
security software (also known as FakeAV) and certain
rootkit variants.
• Run cleanup when probable virus/malware is detected:
Performs the configured cleanup type on probable malware
threats

10-25

Trend Micro Apex Central™ Widget and Policy Management GuideNote
You can only select this option if the action on probable virus/
malware is not Pass or Deny Access.

2.

In the Spyware/Grayware section, select the action the Security Agent
takes after detecting spyware or grayware programs.
• Clean: Terminates all related processes and deletes associatedregistry values, files, cookies and shortcuts
Note
After cleaning spyware/grayware, Security Agents back up spyware/
grayware data, which you can restore if you consider the spyware/
grayware safe to access.

• Pass: Logs the detection but allows the program to execute3.

In the Advanced Malware Detection section, select an option andconfigure the required setting.
• Use ActiveAction: Select to use a set of pre-configured scan actions
on detected portable executable files. This is the recommended
option.
For more information, see ActiveAction on page 10-39.
• Use the same action for all portable executable files with threats:
Select to apply one of the following actions on detected portable
executable files.
• Quarantine: The system automatically quarantines thedetected portable executable files.
• Pass: The system generates a detection log but does not apply
any action on detected portable executable files.

10-26

Anti-malware Policy Settings

Note
If a detected portable executable file is in the Scan Exclusion list, thesystem does not apply any action on the file.

Scan Now: Scan Exclusion Tab
Procedure1.

Select Enable scan exclusion.

2.

In the Scan Exclusion List (Directories) section, configure the required
settings.
a.

Select Exclude directories where Trend Micro products are
installed to automatically exclude directories associated with otherTrend Micro products.
For more information, see Trend Micro Product Directory Exclusions
on page 10-47.

b.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policy
Note
If your child policies Extend from parent, you can also
configure Child Policy Restrictions. Restrictions prevent thechild policy from adding specific objects to the list.

c.

Type a directory path to exclude from scans and click the + button.
The Security Agent does not scan files located in the specified
directory (and sub-directories).
10-27

Trend Micro Apex Central™ Widget and Policy Management Guide

Note• You can specify a maximum of 256 directories to exclude fromscanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• Directory exclusions support the use of wildcard characters.
For more information, see Wildcard Exceptions on page 10-47.

3.

In the Scan Exclusion List (Files) section, configure the required
settings.
a.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policyb.

Type a file name or the file name with full directory path to exclude
from scans and click the + button.
Note• You can specify a maximum of 256 files to exclude fromscanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• File exclusions support the use of wildcard characters.
For more information, see Wildcard Exceptions on page 10-47.

4.

10-28

In the Scan Exclusion List (File Extensions) section, configure therequired settings.

Anti-malware Policy Settingsa.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policyb.

Select or type a file extension to exclude from scans and click the
Add > button.
Note• You can specify a maximum of 256 file extensions to exclude
from scanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• For Manual Scan, Scheduled Scan, and Scan Now, use aquestion mark (?) to replace a single character or an asterisk (*)
to replace multiple characters as wildcard characters. For
example, if you do not want to scan all files with extensions
starting with D, such as DOC, DOT, or DAT, type D* or D??.

Scheduled Scan
Scheduled Scan runs automatically on the appointed date and time. Use
Scheduled Scan to automate routine scans on the agent and improve scanmanagement efficiency.
Configure and apply Scheduled Scan settings to one or several agents anddomains, or to all agents that the server manages.

10-29Trend Micro Apex Central™ Widget and Policy Management Guide

Configuring Scheduled Scan Settings
Procedure1.

Select the following options:• Enable virus/malware scan
• Enable spyware/grayware scan
Note
You must enable virus/malware scanning before you can enablespyware/grayware scanning.

2.

Configure the Target settings.
For more information, see Scheduled Scan: Target Tab on page 10-30.

3.

Configure the Action settings.
For more information, see Scheduled Scan: Action Tab on page 10-33.

4.

Configure the Scan Exclusion settings.
For more information, see Scheduled Scan: Scan Exclusion Tab on page
10-36.

Scheduled Scan: Target Tab
Procedure1.

In the Schedule section, specify the Scheduled Scan frequency:• Daily: Scans every day at the specified time
• Weekly, every <day_of_week>: Scans once a week on the specified
day at the specified time
• Monthly, on day <number>: Scans once a month on the specified
day at the specified time

10-30

Anti-malware Policy Settings• Monthly, on the <ordinal> <day_of_week>: Scans once a month on
the specified weekday at the specified time
Important
If you select a day that does not exist within a given month (for example,
day “30” does not exist in February), the Scheduled Scan occurs on thelast day of that month.
Note
When configuring a parent policy, specify how other users can configurechild policies.
• Inherit from parent: Child policies must use the settings configuredin the parent policy• Are customizable: Other administrators can configure child policies
to be different than the parent policy settings.

2.

In the Files to Scan section, select from the following:• All scannable files: Includes all scannable files. Unscannable files
are password protected files, encrypted files, or files that exceed theuser-defined scanning restrictions.
Note
This option provides the maximum security possible. However,scanning every file requires a lot of time and resources and might
be redundant in some situations. Therefore, you might want to limit
the amount of files the agent includes in the scan.

• File types scanned by IntelliScan: Scans files based on true-file
type.
• Files with the following extensions (use commas to separate
entries): Manually specify the files to scan based on theirextensions. Separate multiple entries with commas.
10-31

Trend Micro Apex Central™ Widget and Policy Management Guide

Note
When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policy

3.

In the Scan Settings section, configure the required settings.
Setting
Scan compressed
files

Description
Scans the specified number of compression layers within anarchived file
Note
Scanning through more layers may detect malware
intentionally buried within a compressed archive,
however, the scan may affect system performance.

Scan OLE objects

Scans the specified number of Object Linking and Embedding(OLE) layers in a file
Detect exploit code in OLE files: OLE Exploit Detection
heuristically identifies malware by checking Microsoft Office files
for exploit code.
Note
The specified number of layers is applicable to both the
Scan OLE objects and Detect exploit code in OLE files
options.

Scan boot area

4.

10-32

Scans the boot sector of the hard disk on the endpoint for virus/
malwareIn the CPU Usage section, select from the following:Anti-malware Policy Settings• High: No pausing between scans• Medium: Pause between file scans if CPU consumption is higher
than 50%, and do not pause if 50% or lower• Low: Pause between file scans if CPU consumption is higher than
20%, and do not pause if 20% or lower

Scheduled Scan: Action Tab
Procedure1.

In the Virus/Malware section, configure the required settings.
a.

Select the type of action that the Security Agent takes after detecting
a security threat.
• Use ActiveAction: Select to use a set of pre-configured scanactions for viruses/malware
For more information, see ActiveAction on page 10-39.
• Customize action for probable virus/malware: Select andspecify the action that the Security Agent takes on
probable malware threats• Use the same action for all virus/malware types: Specify theaction that the Security Agent takes on all malware threats• Use a specific action for each virus/malware type: Specify theaction that the Security Agent takes on specific security threats
For more information, see Custom Scan Actions on page 10-40.

b.

Select the types of notification that display to end users.
• Display a notification when virus/malware is detected: Selectto display a notification informing the Security Agent userwhen a malware detection occurs• Display a notification when probable virus/malware is
detected: Select to display a notification informing the Security
Agent user when a probable malware detection occurs
10-33

Trend Micro Apex Central™ Widget and Policy Management Guidec.

Select Back up files before cleaning to create an encrypted copy of
the infected file on the endpoint in the <Agent installation
folder>\Backup folder.
Creating a backup copy of the file allows you to restore the original
version of the file if necessary.

d.

Specify the location of the quarantine directory.
• Quarantine to the Security Agent's managing server: The
Security Agent sends an encrypted copy of all quarantined files
to the managing Apex One server• Quarantine directory: The Security Agent sends an encrypted
copy of all quarantined files to the specified location
For more information, see Quarantine Directory on page 10-41.

e.

In the Damage Cleanup Services section, configure the following:• Cleanup type
• Standard cleanup: The Security Agent performs any of thefollowing actions during standard cleanup:• Detects and removes live Trojans• Kills processes that Trojans create• Repairs system files that Trojans modify• Deletes files and applications that Trojans drop
• Advanced cleanup: In addition to the standard cleanup
actions, the Security Agent stops activities by rogue
security software (also known as FakeAV) and certain
rootkit variants.
• Run cleanup when probable virus/malware is detected:
Performs the configured cleanup type on probable malware
threats

10-34

Anti-malware Policy Settings

Note
You can only select this option if the action on probable virus/
malware is not Pass or Deny Access.

2.

In the Spyware/Grayware section, select the action the Security Agent
takes after detecting spyware or grayware programs.
• Clean: Terminates all related processes and deletes associatedregistry values, files, cookies and shortcuts
Note
After cleaning spyware/grayware, Security Agents back up spyware/
grayware data, which you can restore if you consider the spyware/
grayware safe to access.

• Pass: Logs the detection but allows the program to execute• Display a notification on endpoints when spyware/grayware is
detected: Select to display a notification informing the Security
Agent user when a spyware/grayware detection occurs
3.

In the Advanced Malware Detection section, select an option andconfigure the required setting.
• Use ActiveAction: Select to use a set of pre-configured scan actions
on detected portable executable files. This is the recommended
option.
For more information, see ActiveAction on page 10-39.
• Use the same action for all portable executable files with threats:
Select to apply one of the following actions on detected portable
executable files.
• Quarantine: The system automatically quarantines thedetected portable executable files.
• Pass: The system generates a detection log but does not apply
any action on detected portable executable files.

10-35

Trend Micro Apex Central™ Widget and Policy Management Guide

Note
If a detected portable executable file is in the Scan Exclusion list, thesystem does not apply any action on the file.

Scheduled Scan: Scan Exclusion Tab
Procedure1.

Select Enable scan exclusion.

2.

In the Scan Exclusion List (Directories) section, configure the required
settings.
a.

Select Exclude directories where Trend Micro products are
installed to automatically exclude directories associated with otherTrend Micro products.
For more information, see Trend Micro Product Directory Exclusions
on page 10-47.

b.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policy
Note
If your child policies Extend from parent, you can also
configure Child Policy Restrictions. Restrictions prevent thechild policy from adding specific objects to the list.

c.

Type a directory path to exclude from scans and click the + button.
The Security Agent does not scan files located in the specified
directory (and sub-directories).

10-36

Anti-malware Policy Settings

Note• You can specify a maximum of 256 directories to exclude fromscanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• Directory exclusions support the use of wildcard characters.
For more information, see Wildcard Exceptions on page 10-47.

3.

In the Scan Exclusion List (Files) section, configure the required
settings.
a.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policyb.

Type a file name or the file name with full directory path to exclude
from scans and click the + button.
Note• You can specify a maximum of 256 files to exclude fromscanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• File exclusions support the use of wildcard characters.
For more information, see Wildcard Exceptions on page 10-47.

4.

In the Scan Exclusion List (File Extensions) section, configure therequired settings.

10-37

Trend Micro Apex Central™ Widget and Policy Management Guidea.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policyb.

Select or type a file extension to exclude from scans and click the
Add > button.
Note• You can specify a maximum of 256 file extensions to exclude
from scanning.
• Use the Import and Export buttons to share the list withdifferent policies.
• For Manual Scan, Scheduled Scan, and Scan Now, use aquestion mark (?) to replace a single character or an asterisk (*)
to replace multiple characters as wildcard characters. For
example, if you do not want to scan all files with extensions
starting with D, such as DOC, DOT, or DAT, type D* or D??.

Scan Actions
You can configure Security Agents to use a set of predefined scan actions or
custom actions based on the detected malware type.
ImportantSome files are uncleanable.

For more information, see:

10-38

Anti-malware Policy Settings

ActiveAction
Different types of virus/malware require different scan actions. Customizing
scan actions requires knowledge about virus/malware and can be a tedioustask. The Security Agent uses ActiveAction to counter these issues.
ActiveAction is a set of pre-configured scan actions for viruses/malware. If
you are not familiar with scan actions or if you are not sure which scanaction is suitable for a certain type of virus/malware, Trend Microrecommends using ActiveAction.
Using ActiveAction provides the following benefits:• ActiveAction uses scan actions that are recommended by Trend Micro.
You do not have to spend time configuring the scan actions.
• Virus writers constantly change the way virus/malware attack endpoints.
ActiveAction settings are updated to protect against the latest threats andthe latest methods of virus/malware attacks.
The following table illustrates how ActiveAction handles each type of virus/
malware.
Table 10-2. Trend Micro Recommended Scan Actions Against Viruses and Malware
Real-time Scan

Manual Scan/Scheduled Scan

Virus/Malware
TypeFirst Action

Second Action

First Action

CVE exploit

Pass

N/A

N/A

N/A

Joke

Quarantine

N/A

Quarantine

N/A

Trojans

Quarantine

N/A

Quarantine

N/A

Virus

Clean

Quarantine

Clean

Quarantine

Test virus

Deny Access

N/A

Pass

N/A

PackerQuarantine

N/A

Quarantine

N/A

Others

Clean

Quarantine

Clean

Quarantine

SecondAction10-39

Trend Micro Apex Central™ Widget and Policy Management Guide

Virus/Malware
Type
Probable malware

Real-time Scan

Manual Scan/Scheduled Scan

First Action

Second Action

First Action

Deny Access oruser-configured
actionN/A

Pass or userconfigured
actionSecondActionN/A

Note• For probable virus/malware, the default action is “Deny Access” during
Real-time Scan and “Pass” during Manual Scan and Scheduled Scan. If
these are not your preferred actions, you can change them to“Quarantine”, “Delete”, or “Rename”.
• Some files are uncleanable.
• ActiveAction is not available for spyware/grayware scan.

Custom Scan Actions
ActionDescription

DeleteDeletes the infected file.

Quarantine

Renames and then moves the infected file to a temporary quarantine
directory on the endpoint.
The Security Agent then sends quarantined files to the designated quarantine
directory, which is on the managing server by default.
The Security Agent encrypts quarantined files sent to this directory.
For more information, see Quarantine Directory on page 10-41.

10-40Anti-malware Policy Settings

ActionClean

Description
Cleans the infected file before allowing full access to the file.
If the file is uncleanable, the Security Agent performs a second action, which
can be one of the following actions: “Quarantine”, “Delete”, “Rename”, and“Pass”.
This action can be performed on all types of security threats except probablevirus/malware.
Note
Some files are uncleanable. For details, see Uncleanable Files on page
10-43.

RenameChanges the infected file's extension to vir. Users cannot open the renamed
file initially, but can do so if they associate the file with a certain application.
The virus/malware may execute when opening the renamed infected file.

Pass

Performs no action on detected threats but records the detection in the logs.

Deny Access

When the Security Agent detects an attempt to open or execute an infected
file, it immediately blocks the operation.
Users can manually delete the infected file.

Quarantine Directory
If the action for an infected file is "Quarantine", the Security Agent encrypts
the file and moves it to a temporary quarantine folder located in <Agent
installation folder>\SUSPECT and then sends the file to the designatedquarantine directory.
Note
You can restore encrypted quarantined files in case you need to access themin the future.

10-41

Trend Micro Apex Central™ Widget and Policy Management Guide

Accept the default quarantine directory, which is located on the Apex One
server computer. The directory is in URL format and contains the server's
host name or IP address.
• If the server is managing both IPv4 and IPv6 agents, use the host nameso that all Security Agents can send quarantined files to the server.
• If the server only has or is identified by its IPv4 address, only pure IPv4
and dual-stack Security Agents can send quarantined files to the server.
• If the server only has or is identified by its IPv6 address, only pure IPv6
and dual-stack Security Agents can send quarantined files to the server.
You can also specify an alternative quarantine directory by typing thelocation in URL, UNC path, or absolute file path format. Security Agentsshould be able to connect to this alternative directory. For example, thealternative directory should have an IPv6 address if it will receive
quarantined files from dual-stack and pure IPv6 Security Agents. Trend
Micro recommends designating a dual-stack alternative directory,
identifying the directory by its host name, and using UNC path when typing
the directory.
Refer to the following table for guidance on when to use URL, UNC path, orabsolute file path:
Table 10-3. Quarantine Directory
Quarantine
Directory
A directory on the
managing server
computer

10-42

Accepted
FormatExampleURL

http://<osceserver>

UNC path\\<osceserver>\ofcscan\Virus

Notes
This is the default directory.
Configure settings for this directory,
such as the size of the quarantine
folder.

Anti-malware Policy Settings

Quarantine
Directory

Accepted
FormatExampleA directory on
another Apex One
server computer(if you have other
Apex One servers
on the network)

URL

http://<osceserver2>

UNC path\\<osceserver2>\
ofcscan\Virus

Another endpointon the network

UNC path\\<computer_name>\temp

A different
directory on the
Security Agent

Absolute
path

C:\temp

Notes
Ensure that Security Agents canconnect to this directory. If you
specify an incorrect directory, theSecurity Agent keeps thequarantined files on the SUSPECT
folder until a correct quarantine
directory is specified. In the server's
virus/malware logs, the scan result
is "Unable to send the quarantined
file to the designated quarantine
folder".
If you use UNC path, ensure that thequarantine directory folder isshared to the group "Everyone" andthat you assign read and write
permission to this group.

Uncleanable Files
The Virus Scan Engine is unable to clean the following files:
Table 10-4. Uncleanable File Solutions
Uncleanable File
Files infected with
Trojans

Explanation and Solution
Trojans are programs that perform unexpected or unauthorized,
usually malicious, actions such as displaying messages, erasing files,
or formatting disks. Trojans do not infect files, thus cleaning is notnecessary.
Solution: The Damage Cleanup Engine and Damage Cleanup Template
remove Trojans.

Files infected withworms

A worm is a self-contained program (or set of programs) able to spreadfunctional copies of itself or its segments to other endpoint systems.
The propagation usually takes place through network connections oremail attachments. Worms are uncleanable because the file is a selfcontained program.
Solution: Trend Micro recommends deleting worms.

10-43

Trend Micro Apex Central™ Widget and Policy Management Guide

Uncleanable File

Explanation and Solution

Write-protected
infected files

Solution: Remove the write-protection which allows for the cleaning of
the file.

Password-protected
files

Password-protected files include password-protected compressed
files or password-protected Microsoft Office files.
Solution: Remove the password protection which allows for thecleaning of the file.

Backup files

Files with the RB0~RB9 extensions are backup copies of infected files.
The cleaning process creates a backup of the infected file in case thevirus/malware damaged the file during the cleaning process.
Solution: If successfully cleaned, you do not need to keep the backup
copy of the infected file. If the endpoint functions normally, you candelete the backup file.

Infected files in the
Recycle Bin

The system may not allow the removal of infected files from the
Recycle Bin because the system is running.
1. Log on to the endpoint with Administrator privilege.
2. Close all running applications to prevent applications fromlocking the file, which would make Windows unable to delete it.
3. Open the command prompt.
4. Type the following to delete the files:
del /s \$Recycle.Bin\*

5. Check if the files were removed.
Infected files in
Windows Temp
Folder or Internet
Explorer Temporary
Folder

The system may not allow the cleaning of infected files in the Windows
Temp folder or the Internet Explorer temporary folder because theendpoint uses them. The files to clean may be temporary files needed
for Windows operation.
1. Log on to the endpoint with Administrator privilege.
2. Close all running applications to prevent applications fromlocking the file, which would make Windows unable to delete it.
3. If the infected file is in the Windows Temp folder:a. Open the command prompt.

10-44Anti-malware Policy Settings

Uncleanable File

Explanation and Solution
b. Type the following to delete the files:
del /s \Windows\Temp\*

c. Restart the endpoint in normal mode.
4. If the infected file is in the Internet Explorer temporary folder:a. Open a command prompt and go to the Internet Explorer
Temp folder.
• For Windows 7: %LocalAppData%\Microsoft\Windows\Temporary Internet Files• For Windows 8/8.1: %LocalAppData%\Microsoft\Windows\INetCache• For Windows 10: %LocalAppData%\Microsoft\Windows\INetCache\IE

b. Type the following to delete the files:
del /s .\*The last command deletes all files in the Internet Explorer
temporary folder.
c. Restart the endpoint in normal mode.
Files compressedusing anunsupported
compression format

Solution: Uncompress the files.

Locked files or files
that are currently
executing

Solution: Unlock the files or wait until the files have been executed.

Corrupted files

Solution: Delete the files.

Files Infected with Trojans
Trojans are programs that perform unexpected or unauthorized, usuallymalicious, actions such as displaying messages, erasing files, or formatting
disks. Trojans do not infect files, thus cleaning is not necessary.

10-45

Trend Micro Apex Central™ Widget and Policy Management Guide

Solution: The Security Agent uses the Damage Cleanup Engine and Damage
Cleanup Template to remove Trojans.

Files Infected with Worms
A worm is a self-contained program (or set of programs) able to spreadfunctional copies of itself or its segments to other endpoint systems. The
propagation usually takes place through network connections or email
attachments. Worms are uncleanable because the file is a self-contained
program.
Solution: Trend Micro recommends deleting worms.

Write-protected Infected Files
Solution: Remove the write-protection to allow the Security Agent to clean
the file.

Password-protected Files
Includes password-protected compressed files or password-protected
Microsoft Office files.
Solution: Remove the password protection to allow the Security Agent toclean these files.

Backup Files
Files with the RB0~RB9 extensions are backup copies of infected files. The
Security Agent creates a backup of the infected file in case the virus/malware
damaged the file during the cleaning process.
Solution: If the Security Agent successfully cleans the infected file, you do
not need to keep the backup copy. If the endpoint functions normally, you
can delete the backup file.

10-46

Anti-malware Policy Settings

Scan Exclusion Support
When excluding directories and file names from anti-malware scanning,refer to the following support information:

Trend Micro Product Directory Exclusions
If you select Exclude directories where Trend Micro products are installedin the Scan Exclusion List (Directories) section, the Security Agent
automatically excludes following product directories:• <Server installation folder>• IM Security• InterScan eManager 3.5x
• InterScan Web Security Suite• InterScan Web Protect• InterScan FTP VirusWall• InterScan Web VirusWall• InterScan NSAPI Plug-in• InterScan E-mail VirusWall• ScanMail eManager™ 3.11, 5.1, 5.11, 5.12
• ScanMail for Lotus Notes™ eManager NT• ScanMail™ for Microsoft Exchange

Wildcard Exceptions
Scan exclusion lists for files and directories support the use of wildcard
characters. Use the "?" character to replace one character and "*" to replace
several characters.
Use wildcard characters cautiously. Using the wrong character might exclude
incorrect files or directories. For example, adding C:\* to the Scan Exclusion
List (Files) would exclude the entire C:\ drive.
10-47

Trend Micro Apex Central™ Widget and Policy Management Guide

Table 10-5. Scan Exclusions Using Wildcard Characters
Value

Excluded

Not Excluded

c:\director*\fil\*.txtc:\directory\fil\doc.txt

c:\directory\file\

c:\directories\fil\files\document.txt

c:\directories\files\
c:\directory\file\doc.txt
c:\directories\files\document.txt

c:\director?
\file\*.txt

c:\directory\file\doc.txt

c:\directories\file\document.txt

c:\director?
\file\?.txt

c:\directory\file\1.txt

c:\directory\file\doc.txt

c:\*.txt

All .txt files in the C:\
directory

All other file types in the C:\
directory[]

Not supported

Not supported

10-48

c:\directories\file\document.txt

Chapter 11

Web Reputation Policy Settings
This section describes how to configure Web Reputation policies on Security
Agents.
Topics include:• Web Reputation on page 11-2
• Configuring a Web Reputation Policy on page 11-2

11-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Web Reputation
Web reputation technology tracks the credibility of web domains byassigning a reputation score based on factors such as a website's age,historical location changes, and indications of suspicious activities
discovered through malware behavior analysis. Trend Micro continually
analyzes websites and updates web reputation scores to prevent users fromaccessing potentially malicious content.
When a user attempts to access a website, the Security Agent queries a smart
protection source to ascertain the risk level of the content. The configured
Web Reputation policy for the Security Agent determines whether to allow
access to the website.
Web Reputation allows you to add websites that you consider safe or
dangerous to Approved or Blocked lists. The Security Agent does not query
web reputation scores for websites added to the lists but instead,
automatically allows or blocks access.

Configuring a Web Reputation Policy
Specify proxy server authentication credentials if you have set up a proxy
server to handle HTTP communication in your organization andauthentication is required before web access is allowed.
Procedure
1.

Click the External Agents tab to configure a policy for external agents or
the Internal Agents tab to configure a policy for internal agents.

2.

Under Enable Web Reputation on the following operating systems,
select the types of Windows platforms to protect (Windows desktop
platforms and Windows Server platforms).
Tip
Trend Micro recommends disabling Web Reputation for internal agents
if you already use a Trend Micro product with the web reputation
capability, such as InterScan Web Security Virtual Appliance.

11-2

Web Reputation Policy Settings

3.

Select Enable assessment mode.
Note
When in assessment mode, Security Agents allow access to all websites.
For any accessed website that violates the configured Security Level
setting, the Security Agent logs the event. Assessment mode allows you
to monitor website access and evaluate the safety of websites before
actively blocking users access. Based on your evaluation of the accesslogs, you can add trusted websites to the Approved URL List before
disabling assessment mode.

4.

Select Check HTTPS URLs.
Important
HTTPS URL scanning also supports the HTTP/2 protocol. Before Web
Reputation can check HTTPS or HTTP/2 URLs, you must configure someprerequisite settings for different browsers.
For more information, see HTTPS URL Scan Support on page 11-6.

5.

Select Scan common HTTP ports only to restrict web reputation
scanning to traffic through ports 80, 81, and 8080. By default, Web
Reputation scans all traffic through all ports.
Note
Not supported on Windows 7, 8, 8.1, 10, or Windows Server 2008 R2, 2012or later platforms.

6.

For internal Security Agents, select Send queries to Smart Protection
Servers if you want Security Agents to send web reputation queries to
Smart Protection Servers.
• If you enable this option:• Agents refer to the smart protection source list to determine
the Smart Protection Servers to which they send queries.
11-3

Trend Micro Apex Central™ Widget and Policy Management Guide• Be sure that Smart Protection Servers are available. If all SmartProtection Servers are unavailable, agents do not send queries
to Smart Protection Network. The only remaining sources of
web reputation data for agents are the approved and blocked
URL lists.
• Agents do not block untested websites. Smart Protection
Servers do not store web reputation data for these websites.
• If you disable this option:• Agents send web reputation queries to the Smart Protection
Network. Endpoints must have an Internet connection to send
queries successfully.
• Agents can block untested websites if you select the Blockpages that have not been tested by Trend Micro option.
Note
You can only configure internal on-premises Security Agents to send web
reputation queries to local Smart Protection Servers.

7.

Select from the available web reputation security levels: High, Medium,or LowNote
The security levels determine whether Web Reputation allows or blocks
access to a URL. For example, if you set the security level to Low, Web
Reputation only blocks URLs that are known to be web threats. As you set
the security level higher, the web threat detection rate improves but thepossibility of false positives also increases.

8.

11-4

If you disabled the Send queries to Smart Protection Servers option,
you can select Block pages that have not been tested by Trend Micro.

Web Reputation Policy Settings

Note
While Trend Micro actively tests web pages for safety, users may
encounter untested pages when visiting new or less popular websites.
Blocking access to untested pages can improve safety but can also
prevent access to safe pages.

9.

Select Block pages containing malicious script to identify web browser
exploits and malicious scripts, and prevent the use of these threats fromcompromising the web browser.
Web Reputation utilizes both the Browser Exploit Prevention pattern
and the Script Analyzer pattern to identify and block web pages before
exposing the system.
Important• The Browser Exploit Prevention feature only supports HTTP traffic
analysis for Internet Explorer, Microsoft Edge Legacy, Microsoft
Edge Chromium, Mozilla Firefox, and Chrome browsers.
• The Browser Exploit Prevention feature requires that you enable theAdvanced Protection Service.

10. Configure the approved and blocked lists.
Note
The approved list takes precedence over the blocked list. When a URL
matches an entry in the approved list, agents always allow access to the
URL, even if it is in the blocked list.

a.

Select Enable approved/blocked list.

b.

Type a URL.
You can add a wildcard character (*) anywhere on the URL.
For example:
11-5Trend Micro Apex Central™ Widget and Policy Management Guide• Typing www.trendmicro.com/* means that Web Reputation
approves all pages in the Trend Micro website.
• Typing *.trendmicro.com/* means that Web Reputation
approves all pages on any sub-domain of trendmicro.com.
You can type URLs containing IP addresses. If a URL contains an
IPv6 address, enclose the address in parentheses.
c.

Click Add to Approved List or Add to Blocked List.
Important
Web Reputation does not perform any scanning on addresses located in
the Approved and Blocked lists.

11. To submit Web Reputation feedback, click the URL provided under
Reassess URL. The Trend Micro Web Reputation Query system opens ina browser window.
12. Select whether to allow the Security Agent to send web reputation logs to
the server. Allow agents to send logs if you want to analyze URLs blockedby Web Reputation and take the appropriate action on URLs you think
are safe to access.

HTTPS URL Scan Support
HTTPS communication uses certificates to identify web servers. It encrypts
data to prevent theft and eavesdropping. Although more secure, accessing
websites using HTTPS still has risks. Compromised sites, even those withvalid certificates, can host malware and steal personal information. In
addition, certificates are relatively easy to obtain, making it easy to set up
malicious web servers that use HTTPS.
Important
HTTPS scanning for Internet Explorer only supports Windows 8.1 (or later)and Windows Server 2012 (or later) platforms operating in desktop mode.

11-6

Web Reputation Policy Settings

Enable checking of HTTPS URLs to reduce exposure to compromised andmalicious sites that use HTTPS. Web Reputation can monitor HTTPS traffic
on the following browsers:
Table 11-1. Supported Browsers for HTTPS Traffic
Browser

VersionMozilla Firefox

3.5 or later

ChromeLatest version

Microsoft Edge

Prerequisites
None• Legacy• Chromium

For more information on configuring Internet Explorer settings for Web
Reputation, see the following Knowledge Base articles:• http://success.trendmicro.com/solution/1060643• http://success.trendmicro.com/solution/1095350

11-7

Chapter 12

Unknown Threat Protection
This section describes how you can configure Security Agents to detect andprotect against previously unidentified, targeted, or low prevalence threats.
Topics include:• Predictive Machine Learning on page 12-2
• Configuring Sample Submission Settings on page 12-5
• Configuring Suspicious Connection Settings on page 12-6

12-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Predictive Machine Learning
Trend Micro Predictive Machine Learning uses advanced machine learningtechnology to correlate threat information and perform in-depth file analysis
to detect emerging unknown security risks through digital DNA
fingerprinting, API mapping, and other file features. Predictive Machine
Learning also performs a behavioral analysis on unknown or low-prevalence
processes to determine if an emerging or unknown threat is attempting to
infect your network.
Predictive Machine Learning is a powerful tool that helps protect yourenvironment from unidentified threats and zero-day attacks.
Detection Type
File

Description
After detecting an unknown or low-prevalence file, the Security Agentscans the file using the Advanced Threat Scan Engine (ATSE) to extract
file features and sends the report to the Predictive Machine Learning
engine, hosted on the Trend Micro Smart Protection Network. Throughuse of malware modeling, Predictive Machine Learning compares the
sample to the malware model, assigns a probability score, anddetermines the probable malware type that the file contains.
If a functional Internet connection is unavailable, Predictive Machine
Learning automatically switches to the local model to provide
constant unknown threat protection against portable executable file
threats.
Depending on how you configure Predictive Machine Learning, theSecurity Agent can attempt to “Quarantine” the affected file to preventthe threat from continuing to spread across your network.

12-2

Unknown Threat Protection

Detection Type
Process

Description
After detecting an unknown or low-prevalence process, the Security
Agent monitors the process using the Contextual Intelligence Engine,and sends the behavioral report to the Predictive Machine Learning
engine. Through use of behavioral malware modeling, Predictive
Machine Learning compares the process behavior to the model,
assigns a probability score, and determines the probable malware
type the process is executing.
Process detection also monitors script execution. If the Contextual
Intelligence Engine detects the execution of a suspicious script,
Predictive Machine Learning takes the configured action.
Predictive Machine Learning performs script blocking on the following
types of scripts:• cscript• jar• powershell• vbs• wscript
Depending on how you configure Predictive Machine Learning, theSecurity Agent can “Terminate” the affected process or script andattempt to clean the file that executed the process or script.

Configuring Predictive Machine Learning Settings
Note
Predictive Machine Learning requires that you enable the following services:• Unauthorized Change Prevention• Advanced Protection Service

Procedure1.

Select Enable Predictive Machine Learning.

12-3

Trend Micro Apex Central™ Widget and Policy Management Guide

2.

Under Detection Settings, select the type of detections and related
action that Predictive Machine Learning takes.
Detection Type
File

Actions• Quarantine: Select to automatically quarantine files thatexhibit malware-related features based on the Predictive
Machine Learning analysis• Log only: Select to scan unknown files and log the Predictive
Machine Learning analysis for further in-house investigationof the threat

Process• Terminate: Select to automatically terminate processes orscripts that exhibit malware-related behaviors based on thePredictive Machine Learning analysis
Important
Predictive Machine Learning attempts to clean thefiles that executed the malicious processes or scripts.
If the clean action is unsuccessful, Predictive
Machine Learning quarantines the affected files.
• Log only: Select to scan unknown processes or scripts andlog the Predictive Machine Learning analysis for further inhouse investigation of the threat3.

Under Exceptions, configure the global Predictive Machine Learning file
exceptions to prevent all agents from detecting a file as malicious.
a.

When configuring a parent policy, specify how other users canconfigure child policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additionalsettings to the settings inherited from the parent policy

12-4Unknown Threat Protection

Note
If your child policies Extend from parent, you can also
configure Child Policy Restrictions. Restrictions prevent thechild policy from adding specific objects to the list.

b.

Click Add File Hash.
The Add File to Exception List screen appears.
Note
Use the Import and Export buttons to share the list with different
policies.

c.

Specify the file SHA-1 hash value to exclude from scanning.

d.

Optionally provide a note regarding the reason for the exception or
to describe the file name(s) associated with the hash value.

e.

Click Add.
Predictive Machine Learning adds the file hash to the Exceptions
list.

Configuring Sample Submission Settings
You can configure Security Agents to submit file objects that may containpreviously unidentified threats to a Virtual Analyzer for further analysis.
After assessing the objects, Virtual Analyzer adds any objects found tocontain unknown threats to the Virtual Analyzer Suspicious Objects lists anddistributes the lists to other Security Agents throughout the network.
Suspicious files include any of the following:• Programs not known to Trend Micro (downloaded through supported
web browsers or email channels)• Heuristic detections of processes (downloaded through supported webbrowsers or email channels)

12-5Trend Micro Apex Central™ Widget and Policy Management Guide• Low prevalence autorun programs on removable storage
Important
The size of the sample files that the Security Agents can submit changes basedon the type of Virtual Analyzer you use. For the Deep Discovery Analyzer
server, sample files can be up to 50 MB in size. For Deep Discovery Analyzer asa Service Add-on, sample files can be up to 60 MB in size.

Procedure1.

Select Enable suspicious file submission to Virtual Analyzer.

Configuring Suspicious Connection Settings
Security Agents can log and block all connections made between endpoints
and addresses in the Global C&C IP list. You can also log, but still allow
access to, IP addresses configured in the User-defined Blocked IP List.
Security Agents can also monitor connections that may be the result of abotnet or other malware threat. After detecting a malware threat, Security
Agents can attempt to clean the infection.
Procedure
1.

Enable the Detect network connections made to addresses in the
Global C&C IP list setting to monitor connections made to Trend Microconfirmed C&C servers and select to Log only or Block connections.
• To allow agents to connect to addresses in the User-defined Blocked
IP list, enable the Log and allow access to User-defined Blocked IP
list addresses setting.
Note
You must enable network connection logging before Security Agents canallow access to addresses in the User-defined Blocked IP list.

12-6

Unknown Threat Protection

2.

Enable the Detect connections using malware network fingerprinting
setting and select to Log only or Block connections.
• To allow Security Agents to attempt to clean connections made to
C&C servers, enable the Clean suspicious connections when a C&C
callback is detected setting. Security Agents use GeneriClean toclean the malware threat and terminate the connection to the C&C
server.
Note
You must enable Log connections using malware network
fingerprinting before Security Agents can attempt to clean theconnections made to C&C servers detected by packet structure matching.

12-7

Chapter 13

Device Control Policy Settings
This section describes how to configure Device Control policies on Security
Agents.
Topics include:• Device Control on page 13-2
• Configuring Device Control Settings on page 13-2

13-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Device Control
Device Control regulates access to external storage devices and network
resources connected to computers. Device Control helps prevent data loss
and leakage and, combined with file scanning, helps guard against security
risks.
You can configure Device Control policies for internal and external agents.
Administrators typically configure a stricter policy for external agents.
Apex Central provides both endpoint-based and user-based Device Control
policy configuration.

Configuring Device Control Settings
Procedure1.

Select Enable Device Control.
• If you are on the External Agents tab, you can apply settings tointernal agents by selecting Apply all settings to internal agents.
• If you are on the Internal Agents tab, you can apply settings toexternal agents by selecting Apply all settings to external agents.

2.

Add or edit a Device Control rule:• For user-based rules:• To create a rule based on Active Directory user or groupaccounts, click Add.
• To edit a rule based on Active Directory user or group accounts,
click the link in the User Accounts column.
ImportantUser-based Device Control rules are only available after integrating
Active Directory with Apex Central.

• To edit the default endpoint-based rule:13-2

Device Control Policy Settings• Click the All users (default) link in the User Accounts column.
Note
You cannot delete the default endpoint-based rule.

The Device Control Rule screen appears.
3.

In the User Accounts section, type and select the display name(s) of the
Active Directory user(s) or group account(s) to which the rule applies.
Note
You cannot specify user or group accounts when editing the default All
users (default) endpoint-based rule.

4.

In the Storage Devices section:a.

Select a permission for each storage device.
Important• Only Security Agents with Data Protection enabled can take the“Block” action. If you deploy a policy to Security Agents that do
not have Data Protection enabled, Apex One applies the action
configured in the drop-down box.
• Apex One automatically applies the access permission
configured for any USB device in the Allowed USB List even if
you do not enable Data Protection.

For details about permissions, see Permissions for Devices on page
13-5.
If you selected to restrict access to any storage device, the Allowed
Programs button appears. For USB storage devices, if you selected
Block (Data Protection), the Allowed USB Devices button appears.
b.

(Optional) Click Allowed Programs to configure a list of programs
that Device Control does not restrict access on any device type.
13-3

Trend Micro Apex Central™ Widget and Policy Management Guide

The Allowed Programs screen appears.
1. Type the full path or the trusted Digital Signature Provider
information of programs that Device Control allows users toaccess.
Note• When specifying a Digital Signature Provider, Device
Control only allows programs signed by the publisher to
Execute.
For more information, see Specifying a Digital Signature
Provider on page 13-8.
• When specifying the full path of a program, the Device
Control Allowed Programs list supports the use of
wildcard characters.
For more information, see Wildcard Support for the Device
Control Allowed Programs List on page 13-7.

2. Click Add.
The the full path of the program or the trusted Digital Signature
Provider information appears in the list.
3. Select whether to allow the program to Execute or Read/Write.
4. Click OK.
c.

(Optional) Click Allowed USB Devices to configure a list of USB
devices that Device Control does not block.
The Allowed USB Devices screen appears.
1. Type the device vendor, model, and serial ID in the list.
2. To add more devices, click the plus (+) icon.
3. In the Permissions drop-down, specify the access level Device
Control permits to users accessing the specified USB devices.

13-4

Device Control Policy Settings

4. Click OK.
d.

Select Block the AutoRun function on USB storage devices toprevent programs saved on USB devices from executing
automatically.

e.

Select Display a notification message on the endpoint when Apex
One detects unauthorized device access to inform end users that
Device Control restricted access to a device.

5.

For Security Agents with the Data Protection feature installed, select toAllow or Block access to the devices listed under Mobile Devices and
Non-Storage Devices.

6.

Click OK.
Note
Device Control automatically assigns all user-based rules a higher
priority than the default endpoint-based rule (All users (default)).

7.

(Optional) Manage the Device Control rule list.
• Priority: Click the arrows to change the priority of user-based rules.
• Copy: Select a rule, click Copy, and modify the rule contents.
• Delete: Select a rule and click Delete to permanently remove therule from the list.

Permissions for Devices
Device Control permissions for storage devices are used when you:
• Allow access to USB storage devices, CD/DVD, floppy disks, and network
drives. You can grant full access to these devices or limit the level ofaccess.
• Configure the list of approved USB storage devices. Device Control
allows you to block access to all USB storage devices, except those thathave been added to the list of approved devices. You can grant fullaccess to the approved devices or limit the level of access.
13-5

Trend Micro Apex Central™ Widget and Policy Management Guide

The following table lists the permissions for storage devices.
Table 13-1. Device Control Permissions for Storage Devices
Permissions
Full access

Files on the Device

Incoming Files

Permitted operations: Copy, Move,
Open, Save, Delete, Execute

Permitted operations: Save, Move,
Copy
This means that a file can be saved,
moved, and copied to the device.

ModifyPermitted operations: Copy, Move,
Open, Save, Delete

Permitted operations: Save, Move,
Copy

Prohibited operations: Execute
Read and execute

Permitted operations: Copy,
Open, Execute

Prohibited operations: Save, Move,
Copy

Prohibited operations: Save,
Move, Delete
Read

Permitted operations: Copy, Open
Prohibited operations: Save,
Move, Delete, Execute

List device content
only

Prohibited operations: All
operations

Prohibited operations: Save, Move,
Copy

Prohibited operations: Save, Move,
Copy

The device and the files it contains
are visible to the user (forexample, from Windows Explorer).
Block(available after
installing Data
Protection)

Prohibited operations: All
operations

Prohibited operations: Save, Move,
Copy

The device and the files it contains
are not visible to the user (forexample, from Windows Explorer).

File-based scanning complements, and may override, the device
permissions. For example, if the permission allows a file to be opened but
the Security Agent detects that the file is infected with malware, a specificscan action is performed on the file to eliminate the malware. If the scan

13-6

Device Control Policy Settings

action is Clean, the file opens after it is cleaned. However, if the scan action
is Delete, the file is deleted.
The following table lists the permissions for mobile and non-storage devices
managed by Data Protection.
Table 13-2. Device Control Permissions for Mobile and Non-storage Devices
Permissions
Allow

Files on the Device

Incoming Files

Permitted operations: Copy, Move,
Open, Save, Delete, Execute

Permitted operations: Save, Move,
Copy
This means that a file can be saved,
moved, and copied to the device.

Block

Prohibited operations: All
operations

Prohibited operations: Save, Move,
Copy

The device and the files it contains
are not visible to the user (forexample, from Windows Explorer).

Tip
Device Control for Data Protection supports all 64-bit platforms. For
Unauthorized Change Prevention monitoring on systems that the Security
Agent does not support, set the device permission to Block to limit access tothese devices.

Wildcard Support for the Device Control Allowed Programs List
A program path and name should have a maximum of 259 characters andmust only contain alphanumeric characters (A-Z, a-z, 0-9). It is not possible
to specify only the program name.
You can use wildcards in place of drive letters and program names. Use aquestion mark (?) to represent single-character data, such as a drive letter.
Use an asterisk (*) to represent multi-character data, such as a program
name.

13-7

Trend Micro Apex Central™ Widget and Policy Management Guide

Note
Wildcards cannot be used to represent folder names. The exact name of afolder must be specified.

Wildcards are used correctly in the following examples:
Table 13-3. Correct Usage of Wildcards
ExampleMatched Data?:\Password.exe

The "Password.exe" file located directly under any drive

C:\Program Files\Microsoft\*.exe

Any file in C:\Program Files that has a file extension

C:\Program Files\*.*Any file in C:\Program Files that has a file extension

C:\Program Files\a?c.exe

Any .exe file in C:\Program Files that has 3 charactersstarting with the letter "a" and ending with the letter "c"C:\*

Any file located directly under the C:\ drive, with orwithout file extensions

Wildcards are used incorrectly in the following examples:
Table 13-4. Incorrect Usage of Wildcards
ReasonExample??:\Buffalo\Password.exe?? represents two characters and drive letters only have asingle alphabetic character.

*:\Buffalo\Password.exe* represents multi-character data and drive letters only
have a single alphabetic character.

C:\*\Password.exe

Wildcards cannot be used to represent folder names. The
exact name of a folder must be specified.

C:\?\Password.exe

Specifying a Digital Signature Provider
Specify a Digital Signature Provider if you trust programs issued by theprovider. For example, type Microsoft Corporation or Trend Micro, Inc. You
can obtain the Digital Signature Provider by checking the properties of a
13-8

Device Control Policy Settings

program (for example, by right-clicking the program and selecting
Properties).

13-9

Chapter 14

Scan Exclusion Lists
This section describes how to configure scan exclusion lists that apply tomultiple scan features.
Topics include:• Spyware/Grayware Approved List on page 14-2
• Trusted Program List on page 14-2

14-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Spyware/Grayware Approved List
The Security Agent provides a list of "approved" spyware/grayware, whichcontains files or applications that you do not want treated as spyware orgrayware. When a particular spyware/grayware is detected during scanning,
the Security Agent checks the approved list and performs no action if it finds
a match in the approved list.
Apply the approved list to one or several Security Agents and domains, or to
all Security Agents that the server manages. The approved list applies to allscan types, which means that the same approved list will be used during
Manual Scan, Real-time Scan, Scheduled Scan, and Scan Now.

Managing the Spyware/Grayware Approved List
Procedure
1.

On the Spyware/Grayware names table, select a spyware/grayware
name. To select multiple names, hold the CTRL key while selecting.
• You can also type a keyword in the Search field and click Search.
The table refreshes with names that match the keyword.

2.

Click Add.
The names move to the Approved List table.

3.

To remove names from the approved list, select the names and click
Remove. To select multiple names, hold the CTRL key while selecting.

Trusted Program List
You can configure Security Agents to skip scanning of trusted processes
during Application Control, Behavior Monitoring, Device Control, Endpoint
Sensor, and Real-time Scans. After adding a program to the Trusted Programs
List, the Security Agent does not subject the program or any processes
initiated by the program to Real-time Scan. Add trusted programs to theTrusted Program List to improve the performance of scanning on endpoints.
14-2

Scan Exclusion Lists

Note
You can add files to the Trusted Programs List if the following requirements
are met:• The file is not located in the Windows system directory.
• The file has a valid digital signature.

After adding a program to the Trusted Programs List, the Security Agent
automatically excludes the program from the following scans:• Application Control (configurable only on the Apex Central console)• Behavior Monitoring• Device Control• Endpoint Sensor (configurable only on the Apex Central console)• Real-time Scan: file checking and process scanning

Configuring the Trusted Programs List
The Trusted Programs List excludes programs and all child processes calledby the program from Application Control, Behavior Monitoring, Device
Control, Endpoint Sensor, and Real-time Scan.
Procedure
1.

When configuring a parent policy, specify how other users can configurechild policies.
• Inherit from parent: Child policies must use the settings
configured in the parent policy• Extend from parent: Child policies can append additional settings
to the settings inherited from the parent policy

14-3

Trend Micro Apex Central™ Widget and Policy Management GuideNote
If your child policies Extend from parent, you can also configureChild Policy Restrictions. Restrictions prevent the child policy
from adding specific objects to the list.

14-4

2.

Type the full program path of the program to exclude from the list.

3.

Click Add to Trusted Program List.

4.

To remove a program from the list, click the Delete icon.

Chapter 15

Endpoint Sensor Policy Settings
This section discusses how to configure Endpoint Sensor policies on Security
Agents.
Topics include:

15-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Endpoint Sensor
Endpoint Sensor is a powerful monitoring and investigation tool used to
identify the presence, location, and entry point of threats. Through the useof detailed system event recording and historical analysis, you can perform
Historical Investigations to discover hidden threats throughout your networkand locate all affected endpoints. Generate Root Cause Analysis reports tounderstand the nature and activity of the malware since the threat entered
the endpoint.
You can also perform Live Investigations through the use of shared IOC files
and YARA rules. Live Investigations conduct in-depth searches of endpoints
to locate previously unidentified threats and possible Advanced PersistentThreat attacks.

Configuring Endpoint Sensor Settings
Important
The Endpoint Sensor feature requires special licensing and additional system
requirements. Ensure that you have the correct license before deploying
Endpoint Sensor policies to endpoints. For more information on how to
obtain licenses, contact your support provider.
If your environment manages both Apex One on-premises and Apex One as aService Security Agents, some features may be different compared to Apex
One as a Service. Apex One as a Service Security Agents continue to send data
to Trend Micro servers but investigation capabilities may differ from the Apex
Central as a Service console.

Procedure1.

Select Enable Endpoint Sensor.

2.

Select Enable event recording to begin collecting system event logs on
the agent endpoint. (on-premises only)
Endpoint Sensor uses the real-time event logs to identify at-risk
endpoints when performing investigations. After identifying affected15-2

Endpoint Sensor Policy Settings

Windows endpoints, you can perform an in-depth root cause analysis tobetter understand possible attack vectors.
OptionDescription

Maximum databasesize(on-premises only)

Specify the maximum database size that Endpoint Sensor canuse to store event logs on the endpoint. Once the agent
database reaches the maximum size limit, Endpoint Sensor
purges the oldest logs to make space for new event entries.

Send a subset of log
data to perform
HistoricalInvestigations

The information sent to the server consists of metadata, such as
domain, files, or processes on the endpoint. Endpoint Sensor
utilizes the data during Historical Investigations to identify
affected endpoints.

(on-premises only)• Upload frequency: Specify how often the agent uploads
the metadata to the server.
Note
Depending on your network, more frequent
uploads may affect network performance.
• Additional hash types: Specify if Endpoint Sensor also
calculates and sends SHA-256 and MD5 hashes to theserver. By default, Endpoint Sensor sends SHA1 hashes
only.
Note
Selecting additional hash types takes up more
database space.

Enable Attack
Discovery to detectknown attack
indicators on
endpoints

Attack Discovery uses Trend Micro threat intelligence based on
Indicators of Attack (IoA) behaviors. After detecting a known
IoA, Attack Discovery logs the detection.

15-3

Chapter 16

Vulnerability Protection Policy Settings
This section discusses how to configure Vulnerability Protection policies on
Security Agents.
Topics include:• Vulnerability Protection on page 16-2
• Configuring Vulnerability Protection Settings on page 16-2

16-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Vulnerability Protection
Integration with Vulnerability Protection protects Apex One users byautomating the application of virtual patches before official patches become
available. Trend Micro provides protected endpoints with recommended
Intrusion Prevention rules based on your network performance and security
priorities.

Configuring Vulnerability Protection Settings
Procedure1.

Select Enable Vulnerability Protection.

2.

Configure intrusion prevention settings:a.

Click the Intrusion Prevention Rules tab.

b.

Select one of the following scanning profiles:• Recommended: Ensures protection against known
vulnerability issues, provides more relevant data, and reduces
performance impact on endpoints• Aggressive: Applies additional Intrusion Prevention Rules for
suspicious network activities to the Recommended scanningprofileImportantAggressive scanning may generate a large number ofnonessential logs and impact endpoint performance. Trend
Micro strongly advises using the Recommended profile.

c.

(Optional) Select a view to filter the list of Intrusion Prevention
Rules by status.
View
All

16-2

Description
Displays all Intrusion Prevention Rules

Vulnerability Protection Policy Settings

d.

View

Description

Default (Enabled)

Displays only the Intrusion Prevention Rules that the selectedscanning profile enables by default

Default (Disabled)

Displays only the Intrusion Prevention Rules that the selectedscanning profile disables by default

User-defined(Enabled)

Displays only the Intrusion Prevention Rules enabled by theuser

User-defined(Disabled)

Displays only the Intrusion Prevention Rules disabled by theuser

Modify the status of a rule by selecting from the Status drop-down
control.
• Default (Enabled): The selected scanning profile enables thecorresponding rule by default. Select to apply the rule status
defined by the scanning profile.
• Default (Disabled): The selected scanning profile disables thecorresponding rule by default. Select to apply the rule status
defined by the scanning profile.
• User-defined (Enabled): Select to enable the rule.
• User-defined (Disabled): Select to disable the rule.

3.

Configure network engine settings:a.

Click the Network Engine Settings tab.

b.

Select the Network Engine Detection Mode*.
Note
You can also use the selected Network Engine Detection Mode toconfigure the Advanced Logging Policy.

• Inline: Live packet streams pass directly through the
Vulnerability Protection network engine. All rules are applied

16-3

Trend Micro Apex Central™ Widget and Policy Management Guide

to the network traffic before the packets proceed up the
protocol stack.
• Tap (Detect-only): Live packet streams are replicated anddiverted from the main stream.
c.

Configure the following settings:
Setting

16-4

Description

ESTABLISHED Timeout

How long to stay in the ESTABLISHED state before
closing the connection

LAST_ACK Timeout

How long to stay in the LAST-ACK state before closing
the connection

Cold Start Timeout

The amount of time to allow non-SYN packets that
could belong to a connection that was established
before the stateful mechanism was started

UDP Timeout

The maximum duration of a UDP connection

Maximum TCP
Connections

The maximum number of simultaneous TCP
connections

Maximum UDP
Connections

The maximum number of simultaneous UDP
connections

Ignore Status Code

Select up to 3 types of events to ignoreVulnerability Protection Policy Settings

Setting
Advanced Logging Policy

Description
Select from the following settings:• Bypass: No filtering of events. Overrides the
Ignore Status Code settings (above) and otheradvanced settings, but does not override logging
settings defined on the Apex One server• Network Engine Detection Mode*: Uses Tap
Mode if Tap (Detect-only) is selected for the
Network Engine Detection Mode, or Normal if
Inline is selected for the Network Engine
Detection Mode
• Normal: All events are logged except dropped
retransmits• Backwards Compatibility Mode: For support use
only• Verbose Mode: Same as Normal but including
dropped retransmits• Stateful and Normalization Suppression:
Ignores dropped retransmit, out of connection,
invalid flags, invalid sequence, invalid ack,
unsolicited udp, unsolicited ICMP, out of allowed
policy• Stateful, Normalization, and Frag Suppression:
Ignores everything that Stateful andNormalization Suppression ignores as well as
events related to fragmentation• Stateful, Frag, and Verifier Suppression:
Ignores everything Stateful, Normalization, andFrag Suppression ignores as well as verifierrelated events• Tap Mode: Ignores dropped retransmit, out ofconnection, invalid flags, invalid sequence,
invalid ack, max ack retransmit, packet on closed
connection
For a more comprehensive list of which events are
ignored for Stateful and Normalization Suppression,
Stateful, Normalization, and Frag Suppression,
Stateful, Frag, and Verifier Suppression, and Tap
16-5

Trend Micro Apex Central™ Widget and Policy Management Guide

Setting

Description
Mode, see Advanced Logging Policy Modes on page
16-6.

4.

Click Save to apply settings.

Advanced Logging Policy Modes
The following table lists the types of Events that are ignored in four of themore complex Advanced Logging Policy modes.
ModeStateful and Normalization
Suppression

Ignored Events
Out Of Connection
Invalid Flags
Invalid Sequence
Invalid ACK
Unsolicited UDP
Unsolicited ICMPOut Of Allowed Policy
Dropped Retransmit

Stateful, Normalization, andFrag Suppression

Out Of Connection
Invalid Flags
Invalid Sequence
Invalid ACK
Unsolicited UDP
Unsolicited ICMPOut Of Allowed Policy
CE Flags

16-6

Vulnerability Protection Policy Settings

Mode

Ignored Events
Invalid IP
Invalid IP Datagram Length
Fragmented
Invalid Fragment Offset
First Fragment Too Small
Fragment Out Of Bounds
Fragment Offset Too Small
IPv6 Packet
Max Incoming Connections
Max Outgoing Connections
Max SYN Sent
License Expired
IP Version Unknown
Invalid Packet Info
Maximum ACK Retransmit
Packet on Closed Connection
Dropped Retransmit

Stateful, Frag, and Verifier
Suppression

Out Of Connection
Invalid Flags
Invalid Sequence
Invalid ACK
Unsolicited UDP
Unsolicited ICMP

16-7

Trend Micro Apex Central™ Widget and Policy Management Guide

Mode

Ignored Events
Out Of Allowed Policy
CE Flags
Invalid IP
Invalid IP Datagram Length
Fragmented
Invalid Fragment Offset
First Fragment Too Small
Fragment Out Of Bounds
Fragment Offset Too Small
IPv6 Packet
Max Incoming Connections
Max Outgoing Connections
Max SYN Sent
License Expired
IP Version Unknown
Invalid Packet Info
Invalid Data Offset
No IP Header
Unreadable Ethernet Header
Undefined
Same Source and Destination IP
Invalid TCP Header Length
Unreadable Protocol Header

16-8

Vulnerability Protection Policy Settings

Mode

Ignored Events
Unreadable IPv4 Header
Unknown IP Version
Maximum ACK Retransmit
Packet on Closed Connection
Dropped Retransmit

Tap Mode

Out Of Connection
Invalid Flags
Invalid Sequence
Invalid ACK
Maximum ACK Retransmit
Packet on Closed Connection
Dropped Retransmit

16-9

Part VI
Apex One Data Loss Prevention
Policies

Chapter 17

Apex One Data Discovery Dashboard
Widgets
This section contains help topics for the Apex One Data Discovery dashboard
widgets supported in Apex Central.
Topics include:• Top Sensitive File Policy Detections Widget on page 17-2
• Top Endpoints with Sensitive Files Widget on page 17-3
• Top Data Discovery Template Matches Widget on page 17-5
• Top Sensitive Files Widget on page 17-6

17-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Top Sensitive File Policy Detections Widget
This widget displays information about Data Discovery policy violation
detections and the sensitive files that triggered the rules.
Note
By default, the widget displays data from all the managed products that a user
account has privileges to view.

Use the Range drop-down to select the time period for the data that displays.
• To specify a custom time range or time interval, click the settings icon
( > ) and select Customized for the Range.
Use the Rule drop-down to specify the rule that triggered the detection.
• To specify the number of rules that display, click the settings icon () and select from the Rules to display drop-down.
• To aggregate the remaining data, click the settings icon (select Display the remaining data as "Others".

>

>

) and

You can choose to display the data in a table, bar chart, pie chart, or line
chart by clicking the display icons ().
The default view displays the following information in a table.
Column Name

Description

Rule Name

Displays the rules triggered by sensitive files.

Detections

Displays the number of times the rule is triggered
Click the Detections column name to sort the table by the number ofdetections.
Click the number to view detailed information about the detection(when the detection occurs, the sensitive files detected).

Percentage

17-2

Displays the number of times that the rule is triggered as a percentageof the total number of detections

Apex One Data Discovery Dashboard Widgets

Click a number in the Detections column or click a chart section to view
detailed information.
Data

Description

Received

The time and date Apex Central received the data

Generated

The time and date the detection occurred

Rule

The rule that is triggered

Endpoint

The endpoint that triggered the rule

DomainThe domain that triggered the rule

User

The user that triggered the rule

User Domain

The domain that the user belongs toFile Path

The file path for the sensitive fileFile

The name of the sensitive file

Template

The template that the rule belongs to

ActionThe action taken on the sensitive file

Top Endpoints with Sensitive Files Widget
This widget displays information about endpoints with sensitive files thattriggered Data Discovery policy violation detections.
Note
By default, the widget displays data from all the managed products that a user
account has privileges to view.

Use the Range drop-down to select the time period for the data that displays.
• To specify a custom time range or time interval, click the settings icon
( > ) and select Customized for the Range.
Use the Rule drop-down to specify the rule that triggered the detection.
17-3

Trend Micro Apex Central™ Widget and Policy Management Guide• To specify the number of templates that display, click the settings icon
( > ) and select from the Endpoints to display drop-down.
• To aggregate the remaining data, click the settings icon (select Display the remaining data as "Others".

>

) and

You can choose to display the data in a table, bar chart, or pie chart byclicking the display icons ().
The default view displays the following information in a table.
Column Name

Description

Endpoints

Displays the endpoint with sensitive files that triggered the rule

Detections

Displays the number of times the rule is triggered
Click the Detections column name to sort the table by the number ofdetections.

Percentage

Displays the number of times that the rule is triggered as a percentageof the total number of detections

Click a number in the Detections column or click a chart section to view
detailed information.
Description

Data

17-4

Received

The time and date Apex Central received the data

Generated

The time and date the detection occurred

Rule

The rule that is triggered

Endpoint

The endpoint that triggered the rule

DomainThe domain that triggered the rule

User

The user that triggered the rule

User Domain

The domain that the user belongs toFile Path

The file path for the sensitive fileApex One Data Discovery Dashboard Widgets

Data

Description

File

The name of the sensitive file

Template

The template that the rule belongs to

ActionThe action taken on the sensitive file

Top Data Discovery Template Matches Widget
This widget displays information about the top Data Discovery template
policy violations over time.
Note
By default, the widget displays data from all the managed products that a user
account has privileges to view.

Use the Range drop-down to select the time period for the data that displays.
• To specify a custom time range or time interval, click the settings icon
( > ) and select Customized for the Range.
Use the Rule drop-down to specify the rule that triggered the detection.
• To specify the number of templates that display, click the settings icon
( > ) and select from the Templates to display drop-down.
• To aggregate the remaining data, click the settings icon (select Display the remaining data as "Others".

>

) and

You can choose to display the data in a table, bar chart, or pie chart by).
clicking the display icons (The default view displays the following information in a table.
Column Name
Templates

Description
Displays the template triggered by sensitive files

17-5Trend Micro Apex Central™ Widget and Policy Management Guide

Column Name
Detections

Description
Displays the number of times that the template is triggered
Click the Detections column name to sort the table by the number ofdetections.

Percentage

Displays the number of times that the template is triggered as apercentage of the total number of detections

Click a number in the Detections column or click a chart section to view
detailed information.
Data

Description

Received

The time and date Apex Central received the data

Generated

The time and date the detection occurred

Rule

The rule that is triggered

Endpoint

The endpoint that triggered the rule

DomainThe domain that triggered the rule

User

The user that triggered the rule

User Domain

The domain that the user belongs toFile Path

The file path for the sensitive fileFile

The name of the sensitive file

Template

The template that the rule belongs to

ActionThe action taken on the sensitive file

Top Sensitive Files Widget
This widget displays information about the top sensitive files that triggered
Data Discovery policy violations over time.

17-6

Apex One Data Discovery Dashboard Widgets

Note
By default, the widget displays data from all the managed products that a user
account has privileges to view.

Use the Range drop-down to select the time period for the data that displays.
• To specify a custom time range or time interval, click the settings icon
( > ) and select Customized for the Range.
Use the Rule drop-down to specify the rule that triggered the detection.
• To specify the number of detections that display, click the settings icon
( > ) and select from the Sensitive files to display drop-down.
• To aggregate the remaining data, click the settings icon (select Display the remaining data as "Others".

>

) and

You can choose to display the data in a table, bar chart, or pie chart byclicking the display icons ().
The default view displays the following information in a table.
Column Name

Description

File

Displays the sensitive files potentially leaked

Detections

Displays the number of times that the sensitive file has beenpotentially leaked
Click the Detections column name to sort the table by the number ofdetections.

Percentage

Displays the number of times that the sensitive file has beenpotentially leaked as a percentage of the total number of detections

Click a number in the Detections column or click a chart section to view
detailed information.
Data
Received

Description
The time and date Apex Central received the data

17-7

Trend Micro Apex Central™ Widget and Policy Management Guide

Data

17-8

Description

Generated

The time and date the detection occurred

Rule

The rule that is triggered

Endpoint

The endpoint that triggered the rule

DomainThe domain that triggered the rule

User

The user that triggered the rule

User Domain

The domain that the user belongs toFile Path

The file path for the sensitive fileFile

The name of the sensitive file

Template

The template that the rule belongs to

ActionThe action taken on the sensitive fileChapter 18

Apex One Data Discovery Policy Settings
This section discusses how to configure Apex One Data Discovery policy
settings in Apex Central.
Topics include:• Creating Data Discovery Policies on page 18-2

18-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Creating Data Discovery Policies
Data Discovery searches databases, endpoints, and document management
systems for the presence of sensitive information. Data Discovery widgets
display data loss prevention compliance with an enterprise's policy. Using
Data Discovery policies and widgets allows administrators to perform
remediation actions on their network.
Note
Performing a full scan of an endpoint drive or directory can cause significant
system slowdown for end users.

Procedure1.

Select Enable Data Discovery.

2.

Click Add.
The Data Discovery Policy Settings screen appears.

3.

Select Enable this rule.

4.

Specify a name for the rule.

5.

Configure the target folder settings:a.

Click the Target Folder tab.
Note
The root folder cannot be a Windows shared folder or removabledevice (USB device or DVD).

b.

18-2

In the File Path section, specify the scan location for files.

Apex One Data Discovery Policy Settings

Note
Data Discovery does not scan autoexec.bat files located in thefollowing directories:• \Documents and Settings\*\Application Data\• \Documents and Settings\*\Local Settings\• \Documents and Settings\*\Cookies\• \Program Files\• \Windows\• \Winnt\• \Users\*\AppData\• \ProgramData\c.

In the File Type Exceptions section, specify scanning exceptions.
• Scan: Specify specific files or file types to scan.
• Do not scan: Specify specific files, file types, or folders that
Data Discovery will not scan.
Note• Data Discovery supports the following wildcard characters:• *: Substitute for any and all characters before or after the *• ?: Substitute for a single character or a single double-bytecharacter• Separate multiple entries with pipes ( | ) and use the following
format:• For files: *.<file extension> (for example: *.exe|*.doc)• For folders: Specify a file path (for example: *\Test\*|C:\MyDocs\)

18-3

Trend Micro Apex Central™ Widget and Policy Management Guide

Configure the template settings:
6.

Configure the template settings:a.

Click the Template tab.

b.

Select templates from the Available templates list and then click
Add.
When selecting templates:• Select multiple entries by clicking the template names whichhighlights the name.
• Use the search feature if you have a specific template in mind.
You can type the full or partial name of the template.
Note• Each rule can contain a maximum of 500 templates.
• your preferred template is not found in the Available templates
list, go to Policies > Policy Resources > DLP Templates andcreate a new template.

7.

Configure the action settings:a.

Click the Action tab.

b.

Select Monitor to record detections for analysis.

c.

(Optional) Select Encrypt to encrypt sensitive files using one of thefollowing methods:• User key• Group key• Encryption password: The encryption password is a global
password for all Apex One servers. Click Create encryption
password to configure a password.

18-4

Apex One Data Discovery Policy Settings

Important
The File Encryption feature in Endpoint Encryption is deprecatedand may not be available for new installation instances.

8.

9.

Configure the schedule for the scan:a.

Click the Schedule tab.

b.

Specify the frequency of the scan.

c.

Specify the time that the scan starts.

Click Save to apply settings.

18-5

Chapter 19

Apex One Data Loss Prevention Policy
Settings
This section describes how to configure Data Loss Prevention policies for
Security Agents.
Topics include:• Data Loss Prevention (DLP) on page 19-2
• Configuring a Data Loss Prevention Policy on page 19-3

19-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Data Loss Prevention (DLP)
Traditional security solutions are focused on preventing external security
threats from reaching the network. In today’s security environment, this is
only half the story. Data breaches are now commonplace, exposing anorganization’s confidential and sensitive data – referred to as digital assets –to outside unauthorized parties. A data breach may occur as a result ofinternal employee mistakes or carelessness, data outsourcing, stolen or
misplaced computing devices, or malicious attacks.
Data breaches can:• Damage brand reputation• Erode customer trust in the organization• Result in unnecessary costs to cover for remediation and to pay fines forviolating compliance regulations• Lead to lost business opportunities and revenue when intellectual
property is stolen
With the prevalence and damaging effects of data breaches, organizations
now see digital asset protection as a critical component of their security
infrastructure.
Data Loss Prevention safeguards an organization’s sensitive data against
accidental or deliberate leakage. Data Loss Prevention allows you to:• Identify the sensitive information that requires protection using data
identifiers• Create policies that limit or prevent the transmission of digital assets
through common transmission channels, such as email and external
devices• Enforce compliance to established privacy standards
Before you can monitor sensitive information for potential loss, you must beable to answer the following questions:• What data needs protection from unauthorized users?

19-2

Apex One Data Loss Prevention Policy Settings• Where does the sensitive data reside?
• How is the sensitive data transmitted?
• What users are authorized to access or transmit the sensitive data?
• What action should be taken if a security violation occurs?
This important audit typically involves multiple departments and personnel
familiar with the sensitive information in your organization.
If you already defined your sensitive information and security policies, you
can begin to define data identifiers and company policies.

Configuring a Data Loss Prevention Policy
Procedure
1.

Click the External Agents tab to configure a policy for external agents or
the Internal Agents tab to configure a policy for internal agents.
Note
Configure agent location settings if you have not done so. Agents use
these location settings to determine the correct Data Loss Prevention
policy to apply.

2.

Select Enable Data Loss Prevention.

3.

Choose one of the following:• If you are on the External Agents tab, you can apply all Data Loss
Prevention settings to internal agents by selecting Apply all settings
to internal agents.
• If you are on the Internal Agents tab, you can apply all Data Loss
Prevention settings to external agents by selecting Apply all
settings to external agents.

4.

Manage the rules that Data Loss Prevention applies to the policy un theRules tab.
19-3

Trend Micro Apex Central™ Widget and Policy Management Guide

Task
Add a new rule

Description
Click Add to create a rule that applies to the policy.
For more information, see Configuring Data Loss Prevention Rules on
page 19-4.

Copy existing
rule settings

Select an existing rule and click Copy to open the Data Loss
Prevention Policy Settings screen. Modify the rule settings as
required.

Delete existingrules

Select an existing rule and click Delete to remove the rule from the list.

Modify existing
rules

Click the Rule name of an existing rule to modify settings.

Enable/Disable
existing rules

Click the button under the Enable column to enable or disable a rule
for the policy.

Note
A policy can contain a maximum of 40 rules.

5.

Click the Exceptions tab and configure any necessary exception settings.
For more information, see Data Loss Prevention Exceptions on page 19-12.

Configuring Data Loss Prevention Rules
Note
Data Loss Prevention processes rules and templates by priority. If a rule is set
to “Pass”, Data Loss Prevention processes the next rule in the list. If a rule isset to “Block” or “User Justification”, Data Loss Prevention blocks or accepts
the user action and does not process that rule/template further.

Procedure1.
19-4

Select Enable this rule.

Apex One Data Loss Prevention Policy Settings

2.

Specify a name for the rule.
Configure the template settings:

3.

Click the Template tab.

4.

Select templates from the Available templates list and then click Add.
When selecting templates:• Select multiple entries by clicking the template names whichhighlights the name.
• Use the search feature if you have a specific template in mind. You
can type the full or partial name of the template.
Note
Each rule can contain a maximum of 200 templates.

Configure the channel settings:
5.

Click the Channel tab.

6.

Select the channels for the rule.
For details about channels, see Network Channels on page 19-6 and
System and Application Channels on page 19-9.

7.

If you selected any of the network channels, select the transmission
scope:• All transmissions• Only transmissions outside the Local Area Network
See Transmission Scope and Targets for Network Channels on page 19-6 fordetails on transmission scope, how targets work depending on thetransmission scope, and how to define targets correctly.

8.

If you selected Email clients:a.

Click Exceptions.

b.

Specify monitored and non-monitored internal email domains.
19-5

Trend Micro Apex Central™ Widget and Policy Management Guide

For details on monitored and non-monitored email domains, see
Email Clients on page 19-7.
9.

If you selected Removable storage:a.

Click Exceptions.

b.

Add non-monitored removable storage devices, identifying them by
their vendors. The device model and serial ID are optional.
The approved list for USB devices supports the use of the asterisk (*)
wildcard. Replace any field with the asterisk (*) to include all
devices that satisfy the other fields.
For example, [vendor]-[model]-* places all USB devices from thespecified vendor and the specified model type, regardless of serial
ID, to the approved list.

c.

To add more devices, click the plus (+) icon.

Configure the action settings:
10. Click the Action tab.
11. Select a primary action and any additional actions. For details about
actions, see Data Loss Prevention Actions on page 19-10.
12. After configuring the Template, Channel, and Action settings, click
Save.

Transmission Scope and Targets for Network Channels
Transmission scope and targets define data transmissions on network
channels that Data Loss Prevention must monitor. For transmissions thatshould be monitored, Data Loss Prevention checks for the presence of data
identifiers before allowing or blocking the transmission. For transmissions
that should not be monitored, Data Loss Prevention does not check for thepresence of data identifiers and immediately allows the transmission.

Network Channels
Data Loss Prevention can monitor data transmission through the following
network channels:
19-6

Apex One Data Loss Prevention Policy Settings• Email clients• FTP• HTTP and HTTPS• IM applications• SMB protocol• WebmailTo determine data transmissions to monitor, Data Loss Prevention checks thetransmission scope, which you need to configure. Depending on the scopethat you selected, Data Loss Prevention will monitor all data transmissions or
only transmissions outside the Local Area Network (LAN).

Email Clients
Data Loss Prevention monitors email transmitted through various email
clients. Data Loss Prevention checks the email subject, body, andattachments for data identifiers. For a list of supported email clients, see theData Protection Lists document at:
http://docs.trendmicro.com/en-us/enterprise/data-protection-referencedocuments.aspx
Monitoring occurs when a user attempts to send the email. If the email
contains data identifiers, Data Loss Prevention will either allow or block theemail.
You can define non-monitored internal email domains and monitored
subdomains.
• Non-monitored email domains: Data Loss Prevention immediately
allows the transmission of emails sent to non-monitored domains.

19-7

Trend Micro Apex Central™ Widget and Policy Management Guide

Note
Data transmissions to non-monitored email domains and to monitored
email subdomains where "Monitor" is the action are similar in that thetransmission is allowed. The only difference is that for non-monitored
email domains, Data Loss Prevention does not log the transmission,
whereas for monitored email subdomains, the transmission is always
logged.

• Monitored email subdomains: When Data Loss Prevention detects
email transmitted to a monitored subdomain, it checks the action for thepolicy. Depending on the action, the transmission is allowed or blocked.
Note
If you select email clients as a monitored channel, an email must match a
policy for it to be monitored. In contrast, an email sent to monitored
email subdomains is automatically monitored, even if it does not match a
policy.

Specify domains using any of the following formats, separating multiple
domains with commas:• X400 format, such as /O=Trend/OU=USA, /O=Trend/OU=China• Email domains, such as example.com
For email messages sent through the SMTP protocol, Data Loss Prevention
checks if the target SMTP server is on the following lists:
1. Monitored targets
2. Non-monitored targets
3. Non-monitored email domains
4. Monitored email subdomains
This means that if an email is sent to an SMTP server on the monitored
targets list, the email is monitored. If the SMTP server is not on themonitored targets list, Data Loss Prevention checks the other lists.
19-8

Apex One Data Loss Prevention Policy Settings

For emails sent through other protocols, Data Loss Prevention only checks
the following lists:
1. Non-monitored email domains
2. Monitored email subdomains

System and Application Channels
Data Loss Prevention can monitor the following system and application
channels:• Cloud storage services• Data recorders (CD/DVD)• Peer-to-peer applications• PGP Encryption• Printer• Removable storage• Synchronization software (ActiveSync)• Windows clipboard

Device List Tool
Run the Device List Tool locally on each endpoint to query external devices
connected to the endpoint. The tool scans an endpoint for external devices
and then displays device information in a browser window. You can then use
the information when configuring device settings for Data Loss Prevention
and Device Control.

Running the Device List Tool
Procedure
1.

Locate the Device List Tool.
• On the target endpoint that has the Security Agent installed, go to
C:\Windows\System32\dgagent\listDeviceInfo.exe.
19-9Trend Micro Apex Central™ Widget and Policy Management Guide• Obtain listDeviceInfo.zip from the Support portal and extract
the package on the target endpoint.
https://success.trendmicro.com/solution/1120385
2.

On the endpoint, run listDeviceInfo.exe.

3.

View device information in the browser window that displays. Data Loss
Prevention and Device Control use the following information:• Vendor (required)• Model (optional)• Serial ID (optional)

Data Loss Prevention Actions
When Data Loss Prevention detects the transmission of data identifiers, it
checks the DLP policy for the detected data identifiers and performs theaction configured for the policy.
The following table lists the Data Loss Prevention actions.
Table 19-1. Data Loss Prevention Actions
ActionDescription

Actions
Pass

Data Loss Prevention allows and logs the transmission.

Block

Data Loss Prevention blocks and logs the transmission.

Additional Actions
Notify the agent user

Data Loss Prevention displays a notification message toinform the user of the data transmission and whether it was
passed or blocked.

Record data

Regardless of the primary action, Data Loss Prevention
records the sensitive information to <Security Agent
installation folder>\DLPLite\Forensic. Select thisaction to evaluate sensitive information that is being flagged
by Data Loss Prevention.

19-10

Apex One Data Loss Prevention Policy Settings

ActionDescription
Recorded sensitive information may consume too much harddisk space. Therefore, Trend Micro highly recommends thatyou choose this option only for highly sensitive information.

Encrypt supported channels
using the specified key/
password (only available if
Endpoint Encryption is
installed)
Note
This option is only
available for
Removable storage
and Cloud storage
service channels andwhen selecting the
Pass action.
Important
The File Encryption
feature in Endpoint
Encryption isdeprecated and may
not be available for
new installation
instances.

If Trend Micro Endpoint Encryption is installed alongside
theSecurity Agents, Data Loss Prevention can automaticallyencrypt files before allowing a user to pass them to anotherlocation. If Endpoint Encryption is not installed, Data Loss
Prevention performs the Block action on files.
Choose one of the following encryption keys or a fixed
password:• User key: Also known as a Local Key, this key is uniqueto each user and limits access to the encrypted file to theuser that created the file.
• Shared key: This key refers to the Group Key orEnterprise Key and the Endpoint Encryption
administrator configures the type using PolicyServer
MMC.
• Fixed password: Users manually provide a fixed
password using an on-screen prompt. Endpoint
Encryption creates a self-extracting package that users
can access on any endpoint after providing thedecryption password.

19-11

Trend Micro Apex Central™ Widget and Policy Management Guide

ActionDescription
Important• The target endpoint must have Endpoint
Encryption installed and the user must log in to
Endpoint Encryption in order to encrypt data.
• Encrypted files located on USB devices are
subject to Data Loss Prevention scanning whenusers attempt to decrypt the files. Decrypting
files containing sensitive data on a USB device
triggers the USB encryption protocol resulting inthe system requiring that the sensitive data be
encrypted (again). To prevent Data Loss
Prevention from attempting to "re-encrypt" thedata, move the encrypted files to a local drive
before attempting to access the data.
• Data Loss Prevention blocks attempts to upload
files to cloud storage when using a web client.
Encrypt the files manually before uploading
using a web client.

User justification
Note
This option is only
available after
selecting the Blockaction.

Data Loss Prevention prompts the user before performing the“Block” action. User can select to override the “Block” action
by providing an explanation as to why the sensitive data issafe to pass. The available justification reasons are:• This is part of an established business process.
• My manager approved the data transfer.
• The data in this file is not confidential.
• Other: Users provide an alternate explanation in the text
field provided.

Data Loss Prevention Exceptions
DLP exceptions apply to the entire policy, including all rules defined within
the policy. Data Loss Prevention applies the exception settings to all

19-12

Apex One Data Loss Prevention Policy Settingstransmissions before scanning for digital assets. If a transmission matches
one of the exception rules, Data Loss Prevention immediately allows or scans
the transmission depending on the exception type.

Defining Non-monitored and Monitored Targets
Define the non-monitored and monitored targets based on the transmission
scope configured on the Channel tab. For details on how to define nonmonitored and monitored targets for All transmissions, see Transmission
Scope: All Transmissions on page 19-14. For details on how to define nonmonitored and monitored targets for Only transmissions outside the Local
Area Network, see Transmission Scope: Only Transmissions Outside the Local
Area Network on page 19-15.
Follow these guidelines when defining monitored and non-monitored
targets:
1. Define each target by:• IP address• Host name
• FQDN• Network address and subnet mask, such as 10.1.1.1/32
Note
For the subnet mask, Data Loss Prevention only supports a classlessinter-domain routing (CIDR) type port. That means that you can only
type a number like 32 instead of 255.255.255.0.

2. To target specific channels, include the default or company-defined port
numbers for those channels. For example, port 21 is typically for FTP
traffic, port 80 for HTTP, and port 443 for HTTPS. Use a colon to separate
the target from the port numbers.
3. You can also include port ranges. To include all ports, ignore the port
range.
Examples of targets with port numbers and port ranges:
19-13Trend Micro Apex Central™ Widget and Policy Management Guide• 10.1.1.1:80• host:5-20• host.domain.com:20• 10.1.1.1/32:20
4. Separate targets with commas.

Transmission Scope: All Transmissions
Data Loss Prevention monitors data transmitted outside the host computer.
Note
Trend Micro recommends choosing this scope for external agents.

If you do not want to monitor data transmissions to certain targets outside
the host computer, define the following:• Non-monitored targets: Data Loss Prevention does not monitor datatransmitted to these targets.
Note
Data transmissions to non-monitored targets and to monitored targets
where "Monitor" is the action are similar in that the transmission isallowed. The only difference is that for non-monitored targets, Data Loss
Prevention does not log the transmission, whereas for monitored targets,the transmission is always logged.

• Monitored targets: These are specific targets within the non-monitored
targets that should be monitored. Monitored targets are:
• Optional if you defined non-monitored targets.
• Not configurable if you did not define non-monitored targets.
For example:

19-14

Apex One Data Loss Prevention Policy Settings

The following IP addresses are assigned to your company's Legal
Department:• 10.201.168.1 to 10.201.168.25
You are creating a policy that monitors the transmission of Employment
Certificates to all employees except the Legal Department's full time staff. To
do this, you would select All transmissions as the transmission scope andthen:OptionOption 1

Steps
1. Add 10.201.168.1-10.201.168.25 to the non-monitored targets.
2. Add the IP addresses of the Legal Department's part-time staff to themonitored targets. Assume that there are 3 IP addresses,
10.201.168.21-10.201.168.23.

Option 2

Add the IP addresses of the Legal Department's full time staff to the nonmonitored targets:• 10.201.168.1-10.201.168.20• 10.201.168.24-10.201.168.25

For guidelines on defining monitored and non-monitored targets, see
Defining Non-monitored and Monitored Targets on page 19-13.

Transmission Scope: Only Transmissions Outside the Local Area
Network
Data Loss Prevention monitors data transmitted to any target outside theLocal Area Network (LAN).
Note
Trend Micro recommends choosing this scope for internal agents.

"Network" refers to the company or local network. This includes the current
network (IP address of the endpoint and netmask) and the following
standard private IP addresses:

19-15

Trend Micro Apex Central™ Widget and Policy Management Guide• Class A: 10.0.0.0 to 10.255.255.255• Class B: 172.16.0.0 to 172.31.255.255• Class C: 192.168.0.0 to 192.168.255.255
If you select this transmission scope, you can define the following:• Non-monitored targets: Define targets outside the LAN that you
consider safe and therefore should not be monitored.
Note
Data transmissions to non-monitored targets and to monitored targets
where "Monitor" is the action are similar in that the transmission isallowed. The only difference is that for non-monitored targets, Data Loss
Prevention does not log the transmission, whereas for monitored targets,the transmission is always logged.

• Monitored targets: Define targets within the LAN that you want tomonitor.
For guidelines on defining monitored and non-monitored targets, see
Defining Non-monitored and Monitored Targets on page 19-13.

Decompression Rules
Files contained in compressed files can be scanned for digital assets. To
determine the files to scan, Data Loss Prevention subjects a compressed fileto the following rules:• Size of a decompressed file exceeds: __ MB (1-10240 MB)• Compression layers exceed: __ (1-20)• Number of files to scan exceeds: __ (1-2000)

19-16

Part VII
Apex One (Mac) Widgets andPolicies

Chapter 20

Apex One (Mac) Dashboard Widgets
This section contains help topics for the Apex One (Mac) dashboard widgets
supported in Apex Central.
Topics include:• Key Performance Indicators Widget on page 20-2

20-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Key Performance Indicators Widget
Use this widget on the Apex Central Dashboard screen to display Apex One(Mac) key performance indicators (KPIs) based on selected criteria.
For information on how to add a widget to the Dashboard screen, see theApex Central or Control Manager documentation.
Tip
By default, the widget marks events as “Important” (“Critical” () at 15 occurrences and) at 30 occurrences. Optionally, mark events as Important or

Critical by customizing event thresholds.

Configuring Key Performance Indicators
In Apex Central or Control Manager, access the Apex One (Mac) Key
Performance Indicators widget on the Dashboard to perform the following
indicator-related tasks.
Table 20-1. KPI Widget Indicator Tasks
Task
Add a new indicator

Steps
1. Click Add Indicator. The Add Indicator screen
appears.
2. Select an option from the Name drop-down list andoptionally customize settings.
3. Click Save.

Edit an indicator

1. Click the indicator in the list. The Edit Indicator
screen appears.
2. Customize settings.
3. Click Save.

20-2

Apex One (Mac) Dashboard Widgets

Task
Delete an indicator

Steps
1. Click the indicator in the list. The Edit Indicator
screen appears.
2. Click Delete.
3. Click OK.

Configure event threshold settings

1. On the Add Indicator or Edit Indicator screen,
select Enable alerts at the following thresholds.
2. Type the minimum number of event occurrences foreach event type.
3. Click Save.
Note
The important or critical icon displays in the
Occurrences column if both of the following aretrue:• The number of event occurrences thatmatch this indicator is equal to or morethan the threshold.
• Enable alerts at the following threshold isselected.

Configuring Widget Settings
On the Apex Central or Control Manager Dashboard screen, select Widget
Settings from the menu on the top-right of the widget to perform thefollowing tasks.
Table 20-2. KPI Widget Settings
Task
Edit widget title

Steps
Type the widget title in the text field.

20-3Trend Micro Apex Central™ Widget and Policy Management Guide

Task
Configure daily update time

Steps
From the drop-down list, select the hour to generate thewidget data every day.
Tip
To manually refresh the widget data, click therefresh (20-4) icon.

Chapter 21

Apex One (Mac) Policy Settings
This section discusses how to configure Trend Micro Apex One (Mac) policy
settings in Apex Central.
Topics include:

21-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Cache Settings for Scans
Each time scanning runs, the agent checks the modified files cache to see if afile has been modified since the last agent startup.
• If a file has been modified, the agent scans the file and adds it to thescanned files cache.
• If a file has not been modified, the agent checks if the file is in thescanned files cache.
• If the file is in the scanned files cache, the agent skips scanning thefile.
• If the file is not in the scanned files cache, the agent checks theapproved files cache.
Note
The approved files cache contains files that Apex One (Mac) deems
trustworthy. Trustworthy files have been scanned by successive
versions of the pattern and declared threat-free each time, or threatfree files that have remained unmodified for an extended period oftime.

• If the file is in the approved files cache, the agent skips
scanning the file.
• If the file is not in the approved files cache, the agent scans thefile and adds it to the scanned files cache.
All or some of the caches are cleared whenever the scan engine or pattern isupdated.
If scans are run frequently and many files hit the caches, the scanning time
reduces significantly.
If scans are seldom run, disable the caches so that files can be checked forthreats with each scan.

21-2

Apex One (Mac) Policy Settings

Device Control
Device Control regulates access to external storage devices and network
resources connected to endpoints. Device Control helps prevent data loss
and leakage and, combined with file scanning, helps guard against security
risks.
You can configure Device Control policies for internal and external agents.
Administrators typically configure a stricter policy for external agents.
Policies are granular settings in the agent tree. You can enforce specificpolicies to agent groups or individual Security Agents. You can also enforce asingle policy to all Security Agents.

Configuring Device Control Settings
Procedure
1.

Click the External Agents tab to configure settings for external agents or
the Internal Agents tab to configure settings for internal agents.

2.

Select Enable Device Control.

3.

Under Devices, select a permission for each storage device.
For details about permissions, see Permissions for Storage Devices on page
21-4.

4.

(Optional) If the permission for USB storage devices is Block, you canconfigure a list of approved devices under USB Storage Device
Approved List. Users can access these devices and you can control thelevel of access using permissions.
a.

Type the device vendor.

b.

Type the device model and serial ID.

c.

Select the permission for the device.
For details about permissions, see Permissions for Storage Devices on
page 21-4.
21-3

Trend Micro Apex Central™ Widget and Policy Management Guide

Note
USB storage devices on the approved list must have a higher
permission level than the permission setting for USB storage
devices in the Devices section.

5.

Under Notification, select the Display a notification message on theagent endpoint when a new device is detected option to display anotification when a new storage device is connected to the endpoint.
The notification indicates the access permission for the new storage
device.

6.

Click Deploy.

Permissions for Storage Devices
Device Control permissions for storage devices are used when you:
• Allow access to USB storage devices, CD/DVD, SD cards, network drives,and Thunderbolt SATA storage devices. You can grant full access to thesedevices or limit the level of access.
• Configure the list of approved USB storage devices. Device Control
allows you to block access to all USB storage devices, except those thathave been added to the list of approved devices. You can grant fullaccess to the approved devices or limit the level of access.
The following table lists the permissions for storage devices.
Table 21-1. Device Control Permissions for Storage Devices
Permissions
Full access

Files on the Device

Incoming Files

Permitted operations: Copy, Move,
Open, Save, Delete, Execute

Permitted operations: Save, Move,
Copy
This means that a file can be saved,
moved, and copied to the device.

21-4

Apex One (Mac) Policy Settings

Permissions
Read only

Files on the Device

Incoming Files

Permitted operations: Copy, Open

Prohibited operations: Save, Move,
Copy

Prohibited operations: Save,
Move, Delete, Execute
Block

Prohibited operations: All
operations

Prohibited operations: Save, Move,
Copy

The device and the files it contains
are not visible to the user (forexample, from Finder).

Note
The read-only permission is not available for network drives.

Endpoint Sensor
Endpoint Sensor is a powerful monitoring and investigation tool used to
identify the presence, location, and entry point of threats. Through the useof detailed system event recording and historical analysis, you can perform
Historical Investigations to discover hidden threats throughout your networkand locate all affected endpoints. Generate Root Cause Analysis reports tounderstand the nature and activity of the malware since the threat entered
the endpoint.

Configuring Endpoint Sensor Settings
Important
The Endpoint Sensor feature requires special licensing and additional system
requirements. Ensure that you have the correct license before deploying
Endpoint Sensor policies to endpoints. For more information on how to
obtain licenses, contact your support provider.

21-5

Trend Micro Apex Central™ Widget and Policy Management Guide

Procedure1.

Select Enable Endpoint Sensor.

Predictive Machine Learning Settings
Trend Micro Predictive Machine Learning uses advanced machine learningtechnology to correlate threat information and perform in-depth file analysis
to detect emerging unknown security risks through digital DNA
fingerprinting, API mapping, and other file features. Predictive Machine
Learning also performs a behavioral analysis on unknown or low-prevalence
processes to determine if an emerging or unknown threat is attempting to
infect your network.
Predictive Machine Learning is a powerful tool that helps protect yourenvironment from unidentified threats and zero-day attacks.
To enable this feature, select Enable Predictive Machine Learning.

Privileges and Other Settings
Configure Security Agents to protect critical Security Agent files and folders.
SectionDescription

Security Agent Selfprotection

Select Protect files used by the Security Agent to prevent otherprograms and even the user from modifying or deleting files that the
Security Agent uses.
For the list of files and folders this feature protects, see Protected
Security Agent Files on page 21-6.

Protected Security Agent Files
When you enable the Security Agent self-protection feature, Apex One (Mac)locks the following files and folders to prevent other programs and even theuser from modifying or deleting Security Agent files:• /Library/Application Support/TrendMicro/common
21-6

Apex One (Mac) Policy Settings• /Library/Application Support/TrendMicro/Kext• /Library/Application Support/TrendMicro/TmccMac• /Library/Application Support/TrendMicro/TmccUpdate• /Library/Application Support/TrendMicro/Plug-in• /Library/Application Support/TrendMicro/Tools• /Library/LaunchDaemons/com.trendmicro.icore.*• /Library/LaunchDaemons/com.trendmicro.tmsm.plugin.plist• /Library/LaunchDaemons/com.trendmicro.tmsm.launcher.plist• /Application/TrendMicroSecurity.app
Note
Apex One (Mac) allows files to be added in the /Library/Application
Support/TrendMicro/Tools folder, files cannot be deleted from the folder.

Scan Method Types
Apex One (Mac) Security Agents can use one of two scan methods when
scanning for security risks. The scan methods are smart scan andconventional scan.
• Smart Scan
Security Agents that use smart scan are referred to as “smart scan
agents” in this document. Smart scan agents benefit from local scans
and in-the-cloud queries provided by File Reputation Services.
This is the default scan method type.
• Conventional Scan
Agents that do not use smart scan are called “conventional scan agents”.
A conventional scan agent stores all Apex One (Mac) components on theagent endpoint and scans all files locally.

21-7

Trend Micro Apex Central™ Widget and Policy Management Guide

Scan Methods Compared
The following table provides a comparison between the two scan methods:
Table 21-2. Conventional Scan and Smart Scan Compared
Basis ofComparison
Scanning behavior

Conventional Scan

Smart Scan

The conventional scan agent
performs scanning on thelocal endpoint.

• The smart scan agent performs
scanning on the local endpoint.
• If the Security Agent cannot
determine the risk of the fileduring the scan, the Security
Agent verifies the risk by sending ascan query to a smart protection
source.
• The Security Agent "caches" thescan query result to improve thescan performance.

Components in use
and updated

All components available on
the update source, except the
Mac Heuristic Pattern andSmart Scan Agent Pattern.

All components available on the
update source, except the Virus Pattern
and Spyware Active-monitoring
Pattern.

Typical updatesourceApex One (Mac) server

Apex One (Mac) server

Switching from Smart Scan to Conventional Scan
The following table provides other considerations when switching agents toconventional scan.
Table 21-3. Considerations When Switching to Conventional Scan

21-8

Consideration

Details

Number of Security Agentsto switch

Switching a relatively small number of Security Agents at a timeallows efficient use of the Apex One (Mac) server and SmartProtection Server resources. These servers can perform othercritical tasks while Security Agents change their scan methods.

Apex One (Mac) Policy Settings

Consideration
Timing

Details
When switching back to conventional scan, Security Agents will
likely download the full version of the Virus Pattern and Spywareactive Monitoring Pattern from the Apex One (Mac) server. These
pattern files are only used by conventional scan agents.
Consider switching during off-peak hours to ensure the download
process finishes within a short amount of time. Also consider
switching when no Security Agent is scheduled to update fromthe server.

Agent tree settings

Scan method is a granular setting that can be set on the root,
domain, or individual agent level. When switching toconventional scan, you can:• Create a new group and assign conventional scan as its scanmethod. Any Security Agent you move to this group will use
conventional scan. When you move the Security Agent,
enable the setting Apply settings of new group to selectedagent(s).
• Select a group and configure it to use conventional scan.
Smart scan agents belonging to the group will switch toconventional scan.
• Select one or several smart scan agents from a group andthen switch them to conventional scan.
Note
Any changes to the group's scan method overrides thescan method you have configured for individual Security
Agents.

Switching from Conventional Scan to Smart Scan
If you are switching Security Agents from conventional scan to smart scan,
ensure that you have set up Smart Protection Services on the Apex One
server. For details, see the Apex One documentation.
The following table provides other considerations when switching Security
Agent to smart scan.

21-9

Trend Micro Apex Central™ Widget and Policy Management Guide

Table 21-4. Considerations When Switching to Smart Scan
Consideration
Product license

Details
To use smart scan, ensure that you have activated the licenses forthe following services on the Apex One server and that the licenses
are not expired:• Antivirus• Web Reputation and Anti-spyware

Apex One (Mac) server

Ensure that Security Agents can connect to the Apex One (Mac)server. Only online Security Agents will be notified to switch tosmart scan. Offline Security Agents get notified when they become
online. Roaming Security Agents are notified when they become
online or, if the Security Agent has scheduled update privileges,
when scheduled update runs.

Number of Security
Agents to switch

Switching a relatively small number of Security Agents at a timeallows efficient use of Apex One (Mac) server resources. The Apex
One (Mac) server can perform other critical tasks while Security
Agents change their scan methods.

TimingWhen switching to smart scan for the first time, Security Agentsneed to download the full version of the Mac Heuristic Pattern andSmart Scan Agent Pattern from the Apex One (Mac) server. The
Smart Scan Pattern is only used by smart scan agents.
Consider switching during off-peak hours to ensure the download
process finishes within a short amount of time. Also consider
switching when no Security Agent is scheduled to update from theserver.

21-10

Apex One (Mac) Policy Settings

Consideration
Agent tree settings

Details
Scan method is a granular setting that can be set on the root,group, or individual agent level. When switching to smart scan,
you can:• Create a new group and assign smart scan as its scan method.
Any Security Agent you move to this group will use smart
scan. When you move the Security Agent, enable the setting
Apply settings of new group to selected agent(s).
• Select a group and configure it to use smart scan.
Conventional scan agents belonging to the group will switch
to smart scan.
• Select one or several conventional scan agents from a groupand then switch them to smart scan.
Note
Any changes to the group's scan method overrides thescan method you have configured for individual Security
Agents.

IPv6 support

Smart scan agents send scan queries to smart protection sources.
A pure IPv6 smart scan agent cannot send queries directly to pure
IPv4 sources, such as:• Smart Protection Server 3.0 (integrated or standalone)• Trend Micro Smart Protection Network
Similarly, a pure IPv4 smart scan agent cannot send queries topure IPv6 Smart Protection Servers.
A dual-stack proxy server that can convert IP addresses, such as
DeleGate, is required to allow smart scan agents to connect to thesources.

Scan Types
Apex One (Mac) provides the following scan types to protect endpoints fromsecurity risks:

21-11

Trend Micro Apex Central™ Widget and Policy Management Guide

Scan Type
Real-time Scan

Description
Automatically scans a file on the endpoint as it is received, opened,
downloaded, copied, or modified
See Real-time Scan on page 21-12.

Manual Scan

A user-initiated scan that scans a file or a set of files requested by the user
See Manual Scan on page 21-17.

Scheduled Scan

Automatically scans files on the endpoint based on the scheduleconfigured by the administrator
See Scheduled Scan on page 21-22.

Scan Now

An administrator-initiated scan that scans files on one or several target
endpoints

Real-time Scan
Real-time Scan is a persistent and ongoing scan. Each time a file is received,
opened, downloaded, copied, or modified, Real-time Scan scans the file forsecurity risks. If Apex One (Mac) does not detect a security risk, the fileremains in its location and users can proceed to access the file. If Apex One(Mac) detects a security risk, it displays a notification message, showing thename of the infected file and the specific security risk.
Configure and apply Real-time Scan settings to one or several agents andgroups, or to all Security Agents that the server manages.

Configuring Real-time Scan Settings
Procedure1.

Select the check box to enable Real-time Scan.

2.

Click the Target tab to configure file activities and scan settings.
For more information, see Real-time Scan: Target Tab on page 21-13.

3.

21-12

Click the Action tab to configure the scan actions Apex One (Mac)performs on detected security threats.

Apex One (Mac) Policy Settings

For more information, see Real-time Scan: Action Tab on page 21-13.

Real-time Scan: Target Tab
Procedure
1.

Under User Activity on Files, choose activities on files that will trigger
Real-time Scan. Select from the following options:• Scan files being created/modified: Scan new files introduced into
the endpoint (for example, after downloading a file) or files being
modified• Scan files being retrieved/executed: Scan files as they are opened• Scan files being created/modified and retrieved/executed• Scan files being created/modified/executed
For example, if the third option is selected, a new file downloaded to theendpoint will be scanned and stays in its current location if no security
risk is detected. The same file will be scanned when a user opens the fileand, if the user modified the file, before the modifications are saved.

2.

Under Scan Settings, select one or more from the following options:• Scan compressed files: Scan individual files within an archive fileFor more information, see Supported Compressed File Types on page
21-14.
• Scan network drive: Scan directories physically located on otherendpoints, but mapped to the local endpoint

Real-time Scan: Action Tab
On the Actions tab, configure the scan actions Apex One (Mac) performs on
detected security threats.

21-13

Trend Micro Apex Central™ Widget and Policy Management Guide

Procedure
1.

Under Action, specify the scan actions.
OptionUse ActiveAction

Description
ActiveAction is a set of pre-configured scan actions
for different types of security risks. If you are unsure
which scan action is suitable for a certain type of
security risk, Trend Micro recommends using
ActiveAction.
ActiveAction settings are constantly updated in thepattern files to protect endpoints against the latest
security risks and the latest methods of attacks.

Use the same action for all
security risk types

Select this option if you want the same action
performed on all types of security risks, except
probable virus/malware. For Probable Virus/
Malware, the action is always "Pass".
If you choose "Clean" as the first action, select asecond action that Apex One (Mac) performs if
cleaning is unsuccessful. If the first action is not"Clean", no second action is configurable.
For details about scan actions, see Scan Actions on
page 21-15.

2.

Select Display a notification message on the agent endpoint whenvirus/malware is detected to display a notification message when Apex
One (Mac) detects a security risk during Real-time Scan.

Supported Compressed File Types
Apex One (Mac) supports the following compression types.
Type

Extension.zip

Archive created by Pkzip.rar

Archive created by RAR

21-14

Apex One (Mac) Policy Settings

Extension

Type

.tar

Archive created by Tar.arj

ARJ Compressed archive.hqx

BINHEX.gz; .gzip

Gnu ZIP.Z

LZW/Compressed 16bits.bin

MacBinary.cab

Microsoft Cabinet file

Microsoft Compressed/MSCOMP.eml; .mht

MIME

.td0

Teledisk format.bz2

Unix BZ2 Bzip compressed file.uu

UUEncode.ace

WinAceScan Actions
Specify the action Apex One (Mac) performs when a particular scan typedetects a security risk.
The action Apex One (Mac) performs depends on the scan type that detected
the security risk. For example, when Apex One (Mac) detects a security risk
during Manual Scan (scan type), it cleans (action) the infected file.
The following are the actions Apex One (Mac) can perform against security
risks:
Scan Action
DeleteDetails
Apex One (Mac) removes the infected file from the endpoint.

21-15

Trend Micro Apex Central™ Widget and Policy Management Guide

Scan Action
Quarantine

Details
Apex One (Mac) renames and then moves the infected file to the quarantine
directory on the endpoint located in <Agent installation folder>/common/lib/vsapi/quarantine.
Once in the quarantine directory, Apex One (Mac) can perform anotheraction on the quarantined file, depending on the action specified by theuser. Apex One (Mac) can delete, clean, or restore the file. Restoring a filemeans moving it back to its original location without performing any
action. Users may restore the file if it is actually harmless. Cleaning a filemeans removing the security risk from the quarantined file and thenmoving it to its original location if cleaning is successful.

CleanApex One (Mac) removes the security risk from an infected file before
allowing users to access it.
If the file is uncleanable, Apex One (Mac) performs a second action, which
can be one of the following actions: Quarantine, Delete, and Pass. To
configure the second action, navigate to Agent Management > Settings >{Scan Type} and click the Action tab.

Pass

Apex One (Mac) performs no action on the infected file but records thedetected security risk in the logs. The file stays where it is located.
Apex One (Mac) always performs "Pass" on files infected with the Probable
Virus/Malware type to mitigate a False Positive. If further analysis confirmsthat probable virus/malware is indeed a security risk, a new pattern will be
released to allow Apex One (Mac) to perform the appropriate scan action. If
actually harmless, probable virus/malware will no longer be detected.
For example: Apex One (Mac) detects "x_probable_virus" on a file named"123.pdf" and performs no action at the time of detection. Trend Microthen confirms that "x_probable_virus" is a Trojan horse program andreleases a new Virus Pattern version. After loading the new pattern, Apex
One (Mac) will detect "x_probable_virus" as a Trojan program and, if theaction against such programs is "Delete", will delete "123.pdf".
NoteThis action is not available for Real-time Scan.

21-16

Apex One (Mac) Policy Settings

Scan Action
Deny access

Details
When Apex One (Mac) detects an attempt to open or execute an infected
file, it immediately blocks the operation.
Users can manually delete the infected file.

Manual Scan
Manual Scan is an on-demand scan and starts immediately after a user runs
the scan on the agent console. The time it takes to complete scanningdepends on the number of files to scan and the endpoint's hardware
resources.
Configure and apply Manual Scan settings to one or several Security Agentsand groups, or to all Security Agents that the server manages.

Configuring Manual Scan Settings
Procedure
1.

Click the Target tab to configure the general scan and CPU usage
settings.
For more information, see Manual Scan: Target Tab on page 21-17.

2.

Click the Action tab to configure the scan actions Apex One (Mac)performs on detected security threats.
For more information, see Manual Scan: Action Tab on page 21-19.

Manual Scan: Target Tab
Procedure1.

In the Files to Scan section, select from the following:• All scannable files: Includes all scannable files. Unscannable files
are password protected files, encrypted files, or files that exceed theuser-defined scanning restrictions.
21-17

Trend Micro Apex Central™ Widget and Policy Management Guide

Note
Scanning every file requires a lot of time and resources and might
be redundant in some situations. Therefore, you might want to limit
the amount of files the Security Agent includes in the scan.

• Scan only Mach-O files: Only scan Mach-O files on endpoints. Apex
One (Mac) Security Agents do not scan other file types for malware.
Note
If you select this option, you must enable the smart scan feature toensure protection against the latest malware attacks targeting OS X
and macOS platforms.

2.

Under Scan Settings, select one or more from the following options:• Scan compressed files: Scan individual files within an archive fileFor more information, see Supported Compressed File Types on page
21-14.
• Scan network drive: Scan directories physically located on otherendpoints, but mapped to the local endpoint• Scan Time Machine: Only scan files on Time Machine drives
Note
After enabling the Scan Time Machine option for Manual and
Scheduled Scan, Apex One (Mac) can only detect malware threats
but not take any action (clean, quarantine, or delete) due to apermission limitation in Mac OS. Configured scan actions display as
unsuccessful in the product logs.

3.

In the CPU Usage section, configure the required settings.
• High: No pausing between scans

21-18

Apex One (Mac) Policy Settings• Low: Pause between file scans if CPU consumption is higher than
20%, and do not pause if 20% or lower

Manual Scan: Action Tab
On the Actions tab, configure the scan actions Apex One (Mac) performs on
detected security threats.
OptionUse ActiveAction

Description
ActiveAction is a set of pre-configured scan actions fordifferent types of security risks. If you are unsure whichscan action is suitable for a certain type of security risk,
Trend Micro recommends using ActiveAction.
ActiveAction settings are constantly updated in thepattern files to protect endpoints against the latest
security risks and the latest methods of attacks.

Use the same action for all
security risk types

Select this option if you want the same action
performed on all types of security risks, except
probable virus/malware. For Probable Virus/Malware,
the action is always "Pass".
If you choose "Clean" as the first action, select a second
action that Apex One (Mac) performs if cleaning is
unsuccessful. If the first action is not "Clean", no second
action is configurable.
For details about scan actions, see Scan Actions on page
21-15.

Supported Compressed File Types
Apex One (Mac) supports the following compression types.
Type

Extension.zip

Archive created by Pkzip.rar

Archive created by RAR.tar

Archive created by Tar

21-19

Trend Micro Apex Central™ Widget and Policy Management Guide

Extension

Type

.arj

ARJ Compressed archive.hqx

BINHEX.gz; .gzip

Gnu ZIP.Z

LZW/Compressed 16bits.bin

MacBinary.cab

Microsoft Cabinet file

Microsoft Compressed/MSCOMP.eml; .mht

MIME

.td0

Teledisk format.bz2

Unix BZ2 Bzip compressed file.uu

UUEncode.ace

WinAceScan Actions
Specify the action Apex One (Mac) performs when a particular scan typedetects a security risk.
The action Apex One (Mac) performs depends on the scan type that detected
the security risk. For example, when Apex One (Mac) detects a security risk
during Manual Scan (scan type), it cleans (action) the infected file.
The following are the actions Apex One (Mac) can perform against security
risks:
Scan Action
Delete21-20

Details
Apex One (Mac) removes the infected file from the endpoint.

Apex One (Mac) Policy Settings

Scan Action
Quarantine

Details
Apex One (Mac) renames and then moves the infected file to the quarantine
directory on the endpoint located in <Agent installation folder>/common/lib/vsapi/quarantine.
Once in the quarantine directory, Apex One (Mac) can perform anotheraction on the quarantined file, depending on the action specified by theuser. Apex One (Mac) can delete, clean, or restore the file. Restoring a filemeans moving it back to its original location without performing any
action. Users may restore the file if it is actually harmless. Cleaning a filemeans removing the security risk from the quarantined file and thenmoving it to its original location if cleaning is successful.

CleanApex One (Mac) removes the security risk from an infected file before
allowing users to access it.
If the file is uncleanable, Apex One (Mac) performs a second action, which
can be one of the following actions: Quarantine, Delete, and Pass. To
configure the second action, navigate to Agent Management > Settings >{Scan Type} and click the Action tab.

Pass

Apex One (Mac) performs no action on the infected file but records thedetected security risk in the logs. The file stays where it is located.
Apex One (Mac) always performs "Pass" on files infected with the Probable
Virus/Malware type to mitigate a False Positive. If further analysis confirmsthat probable virus/malware is indeed a security risk, a new pattern will be
released to allow Apex One (Mac) to perform the appropriate scan action. If
actually harmless, probable virus/malware will no longer be detected.
For example: Apex One (Mac) detects "x_probable_virus" on a file named"123.pdf" and performs no action at the time of detection. Trend Microthen confirms that "x_probable_virus" is a Trojan horse program andreleases a new Virus Pattern version. After loading the new pattern, Apex
One (Mac) will detect "x_probable_virus" as a Trojan program and, if theaction against such programs is "Delete", will delete "123.pdf".
NoteThis action is not available for Real-time Scan.

21-21

Trend Micro Apex Central™ Widget and Policy Management Guide

Scan Action
Deny access

Details
When Apex One (Mac) detects an attempt to open or execute an infected
file, it immediately blocks the operation.
Users can manually delete the infected file.

Scheduled Scan
Scheduled Scan runs automatically on the appointed date and time. Use
Scheduled Scan to automate routine scans on the Security Agent andimprove scan management efficiency.
Configure and apply Scheduled Scan settings to one or several Security
Agents and groups, or to all Security Agents that the server manages.

Configuring Scheduled Scan Settings
Procedure1.

Select the check box to enable Scheduled Scan.

2.

Click the Target tab to configure the general scan and CPU usage
settings, and the scan schedule.
For more information, see Scheduled Scan: Target Tab on page 21-22.

3.

Click the Action tab to configure the scan actions Apex One (Mac)performs on detected security threats.
For more information, see Scheduled Scan: Action Tab on page 21-24.

Scheduled Scan: Target Tab
Procedure
1.

21-22

Under Schedule, configure how often (daily, weekly, or monthly) andwhat time Scheduled Scan will run.

Apex One (Mac) Policy Settings

For monthly Scheduled Scans, if you selected the 29th, 30th, or 31st day
and a month does not have this day, Apex One (Mac) runs Scheduled
Scan on the last day of the month.
2.

In the Files to Scan section, select from the following:• All scannable files: Includes all scannable files. Unscannable files
are password protected files, encrypted files, or files that exceed theuser-defined scanning restrictions.
Note
Scanning every file requires a lot of time and resources and might
be redundant in some situations. Therefore, you might want to limit
the amount of files the Security Agent includes in the scan.

• File types scanned by IntelliScan: Only scan files known topotentially harbor malicious code, including files disguised by aharmless extension name.
• Specify path or full path : Manually specify the files or directories
to scan. For example, /Shared/Files/mytext.txt or /Shared/
Files.
3.

Under Scan Settings, select one or more from the following options:• Scan compressed files: Scan individual files within an archive fileFor more information, see Supported Compressed File Types on page
21-14.
• Scan Time Machine: Only scan files on Time Machine drives
Note
After enabling the Scan Time Machine option for Manual and
Scheduled Scan, Apex One (Mac) can only detect malware threats
but not take any action (clean, quarantine, or delete) due to apermission limitation in Mac OS. Configured scan actions display as
unsuccessful in the product logs.

21-23

Trend Micro Apex Central™ Widget and Policy Management Guide

4.

In the CPU Usage section, configure the required settings.
• High: No pausing between scans• Low: Pause between file scans if CPU consumption is higher than
20%, and do not pause if 20% or lower

Scheduled Scan: Action Tab
On the Actions tab, configure the scan actions Apex One (Mac) performs on
detected security threats.
Procedure
1.

Under Action, specify the scan actions.
OptionUse ActiveAction

Description
ActiveAction is a set of pre-configured scan actions
for different types of security risks. If you are unsure
which scan action is suitable for a certain type of
security risk, Trend Micro recommends using
ActiveAction.
ActiveAction settings are constantly updated in thepattern files to protect endpoints against the latest
security risks and the latest methods of attacks.

Use the same action for all
security risk types

Select this option if you want the same action
performed on all types of security risks, except
probable virus/malware. For Probable Virus/
Malware, the action is always "Pass".
If you choose "Clean" as the first action, select asecond action that Apex One (Mac) performs if
cleaning is unsuccessful. If the first action is not"Clean", no second action is configurable.
For details about scan actions, see Scan Actions on
page 21-15.

2.

21-24

Under Scheduled Scan Privileges, specify whether users can postpone
or skip a scheduled scan.

Apex One (Mac) Policy Settings

Privilege
Postpone Scheduled
Scan

Description
Users with the "Postpone Scheduled Scan" privilege canperform the following actions:• Postpone Scheduled Scan before it runs and thenspecify the postpone duration. Scheduled Scan can only
be postponed once.
• If Scheduled Scan is in progress, users can stop scanningand restart it later. Users then specify the amount oftime that should elapse before scanning restarts. Whenscanning restarts, all previously scanned files arescanned again. Scheduled Scan can be stopped and thenrestarted only once.
Configure the number of hours and minutes, whichcorresponds to:• The maximum postpone duration• The maximum amount of time that should elapse before
scanning restarts

Skip and Stop Scheduled
ScanThis privilege allows users to perform the following actions:• Skip Scheduled Scan before it runs
• Stop Scheduled Scan when it is in progress

3.

Under Scheduled Scan Settings, specify the notification and battery
power settings.
Setting

Description

Display a notification
before Scheduled Scan
runs

When you enable this option, a notification message displayson the endpoint several minutes before Scheduled Scan runs.
Users are notified of the scan schedule (date and time) andtheir Scheduled Scan privileges, such as postponing,skipping, or stopping Scheduled Scan.
Configure the timing for displaying the notification message,
in number of minutes.

21-25

Trend Micro Apex Central™ Widget and Policy Management Guide

Setting

Description

Automatically stop
Scheduled Scan when
scanning lasts more than__ hours and __ minutes

The Security Agent stops scanning when the specified
amount of time is exceeded and scanning is not yet complete.
The Security Agent immediately notifies users of any security
risk detected during scanning.

Skip Scheduled Scan
When a WirelessEndpoint's Battery Life isLess Than __ % and its
AC Adapter is Unplugged

Apex One (Mac) skips a Scheduled Scan if it detects that awireless endpoint's battery life is running low and its AC
adapter is not connected to any power source. If battery life islow but the AC adapter is connected to a power source,scanning proceeds. If a scan is in progress when the battery
life is low, the scan is not terminated.

Supported Compressed File Types
Apex One (Mac) supports the following compression types.
Extension

Type

.zip

Archive created by Pkzip.rar

Archive created by RAR.tar

Archive created by Tar.arj

ARJ Compressed archive.hqx

BINHEX.gz; .gzip

Gnu ZIP.Z

LZW/Compressed 16bits.bin

MacBinary.cab

Microsoft Cabinet file

Microsoft Compressed/MSCOMP.eml; .mht

MIME

.td0

Teledisk format

21-26

Apex One (Mac) Policy Settings

Extension

Type

.bz2

Unix BZ2 Bzip compressed file.uu

UUEncode.ace

WinAceScan Actions
Specify the action Apex One (Mac) performs when a particular scan typedetects a security risk.
The action Apex One (Mac) performs depends on the scan type that detected
the security risk. For example, when Apex One (Mac) detects a security risk
during Manual Scan (scan type), it cleans (action) the infected file.
The following are the actions Apex One (Mac) can perform against security
risks:
Scan Action

Details

DeleteApex One (Mac) removes the infected file from the endpoint.

Quarantine

Apex One (Mac) renames and then moves the infected file to the quarantine
directory on the endpoint located in <Agent installation folder>/common/lib/vsapi/quarantine.
Once in the quarantine directory, Apex One (Mac) can perform anotheraction on the quarantined file, depending on the action specified by theuser. Apex One (Mac) can delete, clean, or restore the file. Restoring a filemeans moving it back to its original location without performing any
action. Users may restore the file if it is actually harmless. Cleaning a filemeans removing the security risk from the quarantined file and thenmoving it to its original location if cleaning is successful.

CleanApex One (Mac) removes the security risk from an infected file before
allowing users to access it.
If the file is uncleanable, Apex One (Mac) performs a second action, which
can be one of the following actions: Quarantine, Delete, and Pass. To
configure the second action, navigate to Agent Management > Settings >{Scan Type} and click the Action tab.

21-27

Trend Micro Apex Central™ Widget and Policy Management Guide

Scan Action
Pass

Details
Apex One (Mac) performs no action on the infected file but records thedetected security risk in the logs. The file stays where it is located.
Apex One (Mac) always performs "Pass" on files infected with the Probable
Virus/Malware type to mitigate a False Positive. If further analysis confirmsthat probable virus/malware is indeed a security risk, a new pattern will be
released to allow Apex One (Mac) to perform the appropriate scan action. If
actually harmless, probable virus/malware will no longer be detected.
For example: Apex One (Mac) detects "x_probable_virus" on a file named"123.pdf" and performs no action at the time of detection. Trend Microthen confirms that "x_probable_virus" is a Trojan horse program andreleases a new Virus Pattern version. After loading the new pattern, Apex
One (Mac) will detect "x_probable_virus" as a Trojan program and, if theaction against such programs is "Delete", will delete "123.pdf".
NoteThis action is not available for Real-time Scan.

Deny access

When Apex One (Mac) detects an attempt to open or execute an infected
file, it immediately blocks the operation.
Users can manually delete the infected file.

Scan Exclusions
Configure scan exclusions to increase the scanning performance and skip
scanning files that are known to be harmless. When a particular scan typeruns, Apex One (Mac) checks the scan exclusion list to determine which files
on the endpoint will be excluded from scanning.

21-28

Apex One (Mac) Policy Settings

Scan Exclusion
List
Files

Details
Apex One (Mac) will not scan a file if:• The file is located under the directory path specified in the scan
exclusion list
• The file matches the full file path (directory path and file name)specified in the scan exclusion list

File extensions

Apex One (Mac) will not scan a file if its file extension matches any ofthe extensions included in this exclusion list.

Configuring Scan Exclusion Lists
For details about Scan Exclusion Lists, see Scan Exclusions on page 21-28.
Procedure1.

Select the check box to enable scan exclusion.

2.

To configure the Scan Exclusion List (Files):a.

Type a full file path or directory path and click Add.
Reminders:• It is not possible to type only a file name.
• You can specify a maximum of 64 paths. See the following tablefor examples.
Path

Details

Full file pathExcludes a
specific file on theendpoint

Examples• Example 1:/file.log• Example 2:/System/file.log

21-29

Trend Micro Apex Central™ Widget and Policy Management Guide

Path

Details

Directory pathExcludes all files
located on a
specific folder andall its subfolders

Examples• Example 1:/System/

Examples of files excluded fromscans:• /System/file.log• /System/Library/file.log

Examples of files that will bescanned:• /Applications/file.log• Example 2:/System/Library

Examples of files excluded fromscans:• /System/Library/file.log• /System/Library/
Filters/file.log

Examples of files that will bescanned:• /System/file.log• Use the asterisk wildcard (*) in place of folder names.
See the following table for examples.

21-30

Apex One (Mac) Policy Settings

Path
Full file path

Wildcard Usage Examples/Users/Mac/*/file.log

Examples of files excluded from scans:• /Users/Mac/Desktop/file.log• /Users/Mac/Movies/file.log
Examples of files that will be scanned:• /Users/file.log• /Users/Mac/file.log
Directory path

• Example 1:/Users/Mac/*

Examples of files excluded from scans:• /Users/Mac/doc.html• /Users/Mac/Documents/doc.html• /Users/Mac/Documents/Pics/pic.jpg
Examples of files that will be scanned:• /Users/doc.html• Example 2:/*/Components

Examples of files excluded from scans:• /Users/Components/file.log• /System/Components/file.log
Examples of files that will be scanned:• /file.log• /Users/file.log• /System/Files/file.log• Partial matching of folder names is not supported. For
example, it is not possible to type /Users/*user/temp to

21-31

Trend Micro Apex Central™ Widget and Policy Management Guide

exclude files on folder names ending in “user”, such as“end_user” or “new_user”.
b.
3.

To delete a path, select it and click Remove.

To configure the Scan Exclusion List (File Extensions):a.

Type a file extension without a period (.) and click Add. For
example, type pdf. You can specify a maximum of 64 fileextensions.

b.

To delete a file extension, select it and click Remove.

Trusted Program List
You can configure Security Agents to skip scanning of trusted processes
during Real-time Scan and event recording. After adding a program to theTrusted Program List, the Security Agent does not subject the program or any
processes initiated by the program to Real-time Scan and event recording.
Add trusted programs to the Trusted Program List to improve theperformance of scanning on endpoints.
Note
You can add files to the Trusted Program List if the following requirements aremet:• The file is not located in the system directory.
• The file has a valid digital signature.

After adding a program to the Trusted Program List, the Security Agent
automatically excludes the program from the following:• Real-time Scan file checking• Real-time Scan process scanning• Event recording

21-32

Apex One (Mac) Policy Settings

Configuring the Trusted Program List
The Trusted Program List excludes programs and all child processes calledby the program from Real-time Scan.
Procedure
1.

Type the full program path of the program to exclude from the list.

2.

Click + Add.

3.

To remove a program from the list, click the Delete icon.

Update Settings
To ensure that Security Agents stay protected from the latest security risks,
update agent components regularly. Also update Security Agents withseverely out-of-date components and whenever there is an outbreak.
Components become severely out-of-date when the Security Agent is unable
to update from the Apex One (Mac) server or the ActiveUpdate server for an
extended period of time.
Agent Update Methods
There are several ways to update Security Agents.
Description

Update Method
Administrator-initiatedmanual update

Initiate an update from the following web console screens:• Agent Management screen.
• Summary screen.

21-33

Trend Micro Apex Central™ Widget and Policy Management Guide

Update Method
Automatic update

Description• After the server finishes an update, it immediately notifies
Security Agents to update.
• Updates can run according to the schedule that you
configured. You can configure a schedule that applies to one
or several Security Agents and domains, or to all the Security
Agents that the server manages.
For details, see Configuring Agent Update Settings on page21-35.

User-initiated manual
updateUsers launch the update from their endpoints.

Agent Update Source
By default, Security Agents download components from the Apex One (Mac)server. In addition to components, Security Agents also receive updated
configuration files when updating from the Apex One (Mac) server. Security
Agents need the configuration files to apply new settings. Each time you
modify Apex One (Mac) settings on the web console, the configuration files
change.
Before updating the Security Agents, check if the Apex One (Mac) server has
the latest components.
Configure one, several, or all Security Agents to download from the Trend
Micro ActiveUpdate server if the Apex One (Mac) server is unavailable.
For details, see Configuring Agent Update Settings on page 21-35.
Note
If an agent only has an IPv6 address, read the IPv6 limitations for agent
updates in Pure IPv6 Agent Limitations on page 21-35.

Agent Update Notes and Reminders• Security Agents can use proxy settings during an update. Proxy settings
are configured on the agent console.
21-34

Apex One (Mac) Policy Settings• During an update, the Security Agent icon on the menu bar of theendpoint indicates that the product is updating. If an upgrade to the
Security Agent program is available, Security Agents update and thenupgrade to the latest program version or build. Users cannot run any
task from the console until the update is complete.
• Access the Summary screen to check if all Security Agents have been
updated.

Pure IPv6 Agent Limitations
The following table lists the limitations when Security Agents only have an
IPv6 address.
Table 21-5. Pure IPv6 Agent Limitations
Item

Limitation

Parent serverPure IPv6 agents cannot be managed by a pure IPv4 server.

UpdatesA pure IPv6 agent cannot update from pure IPv4 update sources,
such as:• Trend Micro ActiveUpdate Server• A pure IPv4 Apex One (Mac) server

Web Reputation queries

A pure IPv6 agent cannot send Web Reputation queries to Trend
Micro Smart Protection Network.

Proxy connection

A pure IPv6 agent cannot connect through a pure IPv4 proxy
server.

Agent deployment

Apple Remote Desktop is unable to deploy the agent to pure IPv6
endpoints because these endpoints always appear as offline.

Most of these limitations can be overcome by setting up a dual-stack proxy
server that can convert between IPv4 and IPv6 addresses (such as DeleGate).
Position the proxy server between the agents and the entities to which they
connect.

Configuring Agent Update Settings
For a detailed explanation of agent updates, see Update Settings on page 21-33.
21-35

Trend Micro Apex Central™ Widget and Policy Management Guide

Procedure1.

Select Agents download updates from the Trend Micro ActiveUpdate
server when unable to connect to the Apex One (Mac) server to allow
agents to download updates from the Trend Micro ActiveUpdate server.
Note
If a Security Agent only has an IPv6 address, read the IPv6 limitations foragent updates in Pure IPv6 Agent Limitations on page 21-35.

2.

Select Agents can update the components but not upgrade the agent
program or install hot fixes to allow component updates to proceed but
prevents agent upgrade.

3.

To set up scheduled updates, complete the following steps:a.

Select Enable scheduled update.

b.

Configure the schedule.

c.

If you select Daily or Weekly, specify the time of the update and thetime period the Apex One (Mac) server will notify Security Agents to
update components. For example, if the start time is 12pm and thetime period is 2 hours, the server randomly notifies all online
Security Agents to update components from 12pm until 2pm. Thissetting prevents all online Security Agents from simultaneously
connecting to the server at the specified start time, significantly
reducing the amount of traffic directed to the server.

Web Reputation
Web reputation technology tracks the credibility of web domains byassigning a reputation score based on factors such as a website's age,historical location changes, and indications of suspicious activities
discovered through malware behavior analysis. It will then continue to scansites and block users from accessing infected ones.
Security Agents send queries to smart protection sources to determine thereputation of websites that users are attempting to access. A website’s
21-36

Apex One (Mac) Policy Settings

reputation is correlated with the specific web reputation policy enforced on
the endpoint. Depending on the policy in use, the Security Agents will either
block or allow access to the website.
Note
This feature supports the latest Safari™, Mozilla™ Firefox™, and Google
Chrome™ browsers.

Configuring Web Reputation Settings
Web Reputation settings include policies that dictate whether Apex One(Mac) will block or allow access to a website. To determine the appropriate
policy to use, Apex One (Mac) checks the location of the Security Agent. The
location of a Security Agent is "internal" if the Security Agent can connect to
the Apex One (Mac) server. Otherwise, the location for the Security Agent is"external".
Procedure1.

To configure a policy for external Security Agents:a.

Click the External Agents tab.

b.

Select Enable Web Reputation policy.
When the policy is enabled, external Security Agents send web
reputation queries to the Smart Protection Network.
Note
If an agent only has an IPv6 address, read the IPv6 limitations for
Web Reputation queries in Pure IPv6 Agent Limitations on page 21-35.

c.

Select from the available web reputation security levels: High,
Medium or Low

21-37

Trend Micro Apex Central™ Widget and Policy Management Guide

Note
The security levels determine whether Apex One (Mac) will allow or
block access to a URL. For example, if you set the security level toLow, Apex One (Mac) only blocks URLs that are known to be web
threats. As you set the security level higher, the web threat detection
rate improves but the possibility of false positives also increases.

d.

2.

To submit web reputation feedback, click the URL provided. The
Trend Micro Web Reputation Query system opens in a browser
window.

To configure a policy for internal Security Agents:a.

Click the Internal Agents tab.

b.

Select Enable Web Reputation policy.
When the policy is enabled, internal Security Agents send web
reputation queries to:• Smart Protection Servers if the Send queries to SmartProtection Servers option is enabled.
• Smart Protection Network if the Send queries to SmartProtection Servers option is disabled.
Note
If an agent only has an IPv6 address, read the IPv6 limitations for
Web Reputation queries in Pure IPv6 Agent Limitations on page 21-35.

c.

Select Send queries to Smart Protection Servers if you wantinternal Security Agents to send web reputation queries to SmartProtection Servers.
• If you enable this option, Security Agents refer to the same
smart protection source list used by Apex One Security Agentsto determine the Smart Protection Servers to which they send
queries.

21-38

Apex One (Mac) Policy Settings• If you disable this option, Security Agents send web reputation
queries to Smart Protection Network. Endpoints must haveInternet connection to send queries successfully.
d.

Select from the available web reputation security levels: High,
Medium or Low
Note
The security levels determine whether Apex One (Mac) will allow or
block access to a URL. For example, if you set the security level toLow, Apex One (Mac) only blocks URLs that are known to be web
threats. As you set the security level higher, the web threat detection
rate improves but the possibility of false positives also increases.
Security Agents do not block untested websites, regardless of the
security level.

e.

To submit web reputation feedback, click the URL provided. The
Trend Micro Web Reputation Query system opens in a browser
window.

f.

Select whether to allow the Security Agents to send web reputation
logs to the server. Allow Security Agents to send logs if you want toanalyze URLs being blocked by Apex One (Mac) and take theappropriate action on URLs you think are safe to access.

Configuring the Approved and Blocked URL Lists
Add websites that you consider safe or dangerous to the approved or blocked
list. When Apex One (Mac) detects access to any of these websites, it
automatically allows or blocks the access and no longer sends a query tosmart protection sources.
Procedure
1.

Access the Apex One (Mac) web console.

2.

Navigate to Agents > Global Agent Settings > Web Reputation
Approved/Blocked URL List.
21-39

Trend Micro Apex Central™ Widget and Policy Management Guide

3.

Specify a URL in the text box. You can add a wildcard character (*)
anywhere on the URL.
Examples:• www.trendmicro.com/* means all pages on the
www.trendmicro.com domain.
• *.trendmicro.com/* means all pages on any sub-domain oftrendmicro.com.
You can type URLs containing IP addresses. If a URL contains an IPv6
address, enclose the address in square brackets.

4.

Click Add to Approved List or Add to Blocked List.

5.

To delete an entry, select an option from the View drop-down list andclick the icon next to a URL.

6.

Click Deploy.

21-40

Part VIII
Deep Discovery Widgets andPolicies

Chapter 22

Deep Discovery Analyzer and Email
Inspector Dashboard Widgets
This section contains help topics for the Deep Discovery Analyzer and Deep
Discovery Email Inspector dashboard widgets supported in Apex Central.
Topics include:

22-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Deep Discovery Analyzer Widgets
This section contains help topics for all the Deep Discovery Analyzer widgets
supported in Apex Central.

Virtual Analyzer Summary Widget
This widget displays the total number of samples submitted to Virtual
Analyzer and the number of these samples with risk. The widget may display
data from one or more Deep Discovery Analyzer appliances. The widget
presents data in a table and an associated pie chart.
Label

Description

Submissions

The total number of submissions to Virtual Analyzer.

Identified risks

The total number of submissions with identified risks.

High risk

The total number of high-risk submissions.

Medium risk

The total number of medium-risk submissions.

Low risk

The total number of low-risk submissions.

% of submissions
that are risks

The percentage of the total submissions that are risks.

Malicious Events
Distribution

A pie chart that shows the percentage of identified risks that are highrisk, medium-risk, and low-risk.

Change the time range by selecting an option in the Range drop-down list at
the top left section of the widget.
Change whether the data shown is from all registered Deep Discovery
Analyzer appliances or a specific appliance by selecting the option in theShow drop-down list at the top left section of the widget.
After selecting an appliance, view more details by clicking the total numberof submissions, the number of submissions with high-/medium-/low-risk, ora section in the pie chart.

22-2

Deep Discovery Analyzer and Email Inspector Dashboard Widgets

Deep Discovery Email Inspector Widgets
This section contains help topics for all the Deep Discovery Email Inspector
widgets supported in Apex Central.

Email Messages with Advanced Threats Widget
The Email Messages with Advanced Threats widget shows all email
messages with malicious and suspicious characteristics that Deep Discovery
Email Inspector detects. Suspicious characteristics includes anomalous
behavior, false or misleading data, suspicious and malicious behavior
patterns, and strings that indicate system compromise but require further
investigation.
The graph is based on the selected period. The Y-axis represents the email
message count. The X-axis represents the period. Mouse-over a point on thegraph to view the number of high risk messages and the period.
Click an item in the widget legend to show or hide data related to that metric.
Click View detected messages to view all detections.

Top Email Recipients of Advanced Threats Widget
The Top Email Recipients of Advanced Threats widget shows the recipients
who received the highest volume of suspicious messages on Deep Discovery
Email Inspector.
The table shows detections based on the selected time period. Click a
number under Detections or High Risk Messages to learn more about thedetections. Detections includes all detected email messages, including highrisk messages.

22-3Chapter 23

Deep Discovery Inspector Integration
and Policy Settings
This section discusses how to integrate Deep Discovery Inspector with Apex
Central and manage policies from the Apex Central console.
Topics include:

23-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Deep Discovery Inspector Integration Summary
This topic discusses the extent of integration between Apex Central andsupported Deep Discovery Inspector versions.
Integration Feature/Function

5.0

Registration

From the Deep Discovery Inspector management
console (through the MCP Agent)

Single sign-on

Supported

License management

None

Command tracking

Supported

Components deployed from Apex Central

All components

Policies managed and deployed from
Apex Central• Deny List/Allow List on page 23-9
• Adding Monitored Network Groups on page23-10
• Adding Registered Services on page 23-12• Configuring Virtual Analyzer Settings on page
23-13

Information shown in User/Endpoint
Directory

None

Ad-hoc query

Select any of the following data views while
performing an ad-hoc query to view productinformation and logs:• Product Status Information• Deep Discovery Information

Dashboard widgets specific to product• Deep Discovery Inspector System Status
Widget on page 23-6
• Deep Discovery Inspector Affected Hosts
Widget on page 23-3

Dashboard widgets shared with othermanaged products

23-2

None

Deep Discovery Inspector Integration and Policy Settings

Integration Feature/Function
Static report templates
Custom report templates (predefined)

5.0
Trend Micro Deep Discovery Inspector reports• TM-Deep Discovery Inspector Host Severity
Summary• TM-Deep Discovery Inspector Suspicious
Threat Detection Summary

Event notifications

Advanced Threat Activity• C&C callback alert• C&C callback outbreak alert• High risk Virtual Analyzer detections• High risk host detections• Known targeted attack behavior detections• Potential document exploit detections• Rootkit or hacking tool detections• SHA-1 Deny List detections• Worm or file infector propagation detections• Correlated incident detections

Data Loss Prevention (DLP) incident
management
Suspicious object and IOC file
management

Not applicable• Sends suspicious objects to Apex Central• Synchronizes suspicious objects with Apex
CentralDeep Discovery Inspector Affected Hosts Widget
This widget displays information about the Deep Discovery Inspector
detections found on affected hosts.
The default view displays only the top 10 high severity hosts by Detection
count.

23-3

Trend Micro Apex Central™ Widget and Policy Management Guide

To change whether the widget displays hosts by detection count or by
detection time, click the settings icon ( > ) and select one of thefollowing:• Detection count: Select the number of hosts (Top 10, Top 25, Top 50)
from the drop-down.
• Detection time: Select the number of hosts (Latest 10, Latest 25, Latest
50, Latest 100) from the drop-down.
Use the Range drop-down to select the time period for the data that displays.
• If you display hosts by Detection count, you can view data for Today, 1Week, 2 Weeks, or 1 Month.
• If you display hosts by Detection time, you can only view data for Todayor 1 Week.
You can also use the Severity drop-down to specify the severity level whendisplaying hosts by Detection time.
ColumnDescription

IP Address

Displays the IP address of the affected host

Host Name

Displays the name of the affected host.

Network Group

Displays the name of the group of monitored networks that allow
Deep Discovery Inspector to determine whether attacks originate fromwithin or outside the network

Detections

Displays the number of events found on affected hosts• Click a number in the Detections column to view additional
information on the Detections screen.
• Click the View link in the Details column to log on to Deep
Discovery Inspector using single sign-on and display the
Detections Log Query Detail screen.
If the log is purged, the console displays a message informing youof the action.

Latest Detection

23-4

Displays the time and date that Deep Discovery Inspector last detected
a potential/known risk.

Deep Discovery Inspector Integration and Policy Settings

Deep Discovery Inspector Affected Hosts Detections
Clicking a value in the Detections column of the Deep Discovery Inspector
Affected Hosts widget displays a table with host-related information:
Table 23-1. Host-related Information
Column Name

Information

Date

Date and time when Deep Discovery Inspector generated the detection
log

Severity

Severity rating descriptions:• High: Known malicious or involved in high-severity connections• Medium: IP address/domain/URL is unknown to reputation
service• Low: Reputation service indicates previous compromise or spam
involvement• Informational: An object that is most likely benign

Detection

The rule description or malware nameThreat TypeAny of the following:• File Pattern• Malicious Behavior• Suspicious Behavior• Exploit• Grayware• Web Reputation• Disruptive Applications

Source IP

The IP address of the source where a suspicious object originates

Destination IP

The IP address of the intended destination of a suspicious object

ProtocolThe protocol used when transporting a suspicious object from thesource to the destination

File Name

File name extracted from the sample

23-5Trend Micro Apex Central™ Widget and Policy Management Guide

Column Name

Information

Logged By

The host name of Deep Discovery Inspector that analyzed the sample

Details

Click View to launch another window that provides detailed analysis
related to the suspicious object in Deep Discovery Inspector.

Deep Discovery Inspector System Status Widget
Use this widget to display the resource usage and number of queued samples
waiting for Virtual Analyzer processing for selected Deep Discovery
Inspector appliances.
By default the widget displays data from all the managed products/serversthat a user's account privileges allow.
Click the settings icon (>) to configure the following:• Title: Specify a new and meaningful title for the widget.
• Scope: All Products: Click the >> button to specify the products that
contribute data for display.
The widget displays the following system resource data to verify that all Deep
Discovery Inspector resources are operating within specifications.

23-6

Deep Discovery Inspector Integration and Policy Settings

ColumnServer Name

Description
The server name for each Deep Discovery Inspector appliance• View detailed status: Click this option to view product statusdetails. "View detailed status" data can also be viewed through a
Product Status log query.
This table displays percentage of CPU usage, percentage andactual memory and disk usage, and number of queued samples
waiting for Virtual Analyzer processing. To assist withtroubleshooting, refer to the Product Host, Product IP,
Connection Status, and Product Version fields. Deep Discovery
Inspector sends a system status update to Apex Central every fiveis displayed, Apex Central is not receiving theminutes. Whenlatest Deep Discovery Inspector system status logs. Confirm that
Deep Discovery Inspector is active and connected.
• Log-on console: Click this option to access the Deep Discovery
Inspector management console. No logon credentials are
required.

CPU Usage

The percent of CPU in use by the server•is displayed when the server's CPU average exceeds 80%.
NoteCPU, memory, and disk usage and queue sample limits
are not configurable. If alerts are persistent, consider
upgrading your Deep Discovery Inspector/Virtual
Analyzer appliances.

23-7

Trend Micro Apex Central™ Widget and Policy Management Guide

ColumnMemory Usage

Description
The percent of available memory on the server•is displayed when memory usage exceeds 80%.
NoteCPU, memory, and disk usage and queue sample limits
are not configurable. If alerts are persistent, consider
upgrading your Deep Discovery Inspector/Virtual
Analyzer appliances.

Disk Usage

The percent of available disk space on the server•is displayed when disk usage exceeds 80%.
NoteCPU, memory, and disk usage and queue sample limits
are not configurable. If alerts are persistent, consider
upgrading your Deep Discovery Inspector/Virtual
Analyzer appliances.

Samples Queued

The number of queued samples waiting for Virtual Analyzer processing•

is displayed when the Virtual Analyzer queue exceeds 40
samples.
NoteCPU, memory, and disk usage and queue sample limits
are not configurable. If alerts are persistent, consider
upgrading your Deep Discovery Inspector/Virtual
Analyzer appliances.

23-8

Deep Discovery Inspector Integration and Policy Settings

Deep Discovery Inspector Policy Settings
This section discusses how to configure Deep Discovery Inspector policy
settings on the Create Policy screen.

Deny List/Allow List
The Deny List/Allow List screen is separated in to the following tabs: Deny
List, Allow List, Import/Export.
Table 23-2. Deny List/Allow List Tabs
Tab

Description

Deny List

Deep Discovery Inspector monitors ormonitors and resets the connection to entries
in the Deny List.

Allow List

Deep Discovery Inspector allows theconnection to entries in the Allow List.
Tip
Use the Allow List to lower thenumber of false positive detections
from the Deny List.

Import/Export

Import or export Deny List or Allow List
entries.

Creating a Custom Deny List
Procedure1.

Select the Deny List tab.

2.

To add an entity to the Deny List, select Add.
The Add Item to Deny List window appears.

23-9

Trend Micro Apex Central™ Widget and Policy Management Guide

3.

At the Add Item to Deny List window, verify information, add any
comments, and click Save.

Creating a Custom Allow List
Procedure1.

Select the Allow List tab.

2.

To add an entity to the Allow List, select Add.
The Add Item to Allow List window appears.

3.

At the Add Item to Allow List window, verify information, add any
comments, and click Save.

Importing/Exporting Custom Deny or Allow Lists
Procedure1.

Select the Import/Export tab.

2.

To export the current Deny or Allow List, select a list and click Export.

3.

To overwrite the current Deny or Allow List, select a list, browse to thestorage location and click Import.
The current selected list is overwritten.

Adding Monitored Network Groups
Establish groups of monitored networks using IP addresses to allow Deep
Discovery Inspector to determine whether attacks originate from within or
outside the network.
Procedure
1.
23-10

Click Add.

Deep Discovery Inspector Integration and Policy Settings

2.

Specify a group name.
Tip
Provide specific groups with descriptive names for easy identification of
the network to which the IP address belongs. For example, "Financenetwork", "IT network", or "Administration".

3.

Specify an IP address range in the text box (up to 1,000 IP address
ranges).
Deep Discovery Inspector comes with a monitored network called
Default, which contains the following IP address blocks reserved by theInternet Assigned Numbers Authority (IANA) for private networks:• 10.0.0.0 - 10.255.255.255• 172.16.0.0 - 172.31.255.255• 192.168.0.0 - 192.168.255.255
Note• If you did not remove Default, you do not need to specify these IP
address blocks when adding a new monitored network.
• Use a dash to specify an IP address range.
Example: 192.168.1.0-192.168.1.255.
• Use a slash to specify the subnet mask for IP addresses.
Example: 192.168.1.0/255.255.255.0 or 192.168.1.0/24.
• Up to three layers of sub-groups can be added.

4.

Select the network zone of network group:• Trusted: This is a secure network• Untrusted: There is a degree of doubt about the security of the
network.
23-11

Trend Micro Apex Central™ Widget and Policy Management Guide

5.

Click Add.

6.

Click Finish.

Adding Registered Services
Add different servers for specific services that your organization uses
internally or considers trustworthy to establish the network profile.
Identifying trusted services in the network ensures detection ofunauthorized applications and services.
Add only trusted services (up to 1,000 services) to ensure the accuracy of
your network profile.

Procedure1.

Select a service from the drop-down list.
Table 23-3. Service Types
Service

23-12

Description

DNS

The network server used as a DNS server.

FTP

The network server used as an FTP server.

HTTP Proxy

The network server used as an HTTP Proxy
server.

SMTP

The network server used as an SMTP
server.

SMTP Open Relay

The network server used as an SMTP Open
Relay server.

Software Update Server

The network server responsible forWindows Server Update Services (WSUS)
or the server that performs remote
deployment.

Security Audit Server

The network server used to detect both
vulnerabilities and insecure configurations.

Deep Discovery Inspector Integration and Policy Settings

Service

Description

Active Directory

The network server used as the Active
Directory server.

Domain Controller

The network server used as the Domain
Controller server.

Database Server

The network server used as the databaseserver.

Authentication Servers - Kerberos

The network server used to provide
Kerberos authentication.

File Server

The network server used to provide alocation for shared file access.

Web Server

The network server used as a web server.

Content Management Server

The network server used for managing
content.

Radius Server

The network server used as the Radiusauthentication server.

Registered service names appear in the Defined Registered Services
section.
2.

Specify a server name.

3.

Specify an IP address.

4.

Click Add.

Configuring Virtual Analyzer Settings
Use this option to enable or disable analysis of threat files.

Procedure
1.

Ensure that the management port can access the Internet; the virtual
analyzer may need to query data through this port.

23-13

Trend Micro Apex Central™ Widget and Policy Management Guide2.

At the Virtual Analyzer Configuration window, check Submit files to
Virtual Analyzer.

3.

Select an analysis module.
• For Internal Analyzer select a network type.
Table 23-4. Analyzer Network Types
Module Option

Description

Management Network

Select this network type to direct virtual
analyzer traffic through a management
port.

Custom network / Specified Network

Select this network type to configure a
specific port for virtual analyzer traffic.
Ensure that the port is able to connect
to an outside network directly.

No network / Isolated Network

Select this network type to isolate
virtual analyzer traffic within the virtual
analyzer, and when the environment
has no connection to an outside
network.

Table 23-5. Custom network / Specified network options
ActionOptionVirtual Analyzer port

Select a Virtual Analyzer port.
Note
Assign a Virtual Analyzer port
different from the Deep
Discovery Inspector data port.

Configure IPv4

23-14

Automatically (using DHCP) is
selected. This setting cannot bechanged.

Deep Discovery Inspector Integration and Policy Settings• For External Analyzer specify a Virtual Analyzer IP address and an
API Key.
Tip
The external analyzer (Deep Discovery Advisor or Deep Discovery
Analyzer) has more analysis capability than the internal analyzer (Virtual
Analyzer).

4.

(Optional) For the internal Virtual Analyzer, enable and configure a
dedicated proxy.
Note
To configure the proxy settings, the management network or custom
network must be selected as the network type.

a.

In Proxy Setting select Use dedicated proxy settings.

b.

In Server address, type the proxy server's IP address, host name, or
FQDN.

c.

Type the port number.

d.

(Optional) Type the proxy server's authentication credentials.

5.

(Optional) For the internal Virtual Analyzer, select Send possible Mac
OS threats to the Trend Micro cloud sandboxes for analysis.

6.

Configure File submission options:a.

Specify the maximum file size. Changing this setting may affect
Deep Discovery Inspector performance.

b.

Enable Certified Safe Software Service (CSSS).

23-15

Trend Micro Apex Central™ Widget and Policy Management Guide

Note
Certified Safe Software Service (CSSS) is the Trend Micro cloud
database of safe files. Deep Discovery Inspector queries Trend
Micro datacenters to check submitted files against the database.

23-16

Part IX
Deep Security Manager Widgets

Chapter 24

Deep Security Manager Dashboard
Widgets
This section contains help topics for the Deep Security Manager dashboard
widgets supported in Apex Central.
Topics include:24-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Deep Security Anti-Malware Event History Widget
This widget displays the number of Anti-Malware Events that occurred overthe specified time range.
Click a bar to display the Deep Security Manager Events page filtered to show
the Anti-Malware Events for the specified event type and time period. You
can also click the event types in the legend to change the chart view.
Use the Range drop-down to select the time period for the data that displays.
Change the managed server that the widget uses as its source by clicking thesettings icon ( > ). On the screen that appears, select the managed
server to use as the source and click Save.
Note
The data displayed in the widget is restricted to what is permitted by the user
account privileges.
TipThis widget can only display data from a single Deep Security server. To
monitor multiple Deep Security servers, create a new widget for each server.

Deep Security Anti-Malware Status (Malware)
WidgetThis widget displays the five most common malware threats detected on yourendpoints.
Click a count in the Total column to view additional details in the Deep
Security Manager console.
Use the Range drop-down to select the time period for the data that displays.
Change the managed server that the widget uses as its source by clicking thesettings icon ( > ). On the screen that appears, select the managed
server to use as the source and click Save.
24-2

Deep Security Manager Dashboard Widgets

To make a Deep Security installation available to the Deep Security widgets,go to Administration > Managed Servers > Server Registration and add a
new Deep Security server.
Note
The data displayed in the widget is restricted to what is permitted by the user
account privileges.
TipThis widget can only display data from a single Deep Security server. To
monitor multiple Deep Security servers, create a new widget for each server.
Data

Description

Malware Name

The name of the malware threat

Number of
Uncleanable

The number of occurrences of the threat that Deep Security was
unable to clean

Total

Number of events in the time range and the percentage of the total
Events of this type that it represents

Previous Total

Number of events in the time period preceding the current time range

Trend

The percentage change from the previous to the current period

Deep Security Application Type Activity (Detected)
WidgetThis widget displays the top five Application Types associated with IPS(Detected) events.
Click on a value in the Total column to display the of Deep Security Manager
Events screen filtered to show the IPS (Detected) events associated with thespecific Application Type.

24-3

Trend Micro Apex Central™ Widget and Policy Management Guide

Change the managed server that the widget uses as its source by clicking thesettings icon ( > ). On the screen that appears, select the managed
server to use as the source and click Save.
Note
The data displayed in the widget is restricted to what is permitted by the user
account privileges.
TipThis widget can only display data from a single Deep Security server. To
monitor multiple Deep Security servers, create a new widget for each server.
Data

Description

Application TypeName

The name of the Application Type

Total

Number of events in the time period and the percentage of the total
events of this type that it represents

Previous Total

Number of events in the time period preceding the current time
periodTrend

The percentage of change from the previous to the current time period

Deep Security Application Type Activity(Prevented) Widget
This widget displays the top five Application Types associated with IPS(Prevented) events.
Click on a value in the Total column to display the of Deep Security Manager
Events screen filtered to show the IPS (Prevented) events associated with thespecific Application Type.

24-4

Deep Security Manager Dashboard Widgets

Change the managed server that the widget uses as its source by clicking thesettings icon ( > ). On the screen that appears, select the managed
server to use as the source and click Save.
Note
The data displayed in the widget is restricted to what is permitted by the user
account privileges.
TipThis widget can only display data from a single Deep Security server. To
monitor multiple Deep Security servers, create a new widget for each server.
Data

Description

Application TypeName

The name of the Application Type

Total

Number of events in the time period and the percentage of the total
events of this type that it represents

Previous Total

Number of events in the time period preceding the current time
periodTrend

The percentage of change from the previous to the current time period

Deep Security Component Summary Widget
This widget displays version numbers of available Deep Security component
updates and the percentage of endpoints that have been updated to the latest
version.
Important
This widget only displays data from Deep Security 7.5 or later.

24-5

Trend Micro Apex Central™ Widget and Policy Management Guide

Change the managed server that the widget uses as its source by clicking thesettings icon ( > ). On the screen that appears, select the managed
server to use as the source and click Save.
Note
The data displayed in the widget is restricted to what is permitted by the user
account privileges.
Data

Description

Components

The name of the Deep Security component.

Current Version

The version that is currently available on Deep Security Manager.

Percent Updated

The percentage of managed computers that have updated to the latest
version.
Note
Updates may not be applicable to all managed computers.

The widget displays version numbers for the following components.
Component

24-6

Description

Smart Scan Agent
Pattern

The smaller malware pattern detection file that is sent to the Deep
Security Virtual Appliance. If a comparison to these patterns suggeststhat a file on a computer may be malicious, the file is compared to themore robust pattern file on the Smart Scan server for confirmation.

Virus Pattern

A file that helps the Deep Security virtual appliance identify virus
signatures, unique patterns of bits and bytes that signal the presenceof a virus.

IntelliTrap PatternIntelliTrap searches malware that may be hidden in files that use realtime compression paired with other malware characteristics likepackers.

Spyware Active
Monitoring Pattern

Spyware detection patterns.

Deep Security Manager Dashboard Widgets

Component

Description

Virus Scan Engine

The engine that applies virus patterns to a file during a virus scan.

Deep Security Rule
UpdateDPI Rules provide Intrusion Detection and Prevention (IDS/IPS)
protection by protecting vulnerabilities from known and as-yet
unknown attacks.

Deep Security Feature Summary Widget
This widget shows the recent activity of each of the Deep Security modules.
Use the Range drop-down to select the time period for the data that displays.
The widget displays aggregated information from multiple managed servers.
Change the managed server that the widget uses as its source by clicking thesettings icon ( > ). On the screen that appears, select the managed
server to use as the source and click Save.
Tip
To view non-aggregated data from multiple managed servers, add a newwidget for each managed server.
Note
The data displayed in the widget is restricted to what is permitted by the user
account privileges.
Description

Data
ModuleThe Deep Security module

Protected Computers

The current number of managed computers being protected by thismodule and the percentage of all managed computers that thisrepresents

Event CountThe number of events generated by the module during the specified
time period

24-7Trend Micro Apex Central™ Widget and Policy Management Guide

Data

Description

Trend

The percentage of change in the number of events since the previous
time period

Total Number ofComputers

The total number of computers being managed by Deep Security

Deep Security Firewall Activity (Detected) Widget
This widget displays the top five Firewall Rules that have triggered thegreatest number of events and are operating in Detect mode .
Click on a value in the Total column to display the of Deep Security Manager
Events screen filtered to show the firewall events triggered by the specific
rule.
Change the managed server that the widget uses as its source by clicking thesettings icon ( > ). On the screen that appears, select the managed
server to use as the source and click Save.
Note
The data displayed in the widget is restricted to what is permitted by the user
account privileges.
Description

Data

24-8

Reason

The name of the rule

Total

Number of events in the time period and the percentage of the total
events of this type that it represents

Previous Total

Number of events in the time period preceding the current time
periodTrend

The percentage of change from the previous to the current time periodDeep Security Manager Dashboard Widgets

Deep Security Firewall Activity (Prevented) Widget
This widget displays the top five Firewall Rules that have triggered thegreatest number of events and are operating in Prevent mode.
Click on a value in the Total column to display the of Deep Security Manager
Events screen filtered to show the firewall events triggered by the specific
rule.
Change the managed server that the widget uses as its source by clicking thesettings icon ( > ). On the screen that appears, select the managed
server to use as the source and click Save.
Note
The data displayed in the widget is restricted to what is permitted by the user
account privileges.
Data

Description

Reason

The name of the rule

Total

Number of events in the time period and the percentage of the total
events of this type that it represents

Previous Total

Number of events in the time period preceding the current time
periodTrend

The percentage of change from the previous to the current time period

Deep Security Firewall Event History Widget
This widget displays the number of Firewall Events detected by Deep
Security Manager over the specified time range. The chart displays Events
triggered by Firewall Rules in both Detect and Prevent mode.
Click a bar to view additional details in the Deep Security Manager console.
You can also click the event types in the legend to change the chart view.
Use the Range drop-down to select the time period for the data that displays.
24-9

Trend Micro Apex Central™ Widget and Policy Management Guide

Change the managed server that the widget uses as its source by clicking thesettings icon ( > ). On the screen that appears, select the managed
server to use as the source and click Save.
To make a Deep Security installation available to the Deep Security widgets,go to Administration > Managed Servers > Server Registration and add a
new Deep Security server.
Note
The data displayed in the widget is restricted to what is permitted by the user
account privileges.
TipThis widget can only display data from a single Deep Security server. To
monitor multiple Deep Security servers, create a new widget for each server.

Deep Security Integrity Monitoring Activity Widget
This widget displays the top five Integrity Monitoring Rules that havetriggered the greatest number of events.
Click on a value in the Total column to display the of Deep Security Manager
Events screen filtered to show the integrity monitoring events triggered by
the specific rule.
Change the managed server that the widget uses as its source by clicking thesettings icon ( > ). On the screen that appears, select the managed
server to use as the source and click Save.
Note
The data displayed in the widget is restricted to what is permitted by the user
account privileges.

24-10Deep Security Manager Dashboard Widgets

Data

Description

Reason

The name of the rule

Total

Number of events in the time period and the percentage of the total
events of this type that it represents

Previous Total

Number of events in the time period preceding the current time
periodTrend

The percentage of change from the previous to the current time period

Deep Security Integrity Monitoring Event History
WidgetThis widget displays the severity level of events logged by Integrity
Monitoring scans for the specified period.
Use the Range drop-down to select the time period for the data that displays.
Change the managed server that the widget uses as its source by clicking thesettings icon ( > ). On the screen that appears, select the managed
server to use as the source and click Save.
Note
The data displayed in the widget is restricted to what is permitted by the user
account privileges.
TipThis widget can only display data from a single Deep Security server. To
monitor multiple Deep Security servers, create a new widget for each server.

24-11

Trend Micro Apex Central™ Widget and Policy Management Guide

Deep Security Intrusion Prevention Event History
WidgetThis widget displays the number of intrusion prevention events detected by
Deep Security over the specified time range. The chart displays Events
triggered by IPS Rules in both Detect and Prevent mode.
Click a bar to display the Deep Security Manager Events page filtered to show
the IPS Events for the specified mode and time range. You can also click amode (Detect or Prevent) in the legend to change the chart view.
Use the Range drop-down to select the time period for the data that displays.
Change the managed server that the widget uses as its source by clicking thesettings icon ( > ). On the screen that appears, select the managed
server to use as the source and click Save.
Note
The data displayed in the widget is restricted to what is permitted by the user
account privileges.
TipThis widget can only display data from a single Deep Security server. To
monitor multiple Deep Security servers, create a new widget for each server.

Deep Security IPS Activity (Detected) Widget
This widget displays the top five IPS Rules that have triggered the greatest
number of events and are operating in Detect mode .
Click on a value in the Total column to display the of Deep Security Manager
Events screen filtered to show the IPS (Detected) events triggered by the
specific rule.
Change the managed server that the widget uses as its source by clicking thesettings icon ( > ). On the screen that appears, select the managed
server to use as the source and click Save.
24-12

Deep Security Manager Dashboard Widgets

Note
The data displayed in the widget is restricted to what is permitted by the user
account privileges.
Data

Description

Reason

The name of the rule

Total

Number of events in the time period and the percentage of the total
events of this type that it represents

Previous Total

Number of events in the time period preceding the current time
periodTrend

The percentage of change from the previous to the current time period

Deep Security IPS Activity (Prevented) Widget
This widget displays the top five IPS Rules that have triggered the greatest
number of events and are operating in Prevent mode.
Click on a value in the Total column to display the of Deep Security Manager
Events screen filtered to show the IPS (Prevented) events triggered by the
specific rule.
Change the managed server that the widget uses as its source by clicking thesettings icon ( > ). On the screen that appears, select the managed
server to use as the source and click Save.
Note
The data displayed in the widget is restricted to what is permitted by the user
account privileges.
Description

Data
Reason

The name of the rule24-13

Trend Micro Apex Central™ Widget and Policy Management Guide

Data

Description

Total

Number of events in the time period and the percentage of the total
events of this type that it represents

Previous Total

Number of events in the time period preceding the current time
periodTrend

The percentage of change from the previous to the current time period

Deep Security Log Inspection Activity Widget
This widget displays the top five Log Inspection Rules that have triggered thegreatest number of events.
Click on a value in the Total column to display the of Deep Security Manager
Events screen filtered to show the log inspection events triggered by the
specific rule.
Change the managed server that the widget uses as its source by clicking thesettings icon ( > ). On the screen that appears, select the managed
server to use as the source and click Save.
Note
The data displayed in the widget is restricted to what is permitted by the user
account privileges.
Description

Data
Reason

The name of the rule

Total

Number of events in the time period and the percentage of the total
events of this type that it represents

Previous Total

Number of events in the time period preceding the current time
periodTrend

The percentage of change from the previous to the current time period

24-14

Deep Security Manager Dashboard Widgets

Deep Security Log Inspection Event History Widget
This widget displays the number of Events triggered by Log Inspection Rules
that occurred over the specified time range.
Click a bar (Detect or Prevent) to display the Deep Security Manager Events
page filtered to show the Log Inspection Events for the specified event type
and time period. You can also click the event types in the legend to change
the chart view.
Use the Range drop-down to select the time period for the data that displays.
Change the managed server that the widget uses as its source by clicking thesettings icon ( > ). On the screen that appears, select the managed
server to use as the source and click Save.
Note
The data displayed in the widget is restricted to what is permitted by the user
account privileges.
TipThis widget can only display data from a single Deep Security server. To
monitor multiple Deep Security servers, create a new widget for each server.

Deep Security Reconnaissance Scan Event History
WidgetThis widget displays the number of Events triggered by Reconnaissance Scan
detection settings that occurred over the specified time range.
Click a bar to display the Deep Security Manager Events page filtered to show
the Reconnaissance Scan detections for the specified event type and time
period. You can also click the event types in the legend to change the chartview.
Use the Range drop-down to select the time period for the data that displays.

24-15

Trend Micro Apex Central™ Widget and Policy Management Guide

Change the managed server that the widget uses as its source by clicking thesettings icon ( > ). On the screen that appears, select the managed
server to use as the source and click Save.
Note
The data displayed in the widget is restricted to what is permitted by the user
account privileges.
TipThis widget can only display data from a single Deep Security server. To
monitor multiple Deep Security servers, create a new widget for each server.

Deep Security Status Summary Widget
This widget displays the number of critical and warning alerts, as well as thestate of endpoints across the network.
The widget displays aggregated information from multiple managed servers.
Change the managed server that the widget uses as its source by clicking thesettings icon ( > ). On the screen that appears, select the managed
server to use as the source and click Save.
Tip
To view non-aggregated data from multiple managed servers, add a newwidget for each managed server.
Note
The data displayed in the widget is restricted to what is permitted by the user
account privileges.

24-16

Deep Security Manager Dashboard Widgets

Table 24-1. Alerts
Data
Critical Alerts

Description
The number of critical alerts
Note
Whether an alert is classified as critical or warning is userconfigurable in the Deep Security Manager web console.

Warning Alerts

The number of warning alerts
Note
Whether an alert is classified as critical or warning is userconfigurable in the Deep Security Manager web console.

Table 24-2. Computer Status
Data

Description

Managed (green)

Protected and without errors or warnings.

Unmanaged (blue)

Not protected.

Lock (grey)

Locked. When a computer is in a locked state,
Deep Security Manager will not communicate
with the Agent/Appliance or generate any
computer-related alerts.

Critical (red)In an error state.

Warning (yellow)

In a warning state.

Deep Security Web Reputation Event History
WidgetThis widget displays the number of events triggered by Web Reputation
Services that occurred over the specified time range.
Use the Range drop-down to select the time period for the data that displays.

24-17

Trend Micro Apex Central™ Widget and Policy Management Guide

Change the managed server that the widget uses as its source by clicking thesettings icon ( > ). On the screen that appears, select the managed
server to use as the source and click Save.
Note
The data displayed in the widget is restricted to what is permitted by the user
account privileges.
Data

Description

Dangerous

The URL is verified to be fraudulent or known sources of threats

Highly Suspicious

The URL is suspected to be fraudulent or possible sources of threats

Suspicious

The URL is associated with spam or possibly compromised

BlockedThe URL was blocked by an administrator

Untested

The URL has not been tested by Trend Micro yet
While Trend Micro actively tests web pages for safety, users may
encounter untested pages when visiting new or less popular websites.

Deep Security Web Reputation URL Activity Widget
This widget displays the top five Web Reputation Services URLs that have thegreatest number of events.
Change the managed server that the widget uses as its source by clicking thesettings icon ( > ). On the screen that appears, select the managed
server to use as the source and click Save.
Note
The data displayed in the widget is restricted to what is permitted by the user
account privileges.

24-18

Deep Security Manager Dashboard Widgets

Data

Description

URL

The URL

Total

Number of events in the time period and the percentage of the total
events of this type that it represents

Previous Total

Number of events in the time period preceding the current time
periodTrend

The percentage change from the previous to the current period

24-19Part X
Endpoint Application Control
Widgets and Policies

Chapter 25

Endpoint Application Control Dashboard
Widgets
This section contains help topics for all the Endpoint Application Control
dashboard widgets supported in Apex Central.
Topics include:

25-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Endpoint Application Control Key Performance
Indicators Widget
This widget displays Endpoint Application Control key performanceindicators based on selected criteria, and includes customizable templates
for applications detected for the first time, applications not in the Certified
Safe Software list, average agents stopped, average endpoints not connected,
block and lockdown rule.

Figure 25-1. KPI Widget Example

By default, the widget marks events as “Important”() at 5 occurrences and “Critical”() at 10 occurrences. Optionally, mark events as Important or Critical bycustomizing event thresholds.
See table Add or Edit Indicator Tasks.
Go to Dashboard and then select Widget Settings from the menu on the topright of the widget to do the following tasks:25-2

Endpoint Application Control Dashboard Widgets

Table 25-1. KPI Widget Configuration Tasks
Task
Edit indicator trend calculation
used by the widget.

Steps
The widget displays trends in the Change column. The
widget calculates indicator trends by comparing thecurrent period with an average of previous periods.
Under Trend Calculations, type a number of previous
periods to average.
The default setting is 1.

Go to Dashboard, locate this widget, and then click Edit to do the following
indicator-related tasks. After completing tasks, click Done.
Table 25-2. KPI Widget Indicator Tasks
Task
Add new indicator.

Steps
1. Click Add Indicator.
The Add Indicator screen appears.
2. Select a template, optionally customize settings,
and then click Save.
See table Add or Edit Indicator Tasks.

Edit indicator.

1. Click the indicator in the list.
The Edit Indicator screen appears.
2. Customize settings, and then click Save.
See table Add or Edit Indicator Tasks.

Delete indicator.

Clickto the left of the indicator and then click Delete.

25-3

Trend Micro Apex Central™ Widget and Policy Management Guide

Table 25-3. Add or Edit Indicator Tasks
Task
Name indicator.

Steps
Under Title, type a name.
Tip
Leave this field blank to allow Apex Central toname the indicator based on your configuration.

Select template.

Under Template, select a template.
See About Templates.

Edit period.

Under Period, select a period for indicator data.

Display threshold icons.

Select Enable thresholds.

Hide threshold icons.

Clear Enable thresholds.

Set “Important”(

Under Mark events as Important, type the minimum
number of event occurrences.

) threshold.

The icon displays in the Occurrences column if thefollowing are true:• The number of event occurrences that match thisindicator is equal to or more than the threshold.
• Enable thresholds is selected.

Set “Critical”(

Under Mark events as Critical, type the minimum
number of event occurrences.

) threshold.

The icon displays in the Occurrences column if thefollowing are true:• The number of event occurrences that match thisindicator is equal to or more than the threshold.
• Enable thresholds is selected.

This widget includes customizable templates for the following indicators:

25-4

Endpoint Application Control Dashboard Widgets“By”“Template”

Applications Detected for
the First Time

“Log type”

Trusted Applications

Occurrences
Aggregatedby Data
Column“Period”(Default)

7 daysImportant
This data matches
the log type
“Knownapplications”.
Applications not in theCertified Safe Software
List

Policy Actions

7 daysAverage Agents Stopped

Clients Samplings

1 day

Important
This data matches
the data source“Users andEndpoints”.
Average Endpoints notConnected

Clients Samplings

More than 1 dayin the last 1 day

Important
This data matches
the data source“Users andEndpoints”.

25-5

Trend Micro Apex Central™ Widget and Policy Management Guide“By”“Template”“Log type”

Block and Lockdown Rule
Application Events

Policy Actions

Occurrences
Aggregatedby Data
Column• Endpoint
Name“Period”(Default)

7 days• Name(default)• User Name
Block Rule Application
Events

Policy Actions• EndpointName

7 days• Name(default)• User Name
Lockdown Rule
Application Events

Policy Actions• EndpointName

7 days• Name(default)• User Name
Uncategorized
Applications Detected

Policy Actions

7 daysEndpoint Application Control Rule Management
This widget provides a list of rules types and rule names in Endpoint
Application Control rules.
To add new rules to Endpoint Application Control, click Add Rule to selectspecific types of rules to be added.
Rule
Allow

25-6

Description
Use the Allow rule to extend the Allow rights of trusted applications.

Endpoint Application Control Dashboard Widgets

Rule

Description

Block

Use the Block rule to block applications before or after execution.

Lockdown

Use the Lockdown rule to allow all currently-installed applications.
Therefore, a complete and up-to-date endpoint inventory is required.

Endpoint Application Control User and Endpoint
Summary Widget
This widget displays a distribution summary of Endpoint Application Control
users and endpoints based on selected criteria, and includes customizable
templates for agent connections, agent versions, endpoint Windows
versions, policies, policy updates, and rules. Modify the templates by using
custom settings.

Figure 25-2. User and Endpoint Summary Widget Example

Go to Dashboard and then select Widget Settings from the menu on the topright of the widget to do the following tasks:

25-7

Trend Micro Apex Central™ Widget and Policy Management Guide

Table 25-4. User and Endpoint Summary Widget Configuration Tasks
Task
Name widget.

Steps
Under Title, type a name.
Tip
Leave this field blank to allow Apex Central toname the widget based on your configuration.

Select template.

Under Template, select a template.

Edit data source.

Select Advanced.
Under Data source, select a data source for data
displayed by the widget.

Figure 25-3. Data Source
Limit displayed results.

Select Advanced.
Under Limit results to the following, use dynamic
search.

25-8

Endpoint Application Control Dashboard Widgets

Task
Change chart type.

Steps
Under Display, select one of the following types of chart:• Selectfor a line chart with data points.
• Selectfor a horizontal histogram.
• Selectfor a pie chart. (default)• Selectfor a data table.
Note
This control is not available if(display data table under chart) is selected.

Change chart size.

To the right of the chart types, select one of the following
a chart sizes:• Select Small for a chart that is about 1 unit tall.
• Select Medium for a chart that is about 2 units tall.
(default)• Select Large for a chart that is about 4 units tall.

Figure 25-4. Chart Size

25-9

Trend Micro Apex Central™ Widget and Policy Management Guide

Task
Change legend location.

Steps
Under Legend, select one of the following locations:• None• Bottom (default)• Right• Top• Left
Note
This control is not available if(display data as pie chart) is selected.

Display chart controls on widget.

Select the Toolbar check box. (default)

Hide chart controls on widget.

Clear the Toolbar check box.

Display data summary table below
chart.

Select Data summary table below chart.

Hide data summary table below
chart.

Clear Data summary table below chart. (default)

Save configuration as new
template.

Under Template, selectDelete widget.

Save current settings as template.
Select Close Widget from the menu on the top-right of
the widget.
The widget and any customizations you have made to thewidget's settings are deleted.

This widget includes the following customizable templates:
Note
Only one template can be displayed at a time.

25-10

Endpoint Application Control Dashboard Widgets“Advanced”“Template”“Data source”

Scope

Agent Connections

Users and Endpoints

All (not user
configurable)

Connected

Agent Versions

Users and Endpoints

Top 3

Agent Version

Endpoint Windows
Versions

Users and Endpoints

Top 3

Windows
Version

Policies

Users and Endpoints

Top 3

PolicyPolicy Updates

Users and Endpoints

All (not user
configurable)

Policy Updates

Rules

Users and Endpoints

Top 3

Rules

Data Column(Default)

25-11

Trend Micro Apex Central™ Widget and Policy Management Guide

Endpoint Application Control Application, Rule,and Policy Events Widget
Use this widget to display a distribution summary of Endpoint Application
Control application events based on selected criteria.

Figure 25-5. Application, Rule, and Policy Events Widget Example

Go to Dashboard and then select Widget Settings from the menu on the topright of the widget to do the following tasks:
Table 25-5. Application, Rule, and Policy Events Widget Configuration Tasks
Steps

Task
Name widget.

Under Title, type a name.
Tip
Leave this field blank to allow Apex Central toname the widget based on your configuration.

Select template.

Under Template, select a template.
See About Templates.

25-12

Endpoint Application Control Dashboard Widgets

Task
Edit data scope.

Steps
Under Log type, select a scope for data displayed by thewidget.

Figure 25-6. Data Scope
Edit period.
Edit data source.

Under Period, select a period for widget data.
1. Select Advanced.
The widget displays additional settings.
2. Under Log type, select a data source for data
displayed by the widget.

Figure 25-7. Data Source
Limit displayed results.

Select Advanced.
Under Limit results to the following, use dynamic
search.

25-13

Trend Micro Apex Central™ Widget and Policy Management Guide

Task
Change chart type.

Steps
Under Display, select one of the following types of chart:• Selectfor a line chart with data points. (default)• Selectfor a vertical histogram.
• Selectfor a horizontal histogram.
• Selectfor a pie chart.
• Selectfor a data table.
Note
This control is not available if(display data table under chart) is selected.

25-14

Endpoint Application Control Dashboard Widgets

Task
Change chart size.

Steps
To the right of the chart types, select one of the following
a chart sizes:• Select Small for a chart that is about 1 unit tall.
• Select Medium for a chart that is about 2 units tall.
(default)• Select Large for a chart that is about 4 units tall.

Figure 25-8. Chart Size
Note
This control is not available if(display data as table) is selected.
Change legend location.

Under Legend, select one of the following locations:• None• Bottom (default)• Right• Top• Left
Note
This control is not available if(display data as pie chart) or(display data as table) is selected.

Display chart controls on widget.

Select the Toolbar check box.

25-15

Trend Micro Apex Central™ Widget and Policy Management Guide

Task

Steps

Hide chart controls on widget.

Clear the Toolbar check box. (default)

Display data summary table below
chart.

Select Data summary table below chart.

Hide data summary table below
chart.

Clear Data summary table below chart. (default)

Save configuration as new
template.

Under Template, selectSave current settings as template.

This widget includes the following customizable templates:
Note
Only one template can be displayed at a time.

“Template”“Log type”

Applications
without Rules

Application Event
ImportantThis data
matchesthe log
type“Policyactions”.

25-16

Scope
(Default)“Period”(Default)

Top 3

Last 14days“Advance “Advance
d”
d”
Data
Column(Default)

Dynamic
Search(Default)

Name

Rule isEmpty

Endpoint Application Control Dashboard Widgets“Template”“Log type”

Applied Policies

Application Event

Scope(Default)“Period”(Default)

Top 3

Top 3

“Advance “Advance
d”
d”
Data
Column(Default)

Dynamic
Search(Default)

Last 14
days

PolicyPolicy is
Not Empty

Last 14
days

Name

ActionTaken is
BlockedImportantThis data
matchesthe log
type“Policyactions”.
BlockedApplications

Application Event
ImportantThis data
matchesthe log
type“Policyactions”.

25-17

Trend Micro Apex Central™ Widget and Policy Management Guide“Template”“Log type”

Used Applications

Application Event

Scope(Default)“Period”(Default)

Top 3

Top 3

“Advance “Advance
d”
d”
Data
Column(Default)

Dynamic
Search(Default)

Last 14
days

Name

ActionTaken isAllowedLast 14
days

PolicyPolicy is
Not Empty

ImportantThis data
matchesthe log
type“Policyactions”.
Violated Policies

Application Event
ImportantThis data
matchesthe log
type“Policyactions”.

25-18

AND
ActionTaken is
BlockedEndpoint Application Control Dashboard Widgets“Template”“Log type”

Violated Rules

Application Event

Scope(Default)“Period”(Default)

Top 3

Last 14days“Advance “Advance
d”
d”
Data
Column(Default)

Dynamic
Search(Default)

Name

Rule is Not
Empty
AND

Important

ActionTaken is
BlockedThis data
matchesthe log
type“Policyactions”.
ViolatingEndpoints

Application Event
Important

Top 3

Last 14days

Endpoint
Name

ActionTaken is
BlockedThis data
matchesthe log
type“Policyactions”.

25-19

Trend Micro Apex Central™ Widget and Policy Management Guide“Template”“Log type”

Violating Users

Application Event
ImportantThis data
matchesthe log
type“Policyactions”.

25-20

Scope
(Default)“Period”(Default)

Top 3

Last 14days“Advance “Advance
d”
d”
Data
Column(Default)

Dynamic
Search(Default)

User Name

ActionTaken is
BlockedChapter 26

Endpoint Application Control Policy
Settings
Use the following Endpoint Application Control policy settings to manage
your Endpoint Application Control agents from Apex Central.

26-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Policy Rules
Expand Rules to do the following tasks:
Task
View list of rules assigned to thispolicy.

Steps
Rules assigned to the policy appear in the table below
the Assign Rule button.
Tip
Operating system applications considered safe
by Certified Safe Software are allowed unlessspecifically blocked by a rule.

Assign rule to this policy.

Click Assign Rule, and then do one of the following:• To select existing rules to assign to the policy, selectExisting. The Assign Existing Rules to Policy
screen appears. Select the rule or rules to assign andthen click Assign Rules.

Remove selected rules from thispolicy.

Select the rule or rules in the list, click Remove Selected,
and then click Remove Selected again.

The following table outlines additional configuration options.
Policy Setting

26-2

Details

Always allow all applications in
the Windows directory(overrides block and lockdown
rules)

By default, Endpoint Application Control allows all
applications located in the Windows directory. Thisfunctions like an Allow rule for the Windows default
path, overriding any Block or Lockdown rules.

Automatically apply Lockdown
rules to endpoints while they are
disconnected

Disconnected endpoints are unable to receive or apply
new policies. By default, that means a disconnected
endpoint continues applying its current policy.

Enable protection against
suspicious objects (requires
subscription to Apex Central)

Endpoint Application Control protects matchedendpoints against suspicious objects.

Endpoint Application Control Policy Settings

Policy Setting

Details

Use the more compatible, lessfeature-rich, user-level blocking
methodKernel-level blocking prevents applications from startingby blocking file access. This provides greater security, but
may unexpectedly block or momentarily delay access tocertain files needed by allowed applications. This feature
is only supported on policies set to first match “User andGroup” criteria (excluding the “SYSTEM” account).
User-level blocking allows applications to start and thenstops them at the task level. This may be unable to stop
certain applications after they start and does not support
the Trusted Source feature and blocking of link libraries(DLLs) and Java interpreter applications.

Policy Logging
Expand Logging to configure the following policy settings for matched users
and endpoints:

26-3

Trend Micro Apex Central™ Widget and Policy Management Guide

Policy Setting
Log the following actions

Details
Select one of the following logging limitations:• Select None to log no actions.
• Select Block to log any blocked application start oraccess that does not originate from an excluded
directory.
This is the default setting for a new policy.
• Select Selected to log any selected application startor access that does not originate from an excluded
directory. Use the list that appears to select the rules
to match.
• Select Any to log any application start or access that
does not originate from an excluded directory.
Note
Selecting this option may generate large log
files and substantially increase network
data transfers.

Exclude the following directories
from logs

Select Exclude the following directories from logs andthen type the application paths to exclude. Separate eachpath with a carriage return.
The default paths are %SYSTEMROOT% and %WINDIR%.

Collect aggregated logs every

Select the interval for collecting the logs aggregated byendpoints.
The default setting is 2 hours. The suggested setting
depends on the number of deployed agents.

Policy Deployment
Expand Deployment to configure the following policy settings for matchedusers and endpoints:

26-4

Endpoint Application Control Policy Settings

Policy Setting
Send policy updates every

Details
Select the policy update time interval.
The default setting is 15 minutes. The suggested interval
depends on the number of deployed agents.
By default, to reduce network data transfers and local
storage needs, deployed policies only include matched
applications already detected in an endpoint's inventory.
At each policy deployment interval, Endpoint Application
Control includes any newly added applications on theendpoint that match rules in the deployed policy.

Deploy the full policy in thefollowing conditions
Note
Selecting these options
may substantially increase
network data transfers.

You can optionally deploy the “full policy”, which
includes all matched applications and disregards
endpoint inventory matching.
• Select Endpoint connects for fewer than andspecify a number of hours per week if matchedendpoints do not regularly connect to the server.
• Select Endpoint starts applying lockdown rules ifmatched endpoints should be allowed to install andrun any applications specified in Allow rules after
applying lockdown rules.

Policy Server Connection
Expand Server connection to configure the following policy settings formatched users and endpoints:

26-5

Trend Micro Apex Central™ Widget and Policy Management Guide

Policy Setting

Details

Connect to the following serverYour network may include more than one Endpoint
Application Control server or a server may have moved toa new IP address.
Specify the server that the endpoint should connect toafter this policy is applied.
• Select Default to use the same server as the one
hosting the web console. This is the default setting
for a new policy.
• Select Specified and then type the server address
and port to specify a server.

Use HTTPS

By default, Endpoint Application Control uses the HTTP
or HTTPS configuration selected during server
installation.
Select Use HTTPS to permanently set all matched users
or endpoints to use HTTPS.
Tip
Using this option requires you to import theserver CA to agent endpoints.
For detailed steps, go to https://success.trendmicro.com/solution/1115573

Policy User Experience
Expand User experience to configure the following policy settings formatched users and endpoints:

26-6

Endpoint Application Control Policy Settings

Policy Setting
Display the system tray icon

Details
The Endpoint Application Control system tray icon ( )can display notifications, allow the user to request accessto applications, and allow the user to manually update
Endpoint Application Control settings and logs.
• Select Yes to display the icon in matched users'
Windows system trays.
• Select No to hide the icon.

Display notification popups

Displaying notifications to some users may beinappropriate. For example, users of special-purpose
endpoints such as ATMs, medical devices, kiosks, and gas
pumps may be confused by notifications and related
requests for interaction.
• Select Yes to display Endpoint Application Control
notifications to matched users.
• Select No to prevent the display of notifications anddisable related user-interactions.
Important
After Endpoint Application Control blocks ordelays an application start using the kernel-level
method, Windows may display the following
notification to end-users:

Figure 26-1. Windows Block Notification
Endpoint Application Control is unable to hide
this notification. You can avoid this notification
by applying user-level blocking instead.

26-7

Trend Micro Apex Central™ Widget and Policy Management Guide

Policy Setting
Generate a new inventory

Details
Endpoints generate inventories to track new and deleted
applications. Endpoint Application Control periodicallycollects application inventories from endpoints.
Select a time interval, such as daily or a weekly.

Start time

26-8

Select a start time for the inventory scan.

Part XI
Endpoint Encryption Widgets andPolicies

Chapter 27

Endpoint Encryption Dashboard Widgets
This section contains help topics for Endpoint Encryption widgets supported
on the Apex Central dashboard.
Topics include:• Endpoint Encryption Users on page 27-2
• Endpoint Encryption Devices on page 27-9
• Full Disk Encryption Status on page 27-14• Endpoint Encryption Unsuccessful Device Logon on page 27-16• Endpoint Encryption Unsuccessful User Logon on page 27-19• Endpoint Encryption Device Lockout on page 27-21• Endpoint Encryption Security Violations Report on page 27-23

27-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Endpoint Encryption Users
The Endpoint Encryption Users widget provides user management
capability directly from the Apex Central dashboard. Use the Endpoint
Encryption Users widget to add or remove Apex Central user accounts, reset
passwords, change permissions, configure policy group priority, import from
Active Directory, and search for specific user accounts.

Item

Description

Show

Select which users to display: all users in the Enterprise, or users in a
specific policy.

Search (Settings ())

Right-click a user
Add users (

27-2

)

Click theicon to filter which Apex Central users appear in thetable. Use the search field to specify parameters to search against.
Click the icon to view user attributes or to perform actions on any
selected user.
Click theicon to add individual users, import users from a CSV file,or import users from Active Directory LDAP.

Endpoint Encryption Dashboard Widgets

Item
Number of users

Description
View the total number of users in the entire Enterprise, selected policy,
or specified search.

User Settings Options
The following table explains the options available under the settings icon.
Table 27-1. User Settings Options
OptionDescription

Change password

Specify a new password for users using theFixed password authentication type. The
widget does not support changing passwords
for the Domain authentication type.

Delete user

Removes the selected user.

Modify user

Update the properties of the selected user.
The following properties can be modified:• User name• First name
• Last name• Employee ID• Email address• Freeze• User type
• One policy• Authentication method

27-3

Trend Micro Apex Central™ Widget and Policy Management Guide

Option
List policies

Description
Displays the policies where the selected user
is a member.
If the Allow Install column for the selecteduser is Yes, then the option to allow ordisallow the installation of selected policies,
as well as selecting which policies should begiven first priority is enabled.

Add New User Options
The following table explains the options available when adding a new Apex
Central user.
Table 27-2. Add New User Options
OptionDescription

User nameSpecify the account user name that the user uses to authenticate.

First nameSpecify the user's first name.

Last nameSpecify the user's last name.

Employee ID

Specify the user's employee ID (optional).

Email address

Specify user's email address (optional).

FreezeSelect Yes to temporarily lock the account. A locked account cannot
log on to Apex Central devices.

User type

Select User, Authenticator, or Administrator.

One group

Select Yes to only allow the user to belong to one policy at a time.
The user may not be added to any other policy groups.
If you set this option to Yes and set the User type to Authenticator
or Administrator, the user will be a group authenticator or group
administrator respectively.

Authentication method

27-4

Select the authentication method available to the user.

Endpoint Encryption Dashboard Widgets

Policy Membership
The following table explains how to understand Apex Central user policy
membership.
Note
Encryption Management for Apple FileVault and Encryption Management for
Microsoft BitLocker do not require authentication and are not affected byauthentication policies. Client, login, password, and authentication policies,or allowing the user to uninstall the Security Agent software only affects theFull Disk Encryption and File Encryption agents.
ExampleHeaderDescription

Priority

1, 2. 3Shows the order that Apex Central applies
policies. When a policy is triggered that
affects a user, Apex Central performs theaction, and then no other policies affect theuser for that event.

Policy Name

GP1

Shows the name of all policies that the user iscurrently assigned.

Description

Temporaryemployees policy.

Shows the description of the policy.

Allow InstallYes, NoShows whether the user can install new
devices.

Importing Users from a CSV File
Note
Importing users from a CSV file is supported only for users using fixed
password authentication.

Format each line in the CSV file as follows:27-5

Trend Micro Apex Central™ Widget and Policy Management Guide<User ID (required)>, <first name>, <last name>, <employee ID>,<email address>

For fields with no data, use a comma as a placeholder. The following is an
example CSV entry:
example_id, name,,, name@example.com

Procedure
1.

From the Endpoint Encryption Users widget, click Add User and thenselect Import Users from a File.
The Import Users from a File screen appears.

2.

Click Choose File to select the CSV file.
The Open CSV File window appears.

3.

Select the file and then click Open.

4.

Click Add.
The users in the CSV file are imported.

Importing Active Directory Users
PolicyServer maintains a user directory separate from the Active Directory
database. This allows PolicyServer absolute security over access to all Apex
Central devices, user rights, and authentication methods.
Use the Endpoint Encryption Users widget in Apex Central to import Active
Directory users.
Procedure

27-6

1.

Log on to Apex Central.

2.

Go to the Endpoint Encryption Users widget.

3.

Click theicon.

Endpoint Encryption Dashboard Widgets

4.

Select Import Users from Active Directory.
The Import Users from Active Directory screen appears.

5.

Specify your credentials for the Active Directory LDAP server.
Note
For Port, the value “0” specifies the default port. The default port is 389.

6.

Click Next.

7.

Wait for the specified Active Directory domain to populate.

27-7

Trend Micro Apex Central™ Widget and Policy Management Guide

The Active Directory tree for the specified domain appears in the left
pane.

8.

From the left pane, use the navigation tree to select the container fromwhich to add users.
The available users populate in the right pane.

9.

Do one of the following:• Select individual users, then click Import Selected Users.
• Click Import Everyone in this Container.

10. Click OK to add the users to the specified location.
A confirmation window appears.
11. Click OK to confirm.
An import status message displays.
12. Click Close to finish, or repeat the procedure to select more users toimport.

27-8

Endpoint Encryption Dashboard Widgets

Endpoint Encryption Devices
Endpoint Encryption devices are Endpoint Encryption agents that haveregistered with PolicyServer. Installing any Endpoint Encryption agent
automatically registers the endpoint with PolicyServer as a new Endpoint
Encryption device. Since multiple Endpoint Encryption agents may protect agiven endpoint, a single endpoint may appear as more than one Endpoint
Encryption device on PolicyServer.
The Endpoint Encryption Devices widget provides Endpoint Encryption
device management capability directly from the Apex Central dashboard.
Use the Endpoint Encryption Devices widget to monitor activity, search for
Endpoint Encryption devices, or secure endpoint data by initiating lock or
kill commands when an endpoint is lost or stolen.

Options
Show

Description
Select which devices to display: all devices in the Enterprise, or
devices in a specific policy.

27-9Trend Micro Apex Central™ Widget and Policy Management Guide

Options
Search (Settings ())

Right-click a device
Number of devices

Description
Click theicon to select the Security Agent and filter the devices
shown in the table. Use the search field to specify parameters tosearch against. Any attributes listed in devices attributes can besearched.
Select a device and click the icon or right-click a device to view
device attributes or to perform actions on the selected device.
View the total number of devices in the entire Enterprise, selected
policy, or specified search.

Device Actions
Select a device and click thefollowing actions:

icon or right-click a device to perform theActionDelete device

Description
Deleting any Apex Central device from the Enterprise also removes thedevice from all policy groups. The deleted Apex Central device
continues functioning as long as connectivity and password policies
are current on the device. The agent will be unable to synchronize its
policy with PolicyServer.
WARNING!
Before deleting a Full Disk Encryption device, decrypt yourdisk, and uninstall the Full Disk Encryption agent. If you
delete a Full Disk Encryption device without deleting theagent, the Full Disk Encryption preboot may be unable toauthenticate with PolicyServer and the data may become
inaccessible.

27-10

Endpoint Encryption Dashboard Widgets

ActionSoft token

Description
Generating a “software token” creates a unique string that you can use
to unlock Apex Central devices and to remotely help Apex Central
users reset forgotten passwords.
The software token is only available in the full version of Full Disk
Encryption, not Encryption Management for Apple FileVault or
Encryption Management for Microsoft BitLocker.

Recovery key

Generating a “recovery key” allows the user to decrypt a hard disk
when the user has forgotten the original password or key.
The recovery key is only available to Encryption Management forApple FileVault and Encryption Management for Microsoft BitLocker
agents because they do not use the other recovery methods available
in Full Disk Encryption.

Device attributes

View a current snapshot of the selected device.

Kill device

Initiating a “kill” command deletes all Apex Central device data. The
deleted data is different depending on the scope of data that theassociated Security Agent manages. For example, initiating a “kill”
command to a Full Disk Encryption device deletes all data from theendpoint, while initiating a “kill” command to a File Encryption device
deletes all files and folders in local or removable storage protected by
the File Encryption agent. The “kill” command is issued when the
Security Agent communicates with PolicyServer.
WARNING!
Killing a device cannot be undone. Back up all the data before
initiating a kill command.

Lock device

Initiating a “lock” command to the Apex Central device prevents Apex
Central user access until after performing a successful Remote Help
authentication. Locking a device reboots the endpoint and forces it
into a state that requires Remote Help. The lock command is issued
when the Security Agent communicates with PolicyServer.

Soft reset

Initiating a “soft reset” command reboots the endpoint. The commandissues the next time that the agent communicates with PolicyServer.

27-11

Trend Micro Apex Central™ Widget and Policy Management Guide

Device Attributes
The following table describes the Apex Central device attributes.
Attribute Name

ExampleDescription

AD NetBIOS NameEnterprise

The name assigned to the AD NetBIOS.

AD Object GUID

6629bdeb-99a8-456b-b7c5-dbbc50ad13d0

The GUID assigned to the AD object.

Battery Count2

The number of batteries installed.

.NET Version

2.0.50727.3620

The version and build number for the
installed .NET framework.

Common Framework
Build Number

5.0.0.84

The Security Agent uses a common
framework for encryption. The build number
is used to tell whether the agent is up-to-date.

Disk Model

VMware Virtual IDE

The hard disk model.

Disk Name\\.\PHYSICALDRIVE0

The name of the hard disk.

Disk Serial Number

The serial number of the hard disk.

Disk Partitions

1

The number of partitions on the disk with theagent installed.

Disk Size

10733990400

The total capacity of the hard disk (in bytes).

Domain Name

WORKGROUP

The domain that the endpoint is a member.

Endpoint ID

85b1e3e2a3c25d8825
40ef6e4818c3e4

The unique ID of the endpoint used for Apex
Central integration.

File Encryption
Version

6.0.0.1039

The version of File Encryption installed on theendpoint.

Hostname

TREND-4136D2DB3

The endpoint's host name.

IP Address

10.1.152.219

The endpoint's IP address.

27-12

Endpoint Encryption Dashboard Widgets

Attribute Name

ExampleDescription

Language

English (UnitedStates)The language used by the endpoint.

Localeen-US

The regional settings used by the endpoint.

MAC Address

00-50-56-01-xx-xx

The endpoint's MAC address.

Machine Name

TREND-4136D2DB3

The computer name that the endpoint used.

Manufacturer

VMware, Inc.

The manufacturer of the hard disk.

Model

VMware Virtual
Platform

The model of the hard disk.

Operating System

Microsoft Windows
NT 5.1.2600 Service
Pack 3The operating system installed on the same
hard disk as the agent.

Operating System
Name

Microsoft Windows
XP Professional

The common name of the operating systeminstalled on the same hard disk as the agent.

Operating System
Service Pack

Service Pack 3

The service pack number of the operating
system installed on the same hard disk as theagent.

Operating System
Version

5.1.2600.196608

The version number of the operating systeminstalled on the same hard disk as the agent.

Partition Scheme

Classical MBR

The partition scheme for the hard disk.

Processor

x86 Family 6 Model 30
Stepping 5, GenuineIntel

The processor make and model of theendpoint.

Processor Count2

The number of processors in the endpoint.

Processor Revision

1e05

The processor revision number.

Time Zone

Taipei Standard TimeThe time zone that the endpoint resides.

Total Physical
Memory2047MBThe total RAM installed in or allocated to theendpoint.

Type

X86-based PC

The endpoint processor type.

27-13

Trend Micro Apex Central™ Widget and Policy Management Guide

Attribute Name

ExampleDescription

Windows User Name

TREND-4136D2DB3\admin

The user name of the Windows account thatlast logged on the endpoint.

<Agent> User

john_smith

The user name for the last logged on used.

<Agent> Version

5.0.0.260

The version and build number for the agent
installation.

Full Disk Encryption Status
The Full Disk Encryption Status widget shows the current encryption statusof any device on your network.

27-14

Endpoint Encryption Dashboard Widgets

ColumnStatusDescription
The status of the endpoint. Statuses include:• Encrypted: The endpoint is 100% encrypted.
• Encrypting: The endpoint is currently encrypting the hard disk.
The status changes to “Fully Encrypted” once encryption
completes and the endpoint restarts.
• Not encrypted: The endpoint is 0% encrypted.
• Decrypting: The endpoint is currently decrypting the hard disk.
The status changes to Not Encrypted once the decryption
completes and the endpoint restarts.
• Unknown: The endpoint is synchronized, but PolicyServer
cannot determine the encryption status.

Rate

The percentage that the endpoint is encrypted.

Devices

The number of endpoints with that current status. Click the number
to view the Endpoint Encryption Devices report.

Note
At the bottom of the widget, click the number next to Total to view the Full
Disk Encryption Status report.

Full Disk Encryption Status Report
The following table describes the Full Disk Encryption Status report. Use it
to understand how to read the report details.
Table 27-3. Full Disk Encryption Status Report Example
ExampleHeaderDescription

PolicyGP1

The title of the policy
controlling the endpoint.

Device Name

TREND-4136D2DB3

The computer name used by
the endpoint.

27-15

Trend Micro Apex Central™ Widget and Policy Management Guide

HeaderExampleDescription

Device ID

1fabfbff-0001-06e5-000c-2970
85710000

The unique ID establishedafter the Security Agent was
installed on the endpoint anda new endpoint was
registered with PolicyServer.

Agent

Full Disk Encryption

The currently installed
Security Agent.

StatusNot Encrypted

The current state of theendpoint.

Last Synchronized Date

10/07/2013 11:05 am

The timestamp when theendpoint last updated
policies from PolicyServer.

Last Policy Enforcement

10/07/2013 11:05 am

The timestamp when theApex Central last enforced
policy changes on
PolicyServer.

Endpoint Encryption Unsuccessful Device Logon
The Endpoint Encryption Unsuccessful Device Logon widget shows all
devices (managed endpoints) that had unsuccessful logon attempts by any

27-16

Endpoint Encryption Dashboard Widgets

user. Unsuccessful device logon events may represent a security breach or
the user may have forgotten their logon credentials.

ColumnDescription

Device Name

The computer name of the endpoint.

PolicyThe policy managing the endpoint.

EventsThe number of unsuccessful logon attempts.
Click the number to view the Endpoint Encryption
Unsuccessful Device Logon report.

Unsuccessful Device Logon Report
The following table explains the Endpoint Encryption Unsuccessful Device
Logon report. Use it to understand how to read the report details.
Table 27-4. Endpoint Encryption Unsuccessful Device Logon Example
HeaderEvent Timestamp

Example07/02/2012 01:56 pm

Description
When the event occurred.

27-17

Trend Micro Apex Central™ Widget and Policy Management Guide

HeaderExampleDescription

PolicyGP1

The title of the policy controlling theendpoint.

Device Name

TREND-4136D2DB3

The computer name used by theendpoint.

Device ID

1fabfbff-0001-06e5-00
0c-297085710000

The unique ID established after the
Security Agent was installed on theendpoint and a new endpoint was
registered with PolicyServer.

IP Address

10.1.152.219

The endpoint IP address.

Agent

Full Disk Encryption

The currently installed Security Agent.

User Nameuser325

The user name used to attempt to log onto the endpoint.

Display Name

Mary Jones

The first and last name of the Apex Central
user account. If the specified user name is
not a valid Apex Central user name, thecolumn shows “Not Recorded”.

Event

Unsuccessful Fixed
Password Login

The logged event including theauthentication method.

27-18

Endpoint Encryption Dashboard Widgets

Endpoint Encryption Unsuccessful User Logon
The Endpoint Encryption Unsuccessful User Logon widget shows all
unsuccessful logon attempts by any user to any managed endpoint on theApex Central network.

ColumnDescription

User Name

The user name used to attempt to log on to the endpoint.

Display Name

The display name of the user account that attempted to log onto the endpoint.

EventsThe number of authentication attempts.
Click the number to view the Endpoint Encryption
Unsuccessful User Logon report.

Unsuccessful User Logon Report
The following table explains the Endpoint Encryption Unsuccessful User
Logon report. Use it to understand how to read the report details.

27-19

Trend Micro Apex Central™ Widget and Policy Management Guide

Table 27-5. Endpoint Encryption Unsuccessful User Logon Report Example
HeaderExampleDescription

Event Timestamp

07/02/2012 01:56 pm

When the event occurred.

PolicyGP1

The title of the policy controlling theendpoint.

Device Name

TREND-4136D2DB3

The computer name used by theendpoint.

Device ID

1fabfbff-0001-06e5-00
0c-297085710000

The unique ID established after the
Security Agent was installed on theendpoint and a new endpoint was
registered with PolicyServer.

IP Address

10.1.152.219

The endpoint IP address.

Agent

Full Disk Encryption

The currently installed Security Agent.

User Nameuser325

The user name used to attempt to log onto the endpoint.

Display Name

Mary Jones

The first and last name of the Apex Central
user account. If the specified user name is
not a valid Apex Central user name, thecolumn shows “Not Recorded”.

Event

Unsuccessful Fixed
Password Login

The logged event including theauthentication method.

27-20

Endpoint Encryption Dashboard Widgets

Endpoint Encryption Device Lockout
The Endpoint Encryption Device Lockout widget shows Apex Central
devices that are locked out due to policy restrictions.

HeaderDescription

Device Name

The computer name used by the endpoint.

PolicyThe title of the policy controlling the endpoint.

Lockout TimeThe timestamp when PolicyServer issued the device lockcommand. The endpoint does not actually lock out until after
the Endpoint Encryption agent synchronizes policies with
PolicyServer.

Details

Click the details icon to view the Endpoint Encryption Device
Lockout report.

At the bottom of the widget, click the number next to Total to view thereport.

Device Lockout Report
The following table explains the Endpoint Encryption Device Lockout
report. Use it to understand how to read the report details.
27-21

Trend Micro Apex Central™ Widget and Policy Management Guide

Table 27-6. Endpoint Encryption Device Lockout Report Example
HeaderExampleDescription

Event Timestamp

07/02/2012 01:56 pm

When the event occurred.

PolicyGP1

The title of the policy
controlling the Endpoint
Encryption device.

Device Name

TREND-4136D2DB3

The computer name used by
the Endpoint Encryption
device.

Device ID

1fabfbff-0001-06e5-000c-2970
85710000

The unique ID establishedafter the Endpoint Encryption
agent was installed on theendpoint and a new Endpoint
Encryption device wasregistered with PolicyServer.

IP Address

10.1.152.219

The Endpoint Encryption
device IP address.

Agent

Full Disk Encryption

The currently installed
Endpoint Encryption agent.

User Nameuser325

The user name used toattempt to log on to the
Endpoint Encryption device.

Display Name

Mary Jones

The first and last name of the
Endpoint Encryption user
account. If the specified username is not a valid Endpoint
Encryption user name, thecolumn shows “Not
Recorded”.

Event

Locked device due to invalid
login attempt violation.

The logged event including
the authentication method.

27-22

Endpoint Encryption Dashboard Widgets

Endpoint Encryption Security Violations Report
The Endpoint Encryption Security Violations Report widget shows the
security violations assessed by the following reports:• Endpoint Encryption Consecutive Unsuccessful Device Logon• Endpoint Encryption Policy Tampering• Endpoint Encryption Log Integrity
Generating a report gathers all security violations currently logged by
PolicyServer. Once generated, click the number on the Reports column toview generated reports for that violation.

HeaderDescription

Violation report typeThe available report types for various violations.

ActionClick Generate to create a new report.

Reports

The total number of generated reports for that violation. Clickthe number to view available reports.

27-23

Trend Micro Apex Central™ Widget and Policy Management Guide

Note
To specify the number of unsuccessful logons attempts before it is considereda security violation, click ▼ to open the Widget Settings window, type a value
in the Consecutive unsuccessful logons textbox, and then click Save.

Consecutive Unsuccessful Device Logon Report
The following table explains the Endpoint Encryption Consecutive
Unsuccessful Device Logon report. Use it to understand when the logon
attempt occurred, the affected Endpoint Encryption device, and how manytimes the user attempted to log on to the Endpoint Encryption device.
Table 27-7. Endpoint Encryption Consecutive Unsuccessful Device Logon Report Example
Entry

ExampleEvent Timestamp

07/02/2012 01:56 pm

When the event occurred.

Device Name

TREND-4136D2DB3

The computer name used by
the Endpoint Encryption
device.

Attempts

5

The number of times that auser attempted to log on to
the Endpoint Encryption
device.

Description

Policy Tampering Report
The following table explains the Endpoint Encryption Policy Tampering
report. Use it to understand how to read the report details.
Table 27-8. Endpoint Encryption Policy Tampering Report Example
HeaderExampleDescription

Event Timestamp

07/02/2012 01:56 pm

When the event occurred.

Event

Policy Value Integrity Check
FailedThe logged event including
the authentication method.

27-24

Endpoint Encryption Dashboard Widgets

Log Integrity Report
The following table explains the Endpoint Encryption Log Integrity report.
Use it to understand how to read the report details.
Table 27-9. Endpoint Encryption Log Integrity Report Example
HeaderExampleDescription

Event Timestamp

07/02/2012 01:56 pm

When the event occurred.

Event

Audit Log Record Missing

The logged event including
the authentication method.

27-25

Chapter 28

Endpoint Encryption Policy Settings
This section discusses how to configure Endpoint Encryption policies on theApex Central console.
Topics include:28-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Authentication Overview
The primary form of protection that Endpoint Encryption delivers isprevention of unauthorized user access to encrypted endpoints and devices.
Correctly configuring Endpoint Encryption devices, users, and policy groups
prevents data loss risk from accidental information release or deliberate
sabotage.
Devices on page28-2

Endpoint Encryption counts the amount of consecutive logon
attempts on a given device and the amount of time since the lastcommunication with PolicyServer for a given length of time. If a device
violates the policy criteria, Endpoint Encryption can reset, lock, or
erase the disk.

Users on page 28-3

In addition to checking authentication attempts on a device, Endpoint
Encryption also counts the amount of consecutive logon attempts by aparticular user account. If that user violates the policy criteria,
Endpoint Encryption can reset, lock, or erase the disk.

Groups on page
28-4

Groups act as a container for users for policy management.
Administrators and authenticators within a group have those special
privileges only within that group, but unassigned administrators andauthenticators have that role throughout the Enterprise.

Devices
Endpoint Encryption devices are Endpoint Encryption agents that haveregistered with PolicyServer. Installing any Endpoint Encryption agent
automatically registers the endpoint with PolicyServer as a new Endpoint
Encryption device. Since multiple Endpoint Encryption agents may protect agiven endpoint, a single endpoint may appear as more than one Endpoint
Encryption device on PolicyServer.
Depending on the policy settings, Endpoint Encryption takes one of thefollowing actions when users attempt to consecutively log on that device
unsuccessfully:• Delay the next authentication attempt• Lock the device• Erase all data on the device
28-2

Endpoint Encryption Policy Settings

Note
To configure Endpoint Encryption devices, use the Endpoint Encryption
Devices widget. See Endpoint Encryption Devices on page 27-9.

Users
Endpoint Encryption users are any user account manually added to
PolicyServer or synchronized with Active Directory.
Endpoint Encryption has several types of account roles and authentication
methods for comprehensive identity-based authentication and management.
Using Endpoint Encryption or PolicyServer MMC, you can add or import user
accounts, control authentication, synchronize with the Active Directory, andmanage policy group membership, as needed.
The following table describes the Endpoint Encryption user roles:
Role
Administrator

Description
Administrators may access the management consoles and perform
any configurations within their domain. This role has different rights
depending on the level that the administrator role is added:• Enterprise administrator: These administrators have control overall policies, groups, users, and devices in the enterprise.
• Group administrator: These administrators have control overusers and devices that authenticate within a specific group.
Endpoint Encryption makes a group for each policy, so theseadministrators may also be known as “policy administrators”.

Authenticator

Authenticators provide remote assistance when users forget their
Endpoint Encryption passwords or have technical problems. This rolehas different rights depending on the level that the authenticator roleis added:• Enterprise authenticator: These authenticators can assist any
users in the enterprise.
• Group authenticator: These authenticators can assist any users
within a specific group. Endpoint Encryption makes a group foreach policy, so these authenticators may also be known as“policy authenticators”.

28-3

Trend Micro Apex Central™ Widget and Policy Management Guide

Role
User

Description
Basic end users have no special privileges. The user role may not log
on the Endpoint Encryption management consoles. Unless allowed by
PolicyServer, the user role also may not use recovery tools.

Note
To configure Endpoint Encryption users, use the Endpoint Encryption Users
widget. See Endpoint Encryption Users on page 27-2.

GroupsApex Central manages policies by user groups. Groups management differs
between PolicyServer MMC and Apex Central. After modifying policies andgroups, PolicyServer synchronizes groups across both consoles.
ImportantApex Central always takes precedence over PolicyServer MMC for policy andgroup assignment. Any modifications to the group assignment in PolicyServer
MMC are automatically overwritten the next time that Apex Central
synchronizes with PolicyServer.
ConsoleApex Central

28-4Group Management
Apex Central automatically creates a group each time a policy with specifictargets is deployed. After deployment, modify the groups a user is in fromthe Endpoint Encryption Users widget, and modify the users in the policy
from the Policy Management screen.

Endpoint Encryption Policy Settings

ConsolePolicyServer
MMC

Group Management
Add and modify groups directly from the left pane of PolicyServer MMC.
Groups in PolicyServer MMC can be assigned as follows:• Top Group: Top Groups are the highest level of groups under theEnterprise. Each Top Group has a unique node underneath theEnterprise.
• Subgroup: Subgroups are created within Top Groups. Subgroups
inherit the policies of the Top Group on creation, but do not inheritchanges made to the Top Group. Subgroups may not be more
permissive than the Top Group.
Note
You must manually assign devices and users to eachsubgroup. Adding Apex Central users to a subgroup does not
automatically add the users to the Top Group. However, you
can add users to both the Top Group and subgroup.

Note
To configure the users within a policy group on Apex Central, use theEndpoint Encryption Users widget.
To configure users within a policy group on PolicyServer MMC, see theEndpoint Encryption PolicyServer MMC Guide.

Configuring Endpoint Encryption Users Rules
The following procedure explains the configurable options for policy rulesthat affect authentication and Endpoint Encryption user accounts.

Procedure
1.

Create a new Endpoint Encryption policy.

2.

Click Users.

28-5

Trend Micro Apex Central™ Widget and Policy Management Guide

The Users policy rules settings appear.

Figure 28-1. Endpoint Encryption Users Policy Rules

3.

If users require domain authentication, select Enable domain
authentication under Domain User Settings.
If you selected Enable domain authentication, specify the server
information for your Active Directory (AD) account.
a.

Configure the AD domain name.

b.

Configure the host name of the AD server.

c.

Select the server type:• LDAP• LDAP proxy4.

Under User Management, configure user access.
OptionAll Endpoint
Encryption
users

28-6

Description
Allow all users, domain and local accounts, to authenticate devices.

Endpoint Encryption Policy Settings

OptionActive Directoryusers

Description
Allow users from organizational units (OUs) within an AD toauthenticate devices.
Note
Select Enable domain authentication to enable the Active
Directory users option.

Select specificusers

Specify which already added users can authenticate to managed
endpoints.
Note
In order to select specific users with this option, you must populate
the user list. Add OUs with the Active Directory users option or add
users with the Endpoint Encryption Users widget.

5.

If you selected Active Directory users, add OUs to the policy by their
distinguished name.
After selecting Active Directory users, the following additional options
appear:OptionUser name

Description
Specify your Active Directory user name.

28-7

Trend Micro Apex Central™ Widget and Policy Management Guide

OptionDescription

Password

Specify your Active Directory password.

Distinguished
nameSpecify each OU by its sequence of relative distinguished names(RDN) separated by commas.
Example: OU=TW, DC=mycompany, DC=com
After specifying the OU distinguished name, click OK.
ImportantApex Central supports up to 12 OUs per policy.

Configuring Full Disk Encryption Rules
The following procedure explains the configurable options for policy rules
affecting Full Disk Encryption devices.
Note
Encryption Management for Apple FileVault and Encryption Management for
Microsoft BitLocker do not require authentication and are not affected byauthentication policies. Client, login, password, and authentication policies,or allowing the user to uninstall the Endpoint Encryption agent software only
affects the Full Disk Encryption and File Encryption agents.

Procedure

28-8

1.

Create a new Endpoint Encryption policy.

2.

Click Full Disk Encryption.

Endpoint Encryption Policy Settings

The Full Disk Encryption policy rules settings appear.

Figure 28-2. Full Disk Encryption Policy Rules

3.

Under Encryption, select the following options:• Select Encrypt device to start full disk encryption when the
Endpoint Encryption agent synchronizes policies with PolicyServer.

28-9

Trend Micro Apex Central™ Widget and Policy Management Guide

WARNING!
Do not deploy encryption to Full Disk Encryption agents without
first preparing the endpoint's hard drive.
For information about preparing the hard drive, see Full Disk
Encryption Deployment Outline in the Endpoint Encryption Installation
Guide.

• Select Encrypt only used space to encrypt only the used space.
• Select Select encrypt key size to specify a device encryption key
size in bits.
4.

Under Agent Settings, select the following options:• Select Bypass Full Disk Encryption Preboot to allow the user toauthenticate directly into Windows without protection from preboot
authentication.
• Select Users are allowed to access system recovery utilities on thedevice to allow the user to access the Recovery Console.
• Select Allow user to configure Wi-Fi to allow users to configure WiFi policies on the device during preboot.
• Select Enable Wi-Fi configuration to use a predetermined Wi-Fi
configuration during preboot. Specify the following details:• Network name (SSID)• User name• Password• Security type
• Select Enable logon background color to specify the backgroundcolor during logon.
• Select Enable logon banner to specify a logon banner image.

28-10

Endpoint Encryption Policy Settings

Image should not exceed 128 KB in size and should measure 512 x
64 pixels. Accepted file formats are PNG with transparency(recommended), JPG and GIF
5.

Under Notifications, configure the following options:• Select If found, display the following message on the device toshow a message when the If Found policy is active.
• Select Display Technical Support contact information to show amessage after the user logs on to the Full Disk Encryption agent.
• Select Show a legal notice to show the specific legal message atstart up or only after installing the Full Disk Encryption agent.

Configuring File Encryption Rules
The following procedure explains the configurable options for policy rules
affecting File Encryption devices.
Procedure
1.

Create a new Endpoint Encryption policy.

2.

Click File Encryption.

28-11

Trend Micro Apex Central™ Widget and Policy Management Guide

The File Encryption policy rules settings appear.

Figure 28-3. File Encryption Policy Rules

3.

Under Folder to Encrypt, specify folders that are automatically createdand encrypted on the endpoint when the File Encryption agent
synchronized policies.

4.

Under Encryption Key, select the encryption for the File Encryption
encrypted folder.
• User key: Use a unique key for each Endpoint Encryption user. Only
the Endpoint Encryption user can decrypt files that he or she
encrypted.

28-12Endpoint Encryption Policy Settings• Policy key: Use a unique key for each policy. Only Endpoint
Encryption users and devices in the policy can decrypt files.
• Enterprise key: Any Endpoint Encryption user or device in theEnterprise can decrypt the files.
Note
Selecting Policy key or Enterprise key controls the sharing for the File
Encryption shared key.

5.

Under Storage Devices, configure the following options:• Select Disable optical drives to control whether removable media isaccessible from the endpoint.
• Select Disable USB drives to control when the USB ports are
disabled. Options are:• Always• Logged out• Never• Select Encrypt all files and folders on USB devices to automaticallyencrypt all the files and folders on removable drives when plugged
into the endpoint.
• Select Specify the file path to encrypt on USB devices to add or
remove encrypted folders to USB drives. If a folder does not exist, itis created. If no drive letter is specified, all USB devices are affected.

6.

Under Notifications, select Show a legal notice to show the specificlegal message at start up or only after installing the File Encryption
agent.
Note
Notifications are only supported by Trend Micro File Encryption agents
versions 3.1.3 and earlier.

28-13

Trend Micro Apex Central™ Widget and Policy Management Guide

Configuring Common Policy Rules
This section explains the configurable options for policy rules affecting all
Endpoint Encryption devices.
Procedure
1.

Create a new Endpoint Encryption policy.

2.

Click Common.
The Common policy rules settings appear.

Figure 28-4. Common Policy Rules

28-14

Endpoint Encryption Policy Settings

3.

Under Allow User to Uninstall, select Allow User (non-administrator)
accounts to uninstall agent software to allow any Endpoint Encryptionuser to uninstall the agent.
Note
By default, only Administrator accounts can uninstall Endpoint
Encryption agents.

4.

Under Lockout and Lock Device Actions, configure the following
options:• Select Lock account after <number> days to specify the number ofdays that the Endpoint Encryption device locks if it does notsynchronize policies.
• Use Account lockout action to specify whether the remoteauthentication or erase action occurs at lockout.
Note
For information about lock options, see Lockout Actions on page28-16

• Select Failed log on attempts allowed to specify how many times
that a user can attempt to authenticate before the Endpoint
Encryption device locks.
• For Full Disk Encryption or File Encryption devices, separately
configure the following:• Use Device locked action to specify whether the “Remote
Authentication” or the “Erase” action occurs at lockout.
Note
For information about lock options, see Lockout Actions on page
28-16

28-15

Trend Micro Apex Central™ Widget and Policy Management Guide• Use Number of minutes to lock device to specify the durationthat time delay locks the Endpoint Encryption device fromauthentication
5.

Under Password, configure the following options:• Select Users must change password after <number> days tocontrol when a user is prompted to update password.
• Select Users cannot reuse the previous <number> passwords tospecify how many previous passwords the user may reuse.
• Select Number of consecutive characters allowed in a password tospecify how many repeated characters a user may specify in the
password.
• Select Minimum length allowed for passwords to specify how
many characters the user is required to use in the password.

6.

Under Password Requirements, specify the password character
limitations.
• Letters• Lowercase characters• Uppercase characters• Numbers• Symbols
Important
The sum total of letters, numbers, and symbols cannot exceed 255
characters.

7.

Under Agent, specify the Sync internal in minutes.

Lockout Actions
Some policies have settings to lock out a user account or to lock a device
based on certain criteria. Account lockout and device lockout actions affect28-16

Endpoint Encryption Policy Settings

the Endpoint Encryption device whether or not the agent synchronizes
policies with PolicyServer. For example, if the Endpoint Encryption agent
does not communicate with PolicyServer for a certain period of time, theEndpoint Encryption agent automatically locks the Endpoint Encryption
device. Use the tables below to understand the actions available for theaccount lockout and device lock actions.
The following table describes when the lockout actions occur:
Type

Description

Account lockout

Account lockout actions take effect when the Endpoint Encryption
agent does not communicate with PolicyServer for a certain period oftime as set by the policy.

Full Disk Encryption
device lockout

Full Disk Encryption device lockout actions take effect when the
Endpoint Encryption user exceeds the number of unsuccessful logon
attempts to that Full Disk Encryption device as set by the policy.

File Encryption
device lockout

File Encryption device lockout actions take effect when the Endpoint
Encryption user exceeds the number of unsuccessful logon attempts
to that File Encryption device as set by the policy.

The options for lockout actions are as follows:
Description

ActionErase

PolicyServer erases all data controlled by the associated Endpoint
Encryption agent.
WARNING!
The Endpoint Encryption user cannot recover the erased
data.

Remote authentication

PolicyServer locks the Endpoint Encryption device until the
Endpoint Encryption user contacts receives Remote Help
authentication from an authenticator or from Support.

28-17

Trend Micro Apex Central™ Widget and Policy Management Guide

ActionTime delay

Description
PolicyServer temporarily locks the Endpoint Encryption device andnotifies the Endpoint Encryption user that the device is locked. The
ability to authenticate or reset the password is disabled during thetime delay. The duration of the time delay is determined by policy.
Once the time delay has expired, the user is permitted toauthenticate.

Migrating Groups to Apex Central
Use the following procedure to add existing groups from PolicyServer MMC
to Apex Central.

Procedure1.

Log on to PolicyServer MMC.

2.

Gather the following information:• Total number of groups, their names, and the subgroups• All users assigned to each group• The policy configuration of each group3.

Log on to Apex Central.

4.

For each group in PolicyServer MMC, configure a new policy thatmatches the corresponding group policy configuration.
Note
Subgroups are not supported in Apex Central. To replicate the subgroup
policy settings, create a separate policy for each subgroup.

5.

Add users to each corresponding new policy.

6.

Deploy each policy.

28-18

Part XII
Endpoint Sensor Widgets andPolicies

Chapter 29

Trend Micro Endpoint Sensor Dashboard
Widgets
This section contains help topics for the Trend Micro Endpoint Sensor
dashboard widgets supported in Apex Central.
Topics include:

29-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Endpoint Sensor Investigation
The Endpoint Sensor Investigation widget connects with a remote Trend
Micro Endpoint Sensor server to start an investigation and display the resultsfrom this investigation directly from the Apex Central dashboard.
Click Start a New Investigation to initiate a new investigation, and thenselect an investigation method:• Historical Records to Investigate historical events based on userdefined criteria• System Snapshot to investigate the current state of the selected
endpoints
Once the New Investigation page appears, fill in the required criteria. The
following investigation types are available:
Investigation Type

Description

Historical Records Retro Scan

Investigate historical events based on user-defined criteria

Historical Records IOC rule

Investigate historical events using an IOC rule

System Snapshot Registry search

Investigate the Windows registry

System Snapshot YARA rule

Investigate for memory-resident threats using a YARA rule

System Snapshot IOC rule

Investigate for events using an IOC rule

System Snapshot Disks IOC rule

Investigate for files using an IOC rule

System Snapshot System audit

Investigate all currently running processes, services, and modules

Click Investigate to start the investigation. To stop an ongoing investigation,
click Cancel.

29-2

Trend Micro Endpoint Sensor Dashboard Widgets

The widget refreshes periodically to display the progress of the investigation.
The widget displays a doughnut chart which gives a visual representation of
the total endpoints classified as:• Matched: indicates the number of endpoints where a matched object
was found.
• Safe: indicates the number of endpoints where a matched object was notfound.
• Pending: indicates the number of endpoints not yet investigated.
• Canceled: indicates the number of endpoints that meet any of thefollowing criteria:• The investigation performed on the endpoint encountered an error• The endpoint is offline, or all commands sent to the endpoint resultin a timeout• The investigation for the endpoint was manually interrupted by theuser
A breakdown of the totals is given on the right of the doughnut chart. Clickthe count for each classification to view the Investigation Results screen.
This screen gives more details regarding the latest investigation results
started from Apex Central.
Note• Once a server is added, refresh the widget to start retrieving data fromthe new server.
• If multiple servers are added, the widget displays the aggregate result of
all the servers' data.

Intelligent Monitoring Summary by Host
This widget displays a summary of the most recent endpoints where amonitoring rule was triggered. The data is pulled from the Intelligent

29-3

Trend Micro Apex Central™ Widget and Policy Management Guide

Monitoring Summary by Host widget in the Trend Micro Endpoint Sensor
server dashboard.
Column Name

Description

Host Name

Host name of the endpoint

Hit Counts

Number of matching rules triggered on the endpoint
Click to view details about the rules triggered on the endpoint.

Rule Category

Classification based on the six stages of a targeted attack

Detection time

Date and time when the rule was last triggered in the endpoint

The default time period is Last 24 hours. Change the time period according
to your preference.
Note• The widget requires an existing connection to a Trend Micro Endpoint
Sensor server. After adding a server, refresh the widget to start retrieving
data from the new server.
• If multiple servers are added, the widget displays the aggregate result of
all the servers' data.

29-4

Trend Micro Endpoint Sensor Dashboard Widgets

Top Critical Threats by Dwell Time Widget

This widget provides an overview of the top critical threats based on thelength of time the threat has been present on the endpoint of the affecteduser.
Important
This widget requires a registered Trend Micro Endpoint Sensor server. The
widgets displays the results of the impact assessment performed by the Trend
Micro Endpoint Sensor server, based on the SHA-1 values of files consideredas critical threats.

You can select Display only unmitigated threats to view only the criticalthreats that require remediation.
Click the column headings to sort the data in the table.

29-5

Trend Micro Apex Central™ Widget and Policy Management Guide

ColumnFile Name

Description
Displays the file name of the critical threat detected
Click the File Name to view additional threat information or perform
further investigation.

Affected User

Displays the name of the affected user

Remediation

Displays the remediation action taken by a Trend Micro product

Dwell Time

Displays the length of time that the threat has persisted on theendpoint of the affected user

Click View dismissed alerts to open the Dismissed Alerts screen and view
information for only critical threat alerts that have been manually dismissedby an Apex Central user account.
ColumnDescription

Dismissed

Displays the time when the critical threat alert was dismissed

File Name

Displays the file name of the critical threat detected
Click the File Name to view additional threat information or perform
further investigation.

29-6

Affected User

Displays the name of the affected user

Dwell Time

Displays the length of time that the threat has persisted on theendpoint of the affected user

Dismissed By

Displays the Apex Central user account that dismissed the criticalthreat alert

Chapter 30

Trend Micro Endpoint Sensor Integration
and Policy Settings
The following content explains how to integrate Trend Micro Endpoint
Sensor with Apex Central and manage policies from the Apex Central
console.
Topics include:

30-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Endpoint Sensor Integration
Apex Central integration with standalone Endpoint Sensor servers enables
the following features and capabilities:• Use uploaded IOC files in Apex Central to initiate investigations directly
to Endpoint Sensor from the Apex Central console.
• Register multiple Endpoint Sensor servers. Apex Central can startsimultaneous investigations on multiple Endpoint Sensor servers.
• Pull data from Endpoint Sensor investigation results. The data is thendisplayed in a Apex Central widget.
• Create and deploy policies to Endpoint Sensor servers registered with
Apex Central.
• Manage monitoring rules in Apex Central.
• Configure and deploy Submission settings to Endpoint Sensor servers
registered with Apex Central.

Registering with Apex Central
Procedure
1.

Open the Apex Central management console.
To open the Apex Central console on any endpoint on the network, open
a web browser and type the following:https:// <Apex Central server name> /Webapp/index.html

Where <Apex Central server name> is the IP address or host name of
the Apex Central server

30-2

2.

Go to Administration > Managed Servers > Server Registration.

3.

On the screen that appears, select Trend Micro Endpoint Sensor as theServer Type, and then click Add.

4.

On the Add Server screen, provide the following details:

Trend Micro Endpoint Sensor Integration and Policy Settings• Server• Display name
• User name• Password
5.

Click Save to add the server to the list. Repeat these steps to add anotherserver.

Adding the Endpoint Sensor Widgets
Procedure
1.

Open the Apex Central management console.
To open the Apex Central console on any endpoint on the network, open
a web browser and type the following:https:// <Apex Central server name> /Webapp/index.html

Where <Apex Central server name> is the IP address or host name of
the Apex Central server
2.

Go to Administration > Managed Servers > Server Registration.

3.

On the screen that appears, select Trend Micro Endpoint Sensor as theServer Type, and then click Add.

4.

Specify the details of the server to be added, and click Save.

5.

Go to the Dashboard.

6.

Select an existing tab or create a new tab.

7.

Click the Settings button to the right of the tab display.

8.

Click Add Widgets.

9.

On the screen that appears, select the Endpoint Sensor category fromthe drop-down list.
The following widgets are available:
30-3Trend Micro Apex Central™ Widget and Policy Management Guide

Table 30-1. Endpoint Sensor Widgets
Widget Name

Description

Intelligent
Monitoring
Summary by Host

Displays the endpoints which triggered a monitoring rule.
Manually refresh the widget to view the most recent data. To
configure the widget settings, click ▼.

Endpoint Sensor
Investigation

Run an investigation and view a quick summary of the latest
Trend Micro Endpoint Sensor investigation started from Apex
Central. By default, the widget automatically refreshes every 2
minutes. To configure the widget settings, click ▼.
For details, see the Trend Micro Endpoint Sensor Administrator's
Guide.

10. Select one or both widgets, and click Add.
Added widgets appear on the Dashboard. These widgets display asummary of the most recent investigations and monitoring results of all
the registered servers.
Note
After registering a new Endpoint Sensor server, refresh the Endpoint
Sensor Investigation and Intelligent Monitoring Summary by Hostwidgets to update the contents of the widgets with data from the newserver.

Using Apex Central to Check Status
Use the Product Connection Status and Agent Connection Status widgets tocheck the status of registered Endpoint Sensor servers or agents. Thesewidgets display information from Endpoint Sensor servers added via the
Administration > Managed Servers > Server Registration screen.

Procedure
1.

30-4

Go to the Dashboard.

Trend Micro Endpoint Sensor Integration and Policy Settings

2.

Click the Compliance tab to view the following widgets:
Note
The Product Connection Status is also available on the Summary tab.

• Product Connection Status: Displays the server status in the Status
columnClick View details to view detailed information about the servers.
• Agent Connection Status: Displays the total number of agents,
online agents, and offline agents for each server
Click the count in the Online, Offline, or Total column to view
detailed information about the agents.
3.

To add the widgets to a tab:a.

Go to an existing tab or create a new tab.

b.

Click the Settings button to the right of the tab display.

c.

Click Add Widgets.

d.

On the Add Widgets screen, select the Compliance category.

e.

Select Agent Connection Status or Product Connection Status.

f.

Click Add.
The added widget appears on the current tab.

Using the Endpoint Sensor Investigation Widget
Procedure
1.

Open the Apex Central management console.

2.

Go to the tab where the Endpoint Sensor Investigation widget has been
added.
30-5

Trend Micro Apex Central™ Widget and Policy Management Guide

3.

In the Endpoint Sensor Investigation widget, click Start a New
Investigation , and then click Historical Records or System Snapshot,
depending on the type of investigation you plan to run.

4.

In the screen that appears, specify the required information.
The Endpoint Sensor Investigation widget also supports importing C&C
callback events as investigation criteria.

5.

a.

On the Endpoint Sensor Investigation widget, click Start a New
Investigation > Historical Records.

b.

Select Retro Scan as the investigation method.

c.

Click Import from C&C Callback Events.

d.

On the screen that appears, select the C&C callback events that need
to be investigated, and click OK. The events will be added as
investigation criteria.

Click Investigate.
The screen refreshes and displays the progress of the investigation.
Note
To stop an ongoing investigation, click Cancel.

6.

Once the investigation is finished, the widget shows the number of
endpoints classified as Matched, Safe, Pending or Cancelled during theinvestigation. Click the result of each classification to view more details.

Using Automatic Updates
To use Apex Central as a local update server for Endpoint Sensor, performthe following steps:
Procedure
1.
30-6

Set up automatic updates in Apex Central.

Trend Micro Endpoint Sensor Integration and Policy Settingsa.

Open the Apex Central management console.

b.

Go to Administration > Updates > Scheduled Update.

c.

Locate the following patterns:• Endpoint Sensor Exception Pattern• Endpoint Sensor Trusted Pattern• Attack Discovery Patternd.

For each pattern, click the pattern name, and select Enable
scheduled downloads. Leave everything else at the default values.
Note
For Endpoint Sensor integration, Automatic Deployment Settings is
not supported.

e.
2.

Click Save.

Configure Endpoint Sensor to use Apex Central as its update source.
a.

Open the Endpoint Sensor server management console.

b.

Click Administration > Updates.

c.

Enable Download monitoring rules from the following source.

d.

Select Other update source, and type the following in the textbox
below:
http://<Apex Central server Name>/TVCSDownload/
Activeupdatee.

Click Save.

Apex Central includes the Endpoint Sensor patterns during the nextscheduled update. Afterwards, Endpoint Sensor then downloads thesepatterns from Apex Central during the next Endpoint Sensor scheduled
update.

30-7

Trend Micro Apex Central™ Widget and Policy Management Guide

Trend Micro Endpoint Sensor Policy
Apex Central includes a Policy Management feature which allows
administrators to remotely update monitoring rules and deploy submission
settings on registered servers.
NoteMultiple Endpoint Sensor policies can be created, but each server can issue
only one policy at a time.
For details, see the Apex Central documentation at:
http://docs.trendmicro.com/en-us/enterprise/apex-central.aspx

Preparing the Server for Policy Deployment
By default, recently added Endpoint Sensor servers are placed in the New
Entity folder. The servers have to be moved to another folder to be visible forpolicy deployment.
Procedure
1.

Open the Apex Central management console.

2.

Go to Directories > Products, and click Directory Management.

3.

In the directory tree, expand the New Entity folder and locate the server
you wish to manage.

4.

Perform any of the following:• Drag and drop the server to another folder• Click Add Folder to create a new folder, and then drag and drop theserver to the new folder.

30-8

Trend Micro Endpoint Sensor Integration and Policy Settings

Creating and Deploying Policies
Procedure
1.

Open the Apex Central management console.

2.

Go to Policies > Policy Management.

3.

On the Product drop down, select Trend Micro Endpoint Sensor.

4.

Click Create.

5.

Click Specify Target(s) and select which Endpoint Sensor servers you
wish to deploy to.

6.

On the Monitoring Settings section, configure monitoring rules andsubmission settings for the new policy.

7.

Click Deploy to immediately start the policy deployment.
Afterwards, Apex Central enforces any subsequent updates to the policyon the target Endpoint Sensor servers every 24 hours.
For details, see the Apex Central documentation at:
http://docs.trendmicro.com/en-us/enterprise/apex-central.aspx

Managing Monitoring Rules
Take note of the following considerations:• Managing monitoring rules:
The Monitoring Rules tab displays user-defined rules only. Whilemonitoring rules are shared across policies, the status of a monitoring
rule (Enabled/Disabled/remove) is independent for each policy.
Administrators can customize policies by selecting which monitoring
rules are enabled, disabled, or remove for each policy. New monitoring
rules are disabled by default.
Apex Central is limited to remotely controlling monitoring rules in
Endpoint Sensor servers where the rules are part of a Endpoint Sensor
policy.
30-9

Trend Micro Apex Central™ Widget and Policy Management Guide

If a new Endpoint Sensor server is registered, Apex Central
automatically includes the new Endpoint Sensor server in its rule
deployment schedule. Once the next deployment schedule is due, Apex
Central uploads all active monitoring rules to the newly registeredserver.
• Uploading monitoring rules:
To upload a monitoring rule, Click Policies > Policies Management , andselect Trend Micro Endpoint Sensor as the Product . Click Create toceate a new policy, or click an existing policy to open the Create / Edit
Policy screen. Expand Monitoring Settings, click Upload IOC Rule >Choose File, and navigate to the location of the monitoring rule. Click
Open to automatically upload the monitoring rule. After the upload iscomplete, click Save or Deploy.
Note• It is recommended to specify the target Endpoint Sensor servers
before uploading the rule.
• The Upload IOC Rule feature is enabled only when there is at least
one Endpoint Sensor server registered to Apex Central.

Uploading the same monitoring rule in both Apex Central and in a
Endpoint Sensor server registered with Apex Central may cause
conflicts. Regularly keep track of the uploaded monitoring rules throughthe Monitoring Settings screen to avoid duplication.
If a duplicate monitoring rule is encountered, the following message
appears: "Unable to upload file. The file already exists in the Endpoint
Sensor server. Use the Endpoint Sensor management console to remove
the file first, and try again."• Changing the status of a monitoring rule:
To change the status of a monitoring rule, click Toggle Status, and selectEnable or Disable. Afterwards, update the remote rule of the Endpoint
Sensor servers specified as targets in this policy.

30-10Trend Micro Endpoint Sensor Integration and Policy Settings

The status of a monitoring rule is independent for each policy.
• Removing monitoring rules:
To remove a rule, select the rule and click Remove. The status of theremoved rule changes to remove. Click Save or Deploy to complete theprocess.
WARNING!
• Removal of a monitoring rule also removes the monitoring rulefrom all other Endpoint Sensor policies.
• If the same rule is re-uploaded in a new policy, the old policy willremove the rule again during its scheduled run.
If problems persist, contact Trend Micro support for assistance.

Managing Submission Settings
Use the Submission Settings tab to specify if the collected files are sent to a
local file server, or sent to Deep Discovery Analyzer for further analysis.
Apex Central is unable to configure a proxy connection between Endpoint
Sensor endpoints and Deep Discovery Analyzer. To configure a proxyconnection between Endpoint Sensor endpoints and Deep Discovery
Analyzer, use the Proxy screen of the Endpoint Sensor server computer.

30-11

Part XIIIInterScan Security Policies

Chapter 31

InterScan Messaging Security Suite
Policy Settings
This section discusses how to configure InterScan Messaging Security Suite
policy settings in Apex Central.
Topics include:

31-1

Trend Micro Apex Central™ Widget and Policy Management Guide

IMSS Rules
InterScan Messaging Security Suite (IMSS) evaluates data in an email message
against a set of defined rules. Rules determine data that must be protectedfrom unauthorized transmission and the action that IMSS performs when it
detects transmission.
IMSS rules have the following components:• Mail Route: A set of sender and recipient email addresses or groups, oran LDAP user or group to which the policy is applied. You can use theasterisk (*) to create wildcard expressions and simplify route
configuration.
• Filter: A rule or set of rules that apply to a specific route. In Apex
Central, you can set rules for protecting against data loss using
templates.
• Action: The action that IMSS performs if the filter conditions are met.

Adding IMSS Rules
Creating a rule involves the following steps:• Step 1: Set Rule Name
• Step 2: Select Recipients and Senders• Step 3: Select Templates• Step 4: Select Actions
Procedure
1.

Under Settings, click Add.
The Add Rule screen appears.

31-2

InterScan Messaging Security Suite Policy Settings

Step 1: Set Rule Name
Procedure
1.

Type a name for the rule. The name must not exceed 122 bytes in length.

2.

Assign an order number that represents its position within the hierarchyof rules.

3.

Click Next.
The Select Recipients and Senders screen appears.

Step 2: Select Recipients and Senders
Set the sender and recipient email addresses or groups, or an LDAP user orgroup to which the rule is applied. You can also configure exceptions to a
mail route.
Procedure
1.

Click the link next to To: or From:.
The Set Recipients or Set Senders screen appears.

2.

Select one of the following:• Anyone: Select this option to remove any restriction on therecipients or senders.
• Any of the selected addresses

3.

If you selected Any of selected addresses, choose one of the following
from the list box:
• Enter email address: Type the email address to add.
• Search for LDAP users or groups: Type the LDAP user or groupname and click Search. The results display in the list box.
• Select address groups: All existing address groups appear in the
list.
31-3

Trend Micro Apex Central™ Widget and Policy Management Guide

When selecting an LDAP group as the recipients or senders, you can use
wildcards at the beginning and/or at the end of the LDAP group if you
have specified Microsoft Active Directory or Sun iPlanet Directory as the
LDAP server.
For more information, see Using the Asterisk Wildcard on page 31-5.
4.

If you are adding an email address, click Add >. If you are adding an
LDAP user or group, or an address group, click it in the list box, and thenclick Add >.

5.

Click Save.

6.

Click Next.
The Step 3: Select Template screen appears.

Configuring Exceptions
You can configure a route that applies to a large group of senders orrecipients, with the exception of specific users, to whom the rule does not
apply.
Procedure
1.

Click Senders and Recipients next to Exceptions.
The Set Exceptions screen appears.

2.

Under Select addresses, select one of the following for both the From
(sender) and To (recipient) addresses:• Enter email address: Type the email address to add.
• Search for LDAP users or groups: Type the LDAP user or groupname and click Search. The results display in the list box.
• Select address groups: All existing address groups appear in the
list.

3.

31-4

If you are adding an email address, click Add >. If you are adding an
LDAP user or group, or an address group, click it in the list box, and thenclick Add >.

InterScan Messaging Security Suite Policy Settings

4.

Click Save.

Using the Asterisk Wildcard
You can use the asterisk (*) as a wildcard in email addresses when defining
routes.
Wildcards can appear in the name or domain sections of an email address.
The following are valid examples:• *@*: Valid representation of all email addresses.
• *@domain.tld, name@*.tld: Valid representation of the whole name or
the domain (not the top level domain (TLD)).
• *@*.tld: Valid representation of both the name and the domain (not the
TLD).
Wildcards cannot appear in a subdomain or the top-level domain. Wildcards
also cannot appear with other letters; they must appear alone. The following
are invalid examples:• name@domain.*.tld: Invalid representation of a subdomain.
• name@domain.*: Invalid representation of a TLD.
• *name@domain.tld: Invalid use in conjunction with a name.

Step 3: Select Templates
Templates prevent your digital assets (for example, social security numbers
and credit card numbers) from leaving your company network. They also
provide compliance for government regulations regarding privacy.
Procedure1.

Select templates from the Available templates list, and then click >>.
Tip
Select multiple templates by pressing and holding the CTRL key and thenselecting the templates.

31-5

Trend Micro Apex Central™ Widget and Policy Management Guide

2.

Click Next.
The Step 4: Select Actions screen appears.

Step 4: Select Actions
IMSS performs one or more actions when it detects an attempt to transmit
digital assets.
Procedure1.

Select one of the following actions:• Quarantine to: Instructs IMSS to intercept the messages andprevent them from reaching the recipients.
• Send notifications: Instructs IMSS to send an email notification to
one or more recipients.

2.

If you selected Send notifications, select the type of notification
message that you want to use from the dropdown list. The notification
messages that are available for use will depend on the targets that you
selected.

3.

Click Finish.

Modifying Existing IMSS Rules
Procedure
1.

Click the name of the rule to edit.
The Summary screen for the rule appears.

2.

In the Rule tab, click Edit for If recipients and senders are.

3.

Configure the route settings.
For more information, see Step 2: Select Recipients and Senders on page
31-3.

31-6

InterScan Messaging Security Suite Policy Settings

4.

Click Edit for And scanning conditions match.

5.

Configure the template settings.

6.

Click Edit for Then action is.

7.

Configure the action settings.
Note
If Apex Central is unable to connect to the selected targets, some action
options may become unavailable.

8.

Click Save.

Deleting IMSS Rules
Procedure1.

Select the check box next to the rule to be deleted.

2.

Click Delete.

31-7Chapter 32

InterScan Messaging Security Virtual
Appliance Policy Settings
This section discusses how to configure InterScan Messaging Security Virtual
Appliance policy settings in Apex Central.
Topics include:

32-1

Trend Micro Apex Central™ Widget and Policy Management GuideIMSVA Rules
InterScan Messaging Security Virtual Appliance (IMSVA) evaluates data in an
email message against a set of defined rules. Rules determine data that must
be protected from unauthorized transmission and the action that IMSVA
performs when it detects transmission.
IMSVA rules have the following components:• Mail Route: A set of sender and recipient email addresses or groups, oran LDAP user or group to which the policy is applied. You can use theasterisk (*) to create wildcard expressions and simplify route
configuration.
• Filter: A rule or set of rules that apply to a specific route. In Apex
Central, you can set rules for protecting against data loss using
templates.
• Action: The action that IMSVA performs if the filter conditions are met.

Adding IMSVA Rules
Creating a rule involves the following steps:• Step 1: Set Rule Name
• Step 2: Select Recipients and Senders• Step 3: Select Templates• Step 4: Select Actions
Procedure
1.

Under Settings, click Add.
The Add Rule screen appears.

32-2

InterScan Messaging Security Virtual Appliance Policy Settings

Step 1: Set Rule Name
Procedure
1.

Type a name for the rule. The name must not exceed 122 bytes in length.

2.

Assign an order number that represents its position within the hierarchyof rules.

3.

Click Next.
The Select Recipients and Senders screen appears.

Step 2: Select Recipients and Senders
Set the sender and recipient email addresses or groups, or an LDAP user orgroup to which the rule is applied. You can also configure exceptions to a
mail route.
Procedure
1.

Click the link next to To: or From:.
The Set Recipients or Set Senders screen appears.

2.

Select one of the following:• Anyone: Select this option to remove any restriction on therecipients or senders.
• Any of the selected addresses

3.

If you selected Any of selected addresses, choose one of the following
from the list box:
• Enter email address: Type the email address to add.
• Search for LDAP users or groups: Type the LDAP user or groupname and click Search. The results display in the list box.
• Select address groups: All existing address groups appear in the
list.
32-3

Trend Micro Apex Central™ Widget and Policy Management Guide

When selecting an LDAP group as the recipients or senders, you can use
wildcards at the beginning and/or at the end of the LDAP group if you
have specified Microsoft Active Directory or Sun iPlanet Directory as the
LDAP server. For more information, see Using the Asterisk Wildcard.
4.

If you are adding an email address, click Add >. If you are adding an
LDAP user or group, or an address group, click it in the list box, and thenclick Add >.

5.

Click Save.

6.

Click Next.
The Step 3: Select Template screen appears.

Configuring Exceptions
You can configure a route that applies to a large group of senders orrecipients, with the exception of specific users, to whom the rule does not
apply.

Procedure
1.

Click the link next to Exceptions.
The Set Exceptions screen appears.

2.

Under Select addresses, select one of the following for both the Fromand To addresses:• Enter email address: Type the email address to add.
• Search for LDAP users or groups: Type the LDAP user or groupname and click Search. The results display in the list box.
• Select address groups: All existing address groups appear in the
list.

3.

32-4

If you are adding an email address, click Add >. If you are adding an
LDAP or address group, click it in the list box, and then click Add >.

InterScan Messaging Security Virtual Appliance Policy Settings

4.

Click Save.

Using the Asterisk Wildcard
You can use the asterisk (*) as a wildcard in email addresses when defining
routes.
Wildcards can appear in the name or domain sections of an email address.
The following are valid examples:• *@*: Valid representation of all email addresses.
• *@domain.tld, name@*.tld: Valid representation of the whole name or
the domain (not the top level domain (TLD)).
• *@*.tld: Valid representation of both the name and the domain (not the
TLD).
Wildcards cannot appear in a subdomain or the top-level domain. Wildcards
also cannot appear with other letters; they must appear alone. The following
are invalid examples:• name@domain.*.tld: Invalid representation of a subdomain.
• name@domain.*: Invalid representation of a TLD.
• *name@domain.tld: Invalid use in conjunction with a name.

Step 3: Select Templates
Templates prevent your digital assets (for example, social security numbers
and credit card numbers) from leaving your company network. They also
provide compliance for government regulations regarding privacy.
Procedure1.

Select templates from the Available templates list, and then click >>.
Select multiple templates by pressing and holding the Ctrl key and thenselecting the templates.

2.

Click Next.
32-5

Trend Micro Apex Central™ Widget and Policy Management Guide

The Step 4: Select Actions screen appears.

Step 4: Select Actions
IMSVA performs one or more actions when it detects an attempt to transmit
digital assets.
Procedure1.

Select one of the following actions:• Quarantine to: Instructs IMSVA to intercept the messages andprevent them from reaching the recipients.
• Send notifications: Instructs IMSVA to send an email notification to
one or more recipients.

2.

If you selected Send notifications, select the type of notification
message that you want to use from the drop-down list.
The notification messages that are available for use will depend on thetargets that you selected.

3.

Click Finish.

Modifying Existing IMSVA Rules
Procedure
1.

Click the name of the rule to edit.
The Summary screen for the rule appears.

2.

In the Rule tab, click Edit for If recipients and senders are.

3.

Configure the route settings.
For more information, see Step 2: Select Recipients and Senders on page
32-3.

4.
32-6

Click Edit for And scanning conditions match.

InterScan Messaging Security Virtual Appliance Policy Settings

5.

Configure the template settings.

6.

Click Edit for Then action is.

7.

Configure the action settings.
Note
If Trend Micro Apex Central is unable to connect to the selected targets,
some action options may become unavailable.

8.

Click Save.

Deleting IMSVA Rules
Procedure1.

Select the check box next to the rule to be deleted.

2.

Click Delete.

32-7Chapter 33

InterScan Web Security Suite Policy
Settings
This section discusses how to configure InterScan Web Security Suite policy
settings in Apex Central.
Topics include:

33-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Data Loss Prevention Rule List
When you enable the Data Loss Prevention option, you can also enable ordisable individual Data Loss Prevention rules. The green check icon indicatesthe rule is enabled. The red "x" icon indicates the rule is disabled. You canclick the icon to toggle between enabled and disabled states.
The following options are available on this screen:
Rule: Click to edit the rule.
Add: Opens the Add Rule screen that allows you to configure a new rule.
Copy: Allows you to copy a selected rule from the list.
Delete: Allows you to delete a rule from the list.
Priority: Click the arrow to change the rule priority.
Status: Click the icon to enable or disable the rule.
Save: Click to save the rule.

Step 1: Set Rule Name
The following is a brief description of the options available on this screen.
• Enable: Select to enable the rule.
• Rule name: Type a name for this rule to display.
• Next >: Click to continue.

Step 2: Select Accounts
The following is a brief description of the options available on this screen.
Note
Not all options are available when creating draft rules. Specify a server toenable all options.

33-2

InterScan Web Security Suite Policy Settings• Specify IP addresses of the accounts that apply to the rule.
• Type an IP range in From and To, a specific account IP address or
host name in IP/Hostname, or an IP subnet in Address and Prefix
Length.
• Click Add to create one or multiple accounts in the right table.
• Click Delete to remove one or multiple accounts from the righttable.
• < Back: Click to return to the previous page.
• Next >: Click to continue.

Step 3: Select Compliance Templates to Block
The following is a brief description of the options available on this screen.
• Specify the compliance templates you would like to block using thisrule.
• Available Template(s): The templates listed are available to use
with the rule.
• Selected Template(s) to Block: The rule to block is applied to thetemplates in the list.
Tip
Select multiple templates by holding the Shift or Ctrl key andclicking account names.

• >>: Click to add available templates to the selected template list.
• <<: Click to remove templates from the selected template list.
• < Back: Click to return to the previous page.
• Next >: Click to continue.

Step 4: Select Compliance Templates to Monitor
The following is a brief description of the options available on this screen.
33-3

Trend Micro Apex Central™ Widget and Policy Management Guide• Specify the compliance templates you would like to monitor using thisrule.
• Available Template(s): The templates listed are available to use
with the rule.
• Selected Template(s) to Monitor: The rule to monitor is applied tothe templates in the list.
Tip
Select multiple templates by holding the Shift or Ctrl key andclicking account names.

• >>: Click to add available templates to the selected template list.
• <<: Click to remove templates from the selected template list.
• < Back: Click to return to the previous page.
• Finish: Click to return to the list of rules.

33-4

Chapter 34

InterScan Web Security Virtual
Appliance Policy Settings
This section discusses how to configure InterScan Web Security Virtual
Appliance policy settings in Apex Central.
Topics include:

34-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Data Loss Prevention Rule List
When you enable the Data Loss Prevention option, you can also enable ordisable individual Data Loss Prevention rules. The green check icon indicatesthe rule is enabled. The red "x" icon indicates the rule is disabled. You canclick the icon to toggle between enabled and disabled states.
The following options are available on this screen:
Rule: Click to edit the rule.
Add: Opens the Add Rule screen that allows you to configure a new rule.
Copy: Allows you to copy a selected rule from the list.
Delete: Allows you to delete a rule from the list.
Priority: Click the arrow to change the rule priority.
Status: Click the icon to enable or disable the rule.
Save: Click to save the rule.

Step 1: Set Rule Name
The following is a brief description of the options available on this screen.
• Enable: Select to enable the rule.
• Rule name: Type a name for this rule to display.
• Next >: Click to continue.

Step 2: Select Accounts
The following is a brief description of the options available on this screen.
Note
Not all options are available when creating draft rules. Specify a server toenable all options.

34-2

InterScan Web Security Virtual Appliance Policy Settings• Specify IP addresses of the accounts that apply to the rule.
• Type an IP range in From and To, a specific account IP address or
host name in IP/Hostname, or an IP subnet in Address and Prefix
Length.
• Click Add to create one or multiple accounts in the right table.
• Click Delete to remove one or multiple accounts from the righttable.
• < Back: Click to return to the previous page.
• Next >: Click to continue.

Step 3: Select Compliance Templates to Block
The following is a brief description of the options available on this screen.
• Specify the compliance templates you would like to block using thisrule.
• Available Template(s): The templates listed are available to use
with the rule.
• Selected Template(s) to Block: The rule to block is applied to thetemplates in the list.
Tip
Select multiple templates by holding the Shift or Ctrl key andclicking account names.

• >>: Click to add available templates to the selected template list.
• <<: Click to remove templates from the selected template list.
• < Back: Click to return to the previous page.
• Next >: Click to continue.

Step 4: Select Compliance Templates to Monitor
The following is a brief description of the options available on this screen.
34-3

Trend Micro Apex Central™ Widget and Policy Management Guide• Specify the compliance templates you would like to monitor using thisrule.
• Available Template(s): The templates listed are available to use
with the rule.
• Selected Template(s) to Monitor: The rule to monitor is applied tothe templates in the list.
Tip
Select multiple templates by holding the Shift or Ctrl key andclicking account names.

• >>: Click to add available templates to the selected template list.
• <<: Click to remove templates from the selected template list.
• < Back: Click to return to the previous page.
• Finish: Click to return to the list of rules.

34-4

Part XIV
ScanMail for Microsoft Exchange
Policies

Chapter 35

ScanMail for Microsoft Exchange Policy
Settings
This section explains how to configure ScanMail for Microsoft Exchange
policy settings on the Apex Central console.
Topics include:

35-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Configuring a Data Loss Prevention Policy
Data Loss Prevention policies govern the actions Apex Central takes when it
discovers sensitive information in email messages.
Create a new policy by clicking Data Loss Prevention > DLP Policies > Add.
Modify an existing policy by clicking Data Loss Prevention > DLP Policies >[DLP Policy Name].
Configure Data Loss Prevention policies through the following five step
process:
1. Selecting Accounts on page 35-2
2. Configuring DLP Targets on page 35-3
3. Configuring DLP Actions on page 35-4
4. Configuring DLP Notifications on page 35-5
5. Enabling a DLP Policy on page 35-6

Selecting Accounts
Procedure
1.

Go to the Data Loss Prevention Policies screen by navigating to Data
Loss Prevention > DLP Policies.

2.

Add or edit a policy or exception:• For new policies or exceptions:
Click Add.
• For preexisting policies or exceptions:a. Click the policy or exception name.
b. Click the Accounts tab.

3.
35-2

Select one of the following:

ScanMail for Microsoft Exchange Policy Settings• Anyone: Apply this policy or exception to all users.
• Specific accounts: Select from Active Directory groups or Apex
Central special groups.
4.

Search and select AD Users/Groups/Contacts/Special Groups and addthem to the Selected Account(s) list.

5.

Search and select AD Users/Groups/Contacts/Special Groups and addthem to the Selected Account(s) list on the Exclude Accounts screen.

Configuring DLP Targets
Procedure
1.

Go to the Data Loss Prevention Policies screen by navigating to thefollowing:• For Real-time scans: Data Loss Prevention > DLP Policies• For Manual scans: Manual Scan > Data Loss Prevention• For Scheduled scans: Scheduled Scan > [Add or Edit] > Data Loss
Prevention2.

Add or edit a policy or exception:• For new policies or exceptions:a. Click Add.
b. Go to the Specify Rule screen.
• For preexisting policies or exceptions:a. Click the policy or exception name.
b. Click the Target tab.

3.

Select the check box(es) for the target area(s) of the email message to
scan.
Available targets are:35-3

Trend Micro Apex Central™ Widget and Policy Management Guide• Header (From, To, and Cc)• Subject• Body• Attachment
4.

Select templates from the list of available templates and click Add >> toapply the templates to the policy.
Note
A Data Loss Prevention policy requires selecting at least one template
before activation.

5.

In the Available DLP Template(s) toolbar, click Add to create a new
template or click Import to import a template file.

Configuring DLP Actions
Procedure
1.

Go to the Data Loss Prevention Policies screen by navigating to thefollowing:• For Real-time scans: Data Loss Prevention > DLP Policies• For Manual scans: Manual Scan > Data Loss Prevention• For Scheduled scans: Scheduled Scan > [Add or Edit] > Data Loss
Prevention2.

Add or edit a policy or exception:• For new policies or exceptions:a. Click Add.
b. Go to the Specify Action screen.
• For preexisting policies or exceptions:35-4

ScanMail for Microsoft Exchange Policy Settings

a. Click the policy or exception name.
b. Click the Action tab.
3.

Select an action for Apex Central to take when it detects undesirable
content.

4.

To notify specific individuals:• Select the check box Forward to sender’s manager.
• Select the check box Forward to specific email address(es) andtype the email address of the recipients.

5.

Specify whether to send notifications when an action is taken by
selecting Notify or Do not notify.

6.

Configure Advanced Options as necessary.

Configuring DLP Notifications
Procedure
1.

Go to the Data Loss Prevention Policies screen by navigating to thefollowing:• For Real-time scans: Data Loss Prevention > DLP Policies• For Manual scans: Manual Scan > Data Loss Prevention• For Scheduled scans: Scheduled Scan > [Add or Edit] > Data Loss
Prevention2.

Add or edit a policy or exception:• For new policies or exceptions:a. Click Add.
b. Go to the Specify Notification screen.
• For preexisting policies or exceptions:35-5

Trend Micro Apex Central™ Widget and Policy Management Guide

a. Click the policy or exception name.
b. Click the Notification tab.
3.

Click the check boxes corresponding to the people Apex Central will
notify.

4.

Click Show details to customize the notification for that recipient.

5.

Select from the notification options.

6.

Click Write to Windows event log to have Apex Central write thenotification to a Windows event log.

Enabling a DLP Policy
Procedure
1.

Go to the Data Loss Prevention Policies screen by navigating to thefollowing:• For Real-time scans: Data Loss Prevention > DLP Policies• For Manual scans: Manual Scan > Data Loss Prevention• For Scheduled scans: Scheduled Scan > [Add or Edit] > Data Loss
Prevention2.

Add or edit a policy before enabling:• For new policies:
a. Click Add.
b. Go to the Name and Priority screen.
• For pre-existing policies:
Click the policy name.

35-6

3.

Select to enable this policy or exception.

4.

Type the name of your policy in the Policy name space.

ScanMail for Microsoft Exchange Policy Settings

5.

Specify the priority.
• For new policies:
Type the priority of your policy in the Priority space.
• For preexisting policies:
a. Select the check box next to the policy or exception name in thelist.
b. Click Reorder.
c. Type the priority number in the Priority field.
d. Click Save Reorder.

6.

Click Save.

35-7

Part XV
Smart Protection Server Widgets

Chapter 36

Smart Protection Server Dashboard
Widgets
This section contains help topics for the Smart Protection Server dashboard
widgets supported in Apex Central.
Topics include:

36-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Active Users for File Reputation
The Active Users widget displays the number of users that have made file
reputation queries to the Smart Protection Server. Each unique clientcomputer is considered an active user.
Note
This widget displays information in a 2-D graph and is updated every hour or
click the refresh icon ( ) at any time to update the data.
Table 36-1. Widget Data
Description

Data
Users

The number of users that sent queries to Smart Protection Serverr
computers.

Date

The date of the query.

Active Users for Web Reputation
The Active Users widget displays the number of users that have made web
reputation queries to the Smart Protection Server. Each unique clientcomputer is considered an active user.
Note
This widget displays information in a 2-D graph and is updated every 5
minutes or click the refresh icon ( ) at any time to update the data.
Table 36-2. Widget Data
Description

Data

36-2

Users

The number of users that sent queries to Smart Protection Server
computers.

Date

The date of the query.

Smart Protection Server Dashboard Widgets

HTTP Traffic Report for File Reputation
The HTTP Traffic Report widget displays the total amount of network trafficin kilobytes (KB) that has been sent to the Smart Protection Server from file
reputation queries generated by clients. The information in this widget is
updated hourly. You can also click the refresh icon ( ) at any time to update
the data.
Table 36-3. Widget Data
Data

Description

Traffic (KB)

The network traffic generated by queries.

Date

The date of the queries.

HTTP Traffic Report for Web Reputation
The HTTP Traffic Report widget displays the total amount of network trafficin kilobytes (KB) that has been sent to the Smart Protection Server from web
reputation queries generated by clients. The information in this widget is
updated hourly. You can also click the refresh icon ( ) at any time to update
the data.
Table 36-4. Widget Data
Description

Data
Traffic (KB)

The network traffic generated by queries.

Date

The date of the queries.

Real Time Status
Use the real time status widget to monitor the Smart Protection Server status.

36-3

Trend Micro Apex Central™ Widget and Policy Management Guide

Note
When this widget displays on the Summary screen, the product console
session will not expire. The Computer Status is updated every minute whichmeans the session will not expire due to the requests sent to the server.
However, the session will still expire if the tab that is currently displayed does
not contain this widget.
Table 36-5. Widget Data
Data

Description

Service

Services provided by the Smart Protection Server.

ProtocolThis displays the protocols supported by services. File reputation
supports both HTTP and HTTPS protocols. Web reputation supports
HTTP. HTTPS provides a more secure connection while HTTP uses lessbandwidth.

Host

File reputation and Web reputation service addresses. These addresses
are used with Trend Micro products that support Smart Protection
Server computers. The addresses are used for configuring connections
to Smart Protection Server computers.

Computer Status

The following items are displayed under Health Status:• File Reputation Query: displays whether File reputation isfunctioning as expected.
• Web Reputation Query: displays whether Web reputation isfunctioning as expected.
• ActiveUpdate: displays whether ActiveUpdate is functioning as
expected.
• Average CPU load: displays the computer load average for the past
1, 5, and 15 minutes generated by the kernel.
• Free memory: displays the available physical memory on thecomputer.
• Swap disk usage: displays the swap disk usage.
• Free space: displays the available free disk space on the computer.

36-4

Smart Protection Server Dashboard Widgets

Top 10 Infected Computers for File Reputation
This widget displays the top 10 computer IP addresses which have beenclassified as infected computers after Smart Protection Server receives aknown virus from file reputation query. Information in this widget isdisplayed in a table, which includes the computer IP address and the total
number of detections on each computer. The information in this widget is
updated hourly or you can click the refresh icon ( ) at any time to update
the data.
Use this widget to track computers with the most number of infections on
your network.
Note
If you enable more than one Smart Protection Server in this widget, thiswidget will calculate the total number of detections on the selected SmartProtection Server and display the top 10 infected computers from the selected
Smart Protection Server computers in the list.
Table 36-6. Widget Data
Data

Description

IP

The IP address of the computer.

Detections

The number of security threats detected by this computer.

Top 10 Blocked Computers for Web Reputation
This widget displays the top 10 computer IP addresses which have beenclassified as blocked computers after the Smart Protection Server receives a
URL for web reputation query. Information in this widget is displayed in atable, which includes the computer IP address and the total number ofblocked URLs on each computer. The information in this widget is updated
daily or you can click the refresh icon ( ) at any time to update the data.
Use this widget to track computers who access the most number of blockedsites on your network.
36-5

Trend Micro Apex Central™ Widget and Policy Management GuideNote
If you enable more than one Smart Protection Server in this widget, thiswidget will calculate the total number of detections on the selected SmartProtection Server and display the top 10 blocked computers from the selected
Smart Protection Server computers in the list.
Table 36-7. Widget Data
Data

36-6

Description

IP

The IP address of the computer.

Detections

The number of blocked URLs from this computer.

Part XVI
Trend Micro Mobile Security
Widgets and Policies

Chapter 37

Trend Micro Mobile Security Dashboard
Widgets
This section contains help topics for the Trend Micro Mobile Security
dashboard widgets supported in Apex Central.
Topics include:

37-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Android Device Health Status
This widget displays a summary of the health status of registered Android
mobile devices.
A status of Healthy indicates that the Android mobile device is enrolled to
the Mobile Security Management Server, and all components and policies on
the Android mobile device are up-to-date.
StatusDescription

Healthy

Number of Android mobile devices that are healthy

Unhealthy

Number of Android mobile devices that are unhealthy

Select All or the group name from the drop-down list to display the
information of the relevant devices.

Android Device Encryption Status Summary
WidgetThis widget displays a summary of the encryption status of registered
Android mobile devices.
StatusDescription

Encrypted

Number of Android mobile devices that are encrypted

Not Encrypted

Number of Android mobile devices that are not encrypted

Select All or the group name from the drop-down list to display the
information of the relevant devices.

Android Device Operating System Version
Summary Widget
This widget displays a summary of the operating system versions installed onregistered Android mobile devices.

37-2

Trend Micro Mobile Security Dashboard Widgets

Select All or the group name from the drop-down list to display the
information of the relevant devices.

Android Device Rooted Status Summary Widget
This widget displays a summary of the rooted status of registered Android
mobile devices.
StatusDescription

RootedNumber of mobile devices that are rooted

Not Rooted

Number of mobile devices that are not rooted

Select All or the group name from the drop-down list to display the
information of the relevant devices.

Android Device Security Status Widget
This widget displays a summary of the security status of registered Android
mobile devices.
• Not scanned• Risky• Protected• Dangerous
Select All or the group name from the drop-down list to display the
information of the relevant devices.

Android Malware Scan Summary Widget
This widget displays a summary of the Malware Scan results for all installed
Android apps.
The widget groups the results into the following categories:• Unknown
37-3

Trend Micro Apex Central™ Widget and Policy Management Guide• Potentially Unwanted Objects• Normal• Malware
Select All or the group name from the drop-down list to display the
information of the relevant devices.

Android Modified App Scan Summary Widget
This widget displays a summary of the Modified App scan results for all
installed Android apps.
The widget groups the results into the following categories:• Unknown• Modified• Not Modified
Select All or the group name from the drop-down list to display the
information of the relevant devices.

Android Privacy Data Leak Scan Summary Widget
This widget displays a summary of the Privacy Scan results for all installed
Android apps.
The widget groups the results into the following categories:• Unknown• Potentially Unwanted Objects• Normal• Malware
Select All or the group name from the drop-down list to display the
information of the relevant devices.

37-4

Trend Micro Mobile Security Dashboard Widgets

Android Vulnerability Scan Summary Widget
This widget displays a summary of the Vulnerability Scan results for all
installed Android apps.
The widget groups the results into the following categories:• Unknown• Normal• High• Medium
Select All or the group name from the drop-down list to display the
information of the relevant devices.

Components Update Status Widget
This widget displays a summary of the device update status of registeredmobile devices.
ColumnDescription

Current Version

Current version number of the Mobile Device Agent or components on
the Mobile Security Management Server

Up-to-date

Number of mobile device with updated Mobile Device Agent versions
or components

Out-of-date

Number of mobile devices that are using out-of-date components

Update Rate

Percentage of mobile devices using the latest component versions

UpgradedNumber of mobile devices using the latest Mobile Device Agentversions

Not Upgraded

Number of mobile devices that have not upgraded to use the latest
Mobile Device Agent versions

Upgrade Rate

Percentage of mobile devices using the latest Mobile Device Agents

37-5

Trend Micro Apex Central™ Widget and Policy Management Guide

Cyber Security News for Mobile Widget
This widget displays cyber security news related to mobile devices, publishedby Trend Micro. .

iOS Device Encryption Status Summary Widget
This widget displays a summary of the encryption status of registered iOS
mobile devices.
StatusDescription

Encrypted

Number of iOS mobile devices that are encrypted

Not Encrypted

Number of iOS mobile devices that are not encrypted

Select All or the group name from the drop-down list to display the
information of the relevant devices.

iOS Device Health Status Widget
This widget displays a summary of the health status of registered iOS mobile
devices.
A status of Healthy indicates that the iOS mobile device is enrolled to the
Mobile Security Management Server, and all components and policies on the
iOS mobile device are up-to-date.
StatusDescription

Healthy

Number of iOS mobile devices that are healthy

Unhealthy

Number of iOS mobile devices that are unhealthy

Select All or the group name from the drop-down list to display the
information of the relevant devices.

iOS Device Security Status Widget
This widget displays a summary of the security status of registered iOS
mobile devices.
37-6

Trend Micro Mobile Security Dashboard Widgets• Not scanned• Risky• Protected• Dangerous
Select All or the group name from the drop-down list to display the
information of the relevant devices.

iOS Device Jailbreak Status Summary Widget
This widget displays a summary of the jailbreak status of registered iOS
mobile devices.
StatusDescription

Jailbroken

Number of mobile devices that are jailbroken

Not Jailbroken

Number of mobile devices that are not jailbroken

Select All or the group name from the drop-down list to display the
information of the relevant devices.

iOS Device Operating System Version Summary
WidgetThis widget displays a summary of the operating system versions installed onregistered iOS mobile devices.
Select All or the group name from the drop-down list to display the
information of the relevant devices.

iOS Malware Scan Summary Widget
This widget displays a summary of the Malware Scan results for all installed
iOS apps.
The widget groups the results into the following categories:

37-7

Trend Micro Apex Central™ Widget and Policy Management Guide• Unknown• Malware• Normal
Select All or the group name from the drop-down list to display the
information of the relevant devices.

Mobile Device App Control Status Summary Widget
This widget displays a summary of the application control status ofregistered mobile devices.
StatusDescription

CompliantNumber of mobile devices that comply with the Mobile Security’scompliance and application control policy

Not Compliant

Number of mobile devices that do not comply with the Mobile
Security’s compliance and application control policy

Select All or the group name from the drop-down list to display the
information of the relevant devices.

Mobile Device Encryption Status Summary Widget
This widget displays a summary of the encryption status of registered mobile
devices.
StatusDescription

Encrypted

Number of mobile devices that are encrypted

Not Encrypted

Number of mobile devices that are not encrypted

Select All or the group name from the drop-down list to display the
information of the relevant devices.

37-8

Trend Micro Mobile Security Dashboard Widgets

Mobile Device Health Status Widget
This widget displays a summary of the health status of registered mobile
devices.
StatusDescription

HealthyDevice is enrolled to the Mobile Security Management Server, and thecomponents and policies on the mobile device are up-to-date

Non-Compliant

Device is enrolled to the Mobile Security Management Server, but does
not comply with the server policies

Out of Sync

Device is enrolled to the Mobile Security Management Server, buteither the components or the polices are out-of-date

Inactive

Device is not yet enrolled to the Mobile Security Management Server

Select All or the group name from the drop-down list to display the
information of the relevant devices.

Mobile Device Jailbreak Status Summary Widget
This widget displays a summary of the jailbreak status of registered mobile
devices.
StatusDescription

Jailbroken

Number of mobile devices that are jailbroken

Not Jailbroken

Number of mobile devices that are not jailbroken

Select All or the group name from the drop-down list to display the
information of the relevant devices.

Mobile Device Operating System Version Summary
WidgetThis widget displays a summary of the operating system versions installed onregistered mobile devices.

37-9

Trend Micro Apex Central™ Widget and Policy Management Guide

Operating System

Description

Android

Number of registered Android mobile devices

iOS

Number of registered iOS mobile devices

Windows Phone

Number of registered Windows Phone mobile devices

Select All or the group name from the drop-down list to display the
information of the relevant devices.

Mobile Device Ransomware Scan Summary Widget
This widget displays a summary of the ransomware scan results for all
installed apps.
The widget groups the results by mobile operating system.
Select All or the group name from the drop-down list to display the
information of the relevant devices.

Mobile Device Security Status Widget
This widget displays a summary of the security status of registered mobile
devices.
• Not scanned• Risky• Protected• Dangerous
Select All or the group name from the drop-down list to display the
information of the relevant devices.

Mobile Device Vendors Summary Widget
This widget displays a summary of the mobile device vendors for registeredmobile devices.
37-10

Trend Micro Mobile Security Dashboard Widgets

Select All or the group name from the drop-down list to display the
information of the relevant devices.

Policy Update Status Summary Widget
This widget displays a summary of the policy update status of registeredmobile devices.
StatusDescription

Up-to-date

Number of mobile devices running with an updated Mobile Device
Agent version or components

Out-of-date

Number of mobile devices that are running with out-of-datecomponents

Select All or the group name from the drop-down list to display the
information of the relevant devices.

Server Component Health Status Summary Widget
This widget displays the server components update status and their version
numbers.
Description

ColumnServerName of the module

Address

Domain name or IP address of the machine hosting the module

Current Version

Version number of the Mobile Security Management Server modules
installed

Last Updated

Time and date of the last update

Telephone Carriers Summary Widget
This widget displays a summary of telephone carriers used by registered
Android mobile devices.

37-11

Trend Micro Apex Central™ Widget and Policy Management Guide

Select All or the group name from the drop-down list to display the
information of the relevant devices.

Top 10 Applications Installed Widget
This widget displays the list of top ten applications installed on registeredmobile devices. Select All or the group name from the drop-down list to
display the information of the relevant devices.

Top Five Android Ransomware Detected Widget
This widget displays the list of top five Android ransomware detected by
Mobile Security, based on the number of times the specified ransomware
was detected. Select All or the group name from the drop-down list to display
the information of the relevant devices.

Top Five Blocked Web Sites Widget
This widget displays the list of top five web sites blocked by Mobile Security,
based on the number of times each site was accessed. Select All or the groupname from the drop-down list to display the information of the relevant
devices.

Top Five iOS Ransomware Detected
This widget displays the list of top five iOS ransomware detected by Mobile
Security, based on the number of times the specified ransomware was
detected. Select All or the group name from the drop-down list to display the
information of the relevant devices.

Top Five Malware Detected Widget
This widget displays the list of the top five malware detected by Mobile
Security, based on the number of times the specified malware was detected.
Select All or the group name from the drop-down list to display the
information of the relevant devices.

37-12

Trend Micro Mobile Security Dashboard Widgets

Windows Phone Device Encryption Status
Summary Widget
This widget displays a summary of the encryption status of registered
Windows Phone mobile devices.
StatusDescription

Encrypted

Number of Windows Phone mobile devices that are encrypted

Not Encrypted

Number of Windows Phone mobile devices that are not encrypted

Select All or the group name from the drop-down list to display the
information of the relevant devices.

Windows Phone Device Health Status Widget
This widget displays a summary of the health status of registered Windows
Phone mobile devices.
A status of Healthy indicates that the Windows Phone mobile device isenrolled to the Mobile Security Management Server, and all components andpolicies on the Windows Phone mobile device are up-to-date.
StatusDescription

Healthy

Number of Windows Phone mobile devices that are healthy

Unhealthy

Number of Windows Phone mobile devices that are unhealthy

Select All or the group name from the drop-down list to display the
information of the relevant devices.

Windows Phone Device Operating System Version
Summary Widget
This widget displays a summary of the operating system versions installed onregistered Windows Phone mobile devices.

37-13

Trend Micro Apex Central™ Widget and Policy Management Guide

Select All or the group name from the drop-down list to display the
information of the relevant devices.

37-14

Chapter 38

Trend Micro Mobile Security Policy
Settings
This section discusses how to configure security policies for Mobile Security
from the Apex Central management console.

38-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Protecting Devices with Policies
You can configure security policies for a Mobile Security group on theManagement Server. These policies apply to all mobile devices in the group.
You can apply security policies to all Mobile Security groups by selecting the
Mobile Devices group (the root group). The following table lists the security
policies available in Mobile Security.
Table 38-1. Security Policies in Mobile Security
Policy Group
General

PolicyCommon Policy

Reference
For Full Version Deployment Mode,
see Common Policy in Full Version
Deployment Mode on page 38-4.
For Security Scan Deployment
Mode, see Common Policy in
Security Scan Deployment Mode on
page 38-5.

Provisioning

38-2

Wi-Fi Policy

See Wi-Fi Policy on page 38-5.

Exchange ActiveSync Policy

See Exchange ActiveSync Policy on
page 38-5.

Certificate Policy

See Certificate Policy on page
38-5.

VPN Policy

See VPN Policy on page 38-6.

Global HTTP Proxy Policy

See Global HTTP Proxy Policy on
page 38-6.

Single Sign-On Policy

See Single Sign-On Policy on page38-6.

Cellular Network Policy

See Cellular Network Policy on
page 38-7.

AirPlay/AirPrint Policy

See AirPlay/AirPrint Policy on page
38-7.

Theme Policy

See Theme Policy on page 38-7.

Trend Micro Mobile Security Policy Settings

Policy Group

Device Security

PolicyReferenceManaged Domains Policy

See Managed Domains Policy on
page 38-8.

Security Policy

For Security Policy in Full Version
Deployment Mode, see Security
Policy in Full Version Deployment
Mode on page 38-8.
For Security Policy in Security Scan
Deployment Mode, see Security
Policy in Security Scan Deployment
Mode on page 38-10.

Devices

Application
Management

Samsung KNOX

Spam Prevention Policy

See Spam Prevention Policy on
page 38-12.

Call Filtering Policy

See Call Filtering Policy on page38-15.

Web Threat Protection Policy

See Web Threat Protection Policy
on page 38-17.

Password Policy

See Password Policy on page38-19.

Feature Lock Policy

See Feature Lock Policy on page38-20.

Compliance Policy

See Compliance Policy on page
38-29.

Application Monitor & Control
PolicySee Application Monitor andControl Policy on page 38-29.

Volume Purchasing Program
PolicySee Volume Purchasing Program
Policy on page 38-32.

Container Policy

See Container Policy on page38-35.

38-3

Trend Micro Apex Central™ Widget and Policy Management Guide

Common Policy in Full Version Deployment Mode
Common Policy provides the common security policies for mobile devices.
To configure common security policy settings, click Policies, then click thepolicy name, and then click Common Policy.
• User Privileges: You can enable or disable the feature that allows users
to uninstall the Mobile Device Agent. Additionally, you can selectwhether to allow users to configure Mobile Security device agent
settings.
The following is a list of features associated with uninstall protection:• turn On/Off uninstall protection from the administration console• password length must have a minimum of six (6) and a maximum of
twelve (12) characters; password may contain numbers, charactersor symbols.
• password can be set for each group from the administration
console.
If you do not select the Allow users to configure Mobile Security client
settings check box, users cannot change Mobile Device Agent settings.
However, the filtering lists for Spam Prevention Policy, Call Filtering
Policy and Web Threat Protection Policy are not affected when thisoption is selected. For more information, see Spam Prevention Policy on
page 38-12, Call Filtering Policy on page 38-15 and Web Threat Protection
Policy on page 38-17.
• Update Settings: You can select to have the Mobile Security
Management Server notify Mobile Device Agents when a newcomponent is available for update. Or you can select the auto-check
option to have Mobile Device Agents periodically check for any
component or configuration updates on the Mobile Security
Management Server.
• Log Settings: When Mobile Device Agents detect a security risk, such asa malware on Android operating system, a log is generated on themobile device.

38-4

Trend Micro Mobile Security Policy Settings

Common Policy in Security Scan Deployment Mode
Common Policy provides the common security policies for mobile devices.
To configure common security policy settings, click Policies, then click thepolicy name, and then click Common Policy.
• User Privileges:• You can select whether to allow users to configure Mobile Security
device agent settings.
If you do not select the Allow users to configure Mobile Security
client settings check box, users cannot change Mobile Device Agentsettings. However, the filtering lists for Web Threat Protection
Policy are not affected when this option is selected. For more
information, see Web Threat Protection Policy on page 38-17.
• You can select the auto-check option to have Mobile Device Agents
periodically check for any component or configuration updates on
the Mobile Security Management Server.

Wi-Fi Policy
Wi-Fi Policy enables you to deliver your organization's Wi-Fi network
information to Android and iOS mobile devices; including the network
name, security type and password.
To configure Wi-Fi policy settings, click Policies, then click the policy name,and then click Wi-Fi Policy.

Exchange ActiveSync Policy
Exchange ActiveSync Policy enables you to create an Exchange ActiveSync
policy for your organization and deliver it to iOS mobile devices.
To configure Exchange ActiveSync policy settings, click Policies, then click
the policy name, and then click Exchange ActiveSync Policy.

Certificate Policy
Certificate Policy enables you to import certificates that you need to deploy
on iOS mobile devices.
38-5

Trend Micro Apex Central™ Widget and Policy Management Guide

To configure certificate policy settings, click Policies, then click the policy
name, and then click Certificate Policy.

VPN Policy
VPN policy settings enable you to create a VPN Policy for your organizationand deliver it to iOS mobile devices.
To configure VPN policy settings, click Policies, then click the policy name,and then click VPN Policy

Global HTTP Proxy Policy
Global HTTP Proxy Policy enables you to deliver your organization's proxyinformation to mobile devices. This policy only applies to iOS mobile devices
that are in supervised mode.
To configure global HTTP proxy policy settings, click Policies, then click thepolicy name, and then click Global HTTP Proxy Policy

Single Sign-On Policy
Single sign-on (SSO) policy enables the users to use the same credentials
across applications, including Mobile Securityand applications from the App
Store. Each new application configured with SSO certification verifies user
permissions for enterprise resources, and logs users in without requiringthem to reenter their passwords.
The single sign-on policy includes the following information:• Name: the Kerberos principal name.
• Realm: The Kerberos realm name.
The Kerberos ream name should be properly capitalized.
• URL Prefixes (Optional): List of URLs that must be matched in order to
use an account for Kerberos authentication over HTTP. If this field isblank, the account is eligible to match all http and https URLs. The URL
matching patterns must begin with either http or https.
Each entry of this list must contain a URL prefix. Only the URLs thatbegin with one of the strings in an account are allowed to access the38-6Trend Micro Mobile Security Policy Settings

Kerberos ticket. URL matching patterns must include the scheme. For
example, http://www.example.com/. If a matching pattern does not end
in /, it will automatically add a / to the URL.
• Application Identifiers (Optional): List of application identifiers that areallowed to use the account. I f this field is blank, this account matches
all application identifiers.
The Application Identifiers array must contain strings that match
application bundle IDs. These strings may be exact matches (such ascom.mycompany.myapp) or may specify a prefix match on the bundle
ID by using the * wildcard character. The wildcard character must
appear after a period character (.), and may appear only at the end of thestring (such as com.mycompany.*). When a wildcard is used, any
application whose bundle ID begins with the prefix is granted access tothe account.
To configure Single Sign-On Policy for iOS settings, click Policies, then click
the policy name, and then click Single Sign-On Policy.

Cellular Network Policy
Celluar network policy settings enables you to configure cellular network
settings for your organization and deliver it to iOS mobile devices.
To configure the celluar network policy settings, click Policies, then click thepolicy name, and then click Celluar Network Policy.

AirPlay/AirPrint Policy
AirPlay/AirPrint policy settings enable you to create AirPlay and AirPrint
policies for your organization and deliver it to iOS mobile devices.
To configure AirPlay and/or AirPrint policy settings, click Policies, then click
the policy name, and then click AirPlay/AirPrint Policy.

Theme Policy
Theme policy settings enable you to push a font and set a wallpaper for home
screen and lock screen for the iOS mobile devices. This policy applies to iOS
mobile devices that are in the supervised mode only.
38-7

Trend Micro Apex Central™ Widget and Policy Management Guide

To configure theme policy settings, click Policies, then click the policy name,and then click Theme Policy.

Managed Domains Policy
Managed domains policy enables you to configure the email and/or web
domains that your organization manages.
• Unmarked Email Domains: When a user is composing an email using
the system email client, any email address entered which does notmatch the configured domains will be highlighted (marked) in red.
Administrators should consider using this functionality, to warn users
who may be inadvertently attempting to send sensitive information to
untrusted email addresses.
• Managed Safari Web Domains: You can specify that files downloaded
from specific domains using Safari may only be opened with managed
apps. For example, a PDF downloaded from internal.example.com may
be opened with Adobe Reader (a managed app) but not Dropbox (anunmanaged app). This provides improved containerization of Safari andwider the use as an enterprise browser.
Important
You must disable the following iOS features in the Feature Lock Policy.
Otherwise, the managed Safari Web domains settings will not have any
effect, since the downloaded files can be opened with other (unmanaged)
apps:• Open documents from managed apps in other apps (7.0 or above)• Open documents from other apps in managed apps (7.0 or above)

To configure managed domain policy settings, click Policies, then click thepolicy name, and then click Managed Domain Policy.

Security Policy in Full Version Deployment Mode
You can configure the Security Settings from the Security Policy screen.

38-8

Trend Micro Mobile Security Policy Settings

To configure the security protection policy settings, click Policies, click thepolicy name, and then click Security Policy.
The following table describes the available settings for this policy.
Table 38-2. Security Policy Settings
SectionSecurity Settings

Item

Description

Scan installed
applications only

Select this option if
you want to scan
installed applications
only

Scan installed
applications andfiles

Select this option if
you want to scan
installed applications
and other files stored
on the mobile device.

Supported Mobile
Device OS

If you select thisoption, specify
whether you want toscan only APK files or
all files.
Scan after pattern
updateEnable this option if
you want to run themalware scan after
every pattern update.
Mobile Security runsa scan automaticallyafter successful
pattern update on
Android mobile
devices.

Enable Facebook
scan

Enable this option toscan the Facebook
privacy settings.

38-9

Trend Micro Apex Central™ Widget and Policy Management Guide

Section

Item

Description

Supported Mobile
Device OS

Note
Enabling
Facebookscan allows
users toprotect theirinformationand makesure thatthey only
share datawith people
they trust.
Scan Schedule

Daily

The scan runs every
day on the specified
day at the Start time.

WeeklyThe scan runs once aweek on the specified
day at the Start time.

Monthly

The scan runs once amonth on thespecified day at theStart time.

Security Policy in Security Scan Deployment Mode
You can configure the Security Settings from the Security Policy screen.
To configure the security protection policy settings, click Policies, click thepolicy name, and then click Security Policy.
The following table describes the available settings for this policy.

38-10

Trend Micro Mobile Security Policy Settings

Table 38-3. Security Policy Settings
SectionSecurity Settings

Item

Description

Scan installed
applications only

Select this option if
you want to scan
installed applications
only

Scan installed
applications andfiles

Select this option if
you want to scan
installed applications
and other files stored
on the mobile device.

Supported Mobile
Device OS

If you select thisoption, specify
whether you want toscan only APK files or
all files.
Scan after pattern
updateEnable this option if
you want to run themalware scan after
every pattern update.
Mobile Security runsa scan automaticallyafter successful
pattern update on
Android mobile
devices.

Scan Schedule

Daily

The scan runs every
day on the specified
day at the Start time.

WeeklyThe scan runs once aweek on the specified
day at the Start time.

Monthly

The scan runs once amonth on the

38-11

Trend Micro Apex Central™ Widget and Policy Management Guide

Section

Item

Description

Supported Mobile
Device OS

specified day at theStart time.

Spam Prevention Policy
The spam prevention policy in Mobile Security provides protection against
spam WAP push and SMS text messages.
To configure spam prevention policy settings, click Policies, then click thepolicy name, and then click Spam Prevention Policy.

Spam SMS Prevention Policies
This feature provides you server-side control of SMS spam prevention
policies. The following features are available when configuring the SMS
Spam Prevention Policies:• enable or disable spam SMS prevention for mobile device• configure the mobile device to use a blocked list, approved list or disable
the SMS anti-spam feature for mobile device.
• configure an approved list from the administration console• configure a blocked list from the administration console
Refer to the following table for approved or blocked filtering list
configuration details.

38-12

Trend Micro Mobile Security Policy Settings

Table 38-4. Filtering list configuration for Spam SMS Prevention Policy
CentralControl
Disabled

User Control
EnabledDescription
The user can edit the approved/blocked list on themobile device agent.
Mobile Security allows or blocks the messages basedon the following priority:
1. Approved List on Mobile Device Agent
2. Blocked List on Mobile Device Agent

EnabledDisabled

The user is only allowed to edit the approve/blocked
list on the mobile device agent.
Mobile Security allows or blocks the messages basedon the following priority:
1. Approved List or Blocked List on server
2. Approved List on Mobile Device Agent
3. Blocked List on Mobile Device Agent

EnabledEnabledThe user can view or edit the approved/blocked list
defined by the administrator and can also use theapproved/blocked list on the mobile device agent.
When the security policies sync with the mobile device
agent, it does not sync the filtering lists, and updates
all other settings according to the policies.
Mobile Security allows or blocks the messages basedon the following priority:
1. Approved List on Mobile Device Agent
2. Blocked List on Mobile Device Agent
3. Approved List or Blocked List on server

38-13

Trend Micro Apex Central™ Widget and Policy Management Guide

Note
The SMS approved and blocked list must use the format: "[name1:]number1;[name2:]number2;...".
The 'name' length should not exceed 30 characters, while phone number
should be between 4 and 20 characters long and can contain the following:
0-9, +, -, #, (, ) and spaces. The maximum number of entries should not exceed
200.

Spam WAP Push Prevention Policies
This feature provides you server-side control of WAP Push Prevention. If
enabled, you can select whether to use a WAP approved list.
Note
The WAP approved list must use the format: "[name1:]number1;[name2:]number2;...".
The 'name' length should not exceed 30 characters, while phone number
should be between 4 and 20 characters long and can contain the following:
0-9, +, -, #, (, ) and spaces. The maximum number of entries should not exceed
200.

The following is a list of features available when configuring WAP Push
Prevention policies:• enable or disable WAP Push Prevention for mobile device• configure the mobile device to use an approved list or disable WAP Push
Prevention on the mobile device• configure an approved list from the administration console• if the administrator has enabled server-side control, the user will be
unable to change the WAP Push Prevention type defined by theadministrator

38-14

Trend Micro Mobile Security Policy Settings• if the administrator has disable server-side control, and allowed users to
configure Mobile Security settings on mobile device, the user will be
unable to view or edit the WAP Push Prevention list configured by theadministrator, and may edit the personal WAP Push Prevention list on
the mobile device side
Note
The users' personal settings for spam messages will be cleared after the Spam
Prevention Policy is applied on the Mobile Device Agents.

Call Filtering Policy
This feature provides you server-side control of call filtering policies. To
configure call filtering policy settings, click Policies, then click the policy
name, and then click Filtering Policy.
The following features are available when configuring the Call Filtering
Policies:• enable or disable call filtering for mobile device• configure the mobile device to use a blocked list or an approved list
• configure an approved list from the administration console• configure a blocked list from the administration console
Refer to the following table for approved or blocked filtering list
configuration details.

38-15

Trend Micro Apex Central™ Widget and Policy Management Guide

Table 38-5. Filtering list configuration for Call Filtering Policy
CentralControl
Disabled

User Control
EnabledDescription
The user can edit the approved/blocked list on themobile device agent.
Mobile Security allows or blocks the URLs based on thefollowing priority:
1. Approved List on Mobile Device Agent
2. Blocked List on Mobile Device Agent

EnabledDisabled

The user is only allowed to edit the approved/blocked
list on the mobile device agent.
Mobile Security allows or blocks the incoming calls
based on the following priority:
1. Blocked List on server
2. Approved List on Mobile Device Agent
3. Blocked List on Mobile Device AgentYou can also configure server-side control for outgoingcalls on Android mobile devices.

EnabledEnabledThe user can view or edit the approved/blocked list
defined by the administrator and can also use theapproved/blocked list on the mobile device agent.
When the security policies sync with the mobile device
agent, it does not sync the filtering lists, and updates
all other settings according to the policies.
Mobile Security allows or blocks the incoming calls
based on the following priority:
1. Approved List on Mobile Device Agent
2. Blocked List on Mobile Device Agent
3. Blocked List on server
You can also configure server-side control for outgoingcalls on Android mobile devices.

38-16

Trend Micro Mobile Security Policy Settings

Note
The call filtering approved and blocked list must use the format:"[name1:]number1;[name2:]number2;...".
The 'name' length should not exceed 30 characters, while phone number
should be between 4 and 20 characters long and can contain the following:
0-9, +, -, #, (, ) and spaces. The maximum number of entries should not exceed
200.

Web Threat Protection Policy
Enables you to manage Web threat protection policy from the Mobile
Security Management Server and deploys it on Android mobile devices. It
also enables Android mobile devices to send the Web threat protection log
back to the server.
Note
Mobile Security Web Threat Protection only supports the default Android
browser and Google Chrome.

To configure Web Threat Protection Policy settings, click Policies, then click
the policy name, and then click Web Threat Protection Policy.

Web Threat Protection for Android Mobile Devices
Web Threat Protection feature provides you the server-side control of Web
threat protection policies on Android mobile devices and provides three predefined security levels: Low, Normal, and High. It also provides blocked andapproved lists to block or allow certain URLs. Mobile Security will block all
the URLs that you add in the Blocked List, and allow all URLs that are in the
Approved List.
Note
The Web threat protection policy only supports Google Chrome and Android’s
default Web browser on mobile devices.

38-17

Trend Micro Apex Central™ Widget and Policy Management Guide

Refer to the following table for approved or blocked filtering list
configuration details.
Table 38-6. Filtering list configuration for Web Threat Protection policy
ServerControl
Disabled

User Control
EnabledDescription
The user can edit the approved/blocked list on themobile device agent.
Mobile Security allows or blocks the URLs based on thefollowing priority:
1. Approved List on Mobile Device Agent
2. Blocked List on Mobile Device Agent

EnabledDisabled

The user is only allowed to edit the approved/blocked
list on the mobile device agent.
Mobile Security allows or blocks the URLs based on thefollowing priority:
1. Approved List on server
2. Blocked List on server
3. Approved List on Mobile Device Agent
4. Blocked List on Mobile Device Agent

EnabledEnabledThe user can view or edit the approved/blocked list
defined by the administrator and can also use theapproved/blocked list on the mobile device agent.
When the security policies sync with the mobile device
agent, it does not sync the filtering lists, and updates
all other settings according to the policies.
Mobile Security allows or blocks the URLs based on thefollowing priority:
1. Approved List on Mobile Device Agent
2. Blocked List on Mobile Device Agent
3. Approved List on server
4. Blocked List on server

38-18

Trend Micro Mobile Security Policy Settings

Note
The Web threat filtering approved and blocked lists must use the following
format: [URL1] [URL2] [URL3], with a blank space or a line break between two
URLs.

Web Threat Protection for iOS Mobile Devices
Web Threat Protection provides you the server-side control on supervised
iOS mobile devices by providing access to the following:• Specific websites only
• Limited adult content
Refer to the following table for the feature details:
Table 38-7. Filtering list configuration for Web Threat Protection policy
FeatureDescription

Specific websites only

Using this option will restrict the access to only the websites that you
have configured on the server.
You can add the URLs that you want to allow, on the iOS tab of the
Web Threat Protection Policy. These URLs will be added to the Safari
Web browser on the users' iOS mobile devices.

Limited adult content

This option uses filtering lists to provide server control of thewebsites that you want to allow or block on iOS mobile devices.
These filters block or allow the access of the websites irrespective ofthe default filter settings on iOS mobile devices.

Note
The Web threat filtering approved and blocked lists must use the following
format: [URL1] [URL2] [URL3], with a blank space or a line break between two
URLs.

Password Policy
The password policy prevents unauthorized access to data on mobile
devices.
38-19

Trend Micro Apex Central™ Widget and Policy Management Guide

To configure password policy settings, click Policies, then click the policy
name, and then click Password Policy from the left-menu.

Feature Lock Policy
With this feature, you can restrict (disable) or allow (enable) the use ofcertain mobile device features/components. For example, you can disable
the camera for all mobile devices in a particular group.
To configure Feature Lock Policy settings, click Policies, then click the policy
name, and then click Feature Lock Policy from the left-menu.
See Supported Mobile Device OS Features on page 38-20 for the list of
supported features/components.
WARNING!
Use caution while disabling WLAN/WIFI and/or Microsoft ActiveSync. The
mobile device may not be able to communicate with the server if both these
options are unavailable.

For Android mobile devices, you can also add access point(s) to control theavailability of the device components within the range of those accesspoint(s).

Supported Mobile Device OS Features
The following table shows the list of features that Mobile Security supports
on each platform.
Table 38-8. Trend Micro Mobile Security 9.7 Feature Matrix
Features

PolicyProvisioning

Wi-Fi

Settings
Standard Wi-Fi configuration
Legacy hotspot configuration
Hotspot 2.0 configuration

38-20

Trend Micro Mobile Security Policy Settings

PolicyFeatures

Settings

Exchange ActiveSync

Exchange ActiveSync
configuration

VPN

VPN configuration

Global HTTP Proxy

Global HTTP Proxy
configuration

Single Sign-on

Single sign-on configuration

Certificate

Certificate configuration

Cellular network

Cellular network configuration

AirPlay/AirPrint

AirPlay/AirPrint configuration

Themes (Supervised
only)

Wallpaper configuration

Managed Domains

Font configuration
Unmarked Email Domains
Managed Safari Web Domains

Device Security

Security Settings

Real-time scan
Scan after pattern update
Manual scan
Facebook scan

Data Protection

Spam SMS
Prevention

Server-side control
Use blocked list
Use approved list

Spam WAP Push
Prevention

Server-side control
Use approved list

38-21

Trend Micro Apex Central™ Widget and Policy Management Guide

PolicyFeatures
Call Filtering

Settings
Server-side control
Use blocked list
Use approved list

Web ThreatProtection

Server-side control
Use blocked list
Use approved list
Allow specific websites only
Allow limited adult content

Data Protection

Password Settings

Use password for login
Allow simple password
Require alphanumericpassword
Minimum password length
Password expiration
Password history
Auto-lockPassword failure action

Feature Lock

CameraFaceTime
Screen captureApps installation
Sync while roaming

38-22

Trend Micro Mobile Security Policy Settings

PolicyFeatures

Settings
Voice dialing
In-app purchase
Multiplayer gaming
Adding game center friends
Game Center (Supervised Only)
Force encrypted backups
Explicit music, podcast andiTunes U
Passbook while device is locked
Bluetooth and Bluetooth
discovery
WLAN/Wi-Fi
3G data network
Tethering
Developer mode
Speaker/speakerphone/microphone
Restrict memory cards
Siri
Siri while device is locked
Enable profnity filter
Enable access to iCloud services
Cloud backup

38-23

Trend Micro Apex Central™ Widget and Policy Management Guide

PolicyFeatures

Settings
Cloud document sync
Photo Stream
Shared Photo Streams
Diagnostic data
Accept untrusted Transport
Layer Security (TLS)
Force iTunes to store password
YouTubeOpen documents frommanaged apps in other apps
Open documents from otherapps in managed apps
iTunes
Safari Web browser
AutoFill
JavaScript
PopupsForce fraud warning
Accept cookies
Removing apps (Supervised
only)Bookstore (Supervised only)
Erotica (Supervised only)

38-24

Trend Micro Mobile Security Policy Settings

PolicyFeatures

Settings
Configuration Profile
Installation (Supervised only)
iMessage (Supervised only)
Ratings region
MoviesTV Shows
Apps
Account modification(Supervised only)
AirDrop (Supervised only)
Applications cellular data
modification (Supervised only)
Assistant (Siri) user-generated
content (Supervised only)
Cloud keychain synchronization
Find My Friends modification(Supervised only)
Fingerprint for unlocking adeviceHost pairing (Supervised only)
Lock screen control center
Lock screen notifications view
Lockscreen today view
Over the Air Public Key
Infrastructure (OTAPKI) updates

38-25

Trend Micro Apex Central™ Widget and Policy Management Guide

PolicyFeatures

Settings
Force limit ad tracking
Force AirPlay outgoing requests
pairing password
Allow managed apps to store
data in iCloud
Allow backup of enterprise
books
Allow configuration restrictions
Allow Erase All Content andSettings
Allow Handoff
Allow Internet results inspotlight
Allow notes and highlights sync
for enterprise books
Allow sharing of managed
documents using AirDrop
Allow iCloud Photo Library
Allow installing apps fromdeviceAllow keyboard shortcuts
Allow paired Apple Watch
Allow passcode modification
Allow device name modification
Allow wallpaper modification

38-26

Trend Micro Mobile Security Policy Settings

PolicyFeatures

Settings
Allow automatic downloadingof appsAllow trusting of enterpriseappsCompliance Settings

Rooted/Jailbroken
Unencrypted
OS version check

Application
Management

Application Monitor& Control

Required Applications
Permitted Applications
Lock to App (Supervised only)

Volume Purchasing
ProgramRemote Control

Volume Purchasing Program

RegisterUpdateAnti-theft

Remote locate
Remote lockRemote wipe
Reset password

Samsung KNOX
Workspace

Create container
Remove container
Lock container
Unlock container
Reset container password

38-27

Trend Micro Apex Central™ Widget and Policy Management Guide

PolicyFeaturesSamsung KNOX
Workspace
PolicyContainer accountsetting
Restriction settings

Settings
Blocked list
Approved list
Allow users to use camera
Allow display the share via listof applications

Browser settings

Enable auto fill setting
Enable cookies setting
Enable popups setting
Enable force fraud warning
setting
Enable JavaScript setting
Enable Web Proxy

Samsung KNOX
Workspace
PolicyContainer password
settings

Enable password visibility
Minimum password change
lengthMinimum password length
Maximum inactivity timeout
Maximum number of failed
attempts
Password history
Maximum password age
Minimum number of special
characters required in a
password

38-28

Trend Micro Mobile Security Policy Settings

PolicyFeatures

Settings
Password complexity

Application settings

Installation approved list
Installation blocked list
Required applications
Disabled applications

Device Enrollment Program

Compliance Policy
Compliance policy enables you to set the compliance criteria for the mobile
devices. If any mobile device does not match the criteria, Mobile Security
displays its non-compliant status on the server UI. Mobile Security also sends
an email to the non-compliant iOS mobile device, while it displays anotification on non-compliant Android mobile devices. The compliancecheck list includes:• Rooted/Jailbroken—checks whether the mobile device is rooted/
jailbroken or not.
• Unencrypted—checks whether the encryption is enabled on the mobile
device or not• OS version check—checks whether the OS version matches the defined
criteria or not.
To configure compliance policy settings, click Policies, then click the policy
name, and then click Compliance Policy.

Application Monitor and Control Policy
Application monitor and control policies provide you server-side control of
the applications installed on mobile devices and push the required
applications to the mobile devices.

38-29

Trend Micro Apex Central™ Widget and Policy Management Guide

To configure application monitor and control policy settings, click Policies,
then click the policy name, and then click Application Monitor and Control
Policy.
• Required Applications—using this option will push all the applications
that you add in the list, to the mobile devices. You can also link a VPN toapplications, so that the applications always use this VPN to connect tothe network.
• Permitted Applications—control the applications installed on mobile
devices by using approved and blocked lists.
For iOS mobile devices, Mobile Security sends notification toadministrator and the user for any application that does not comply withthe policy.
For Android mobile devices, Mobile Security blocks the application that
does not comply with the policy and will allow all others.
• Enable system apps blocking (Android only):
if selected, Mobile Security will block all the system apps on
Android mobile devices.
• Enable Application Category: select the application category thatyou want to enable or disable on mobile devices. You can also makethe exception by adding the applications that belong to thesecategories to the approved or blocked list. For example, if you havedisabled a category type Games, Mobile Security will block all theapplications that belong to this category, unless any suchapplication exists in the approved list.
Mobile Security allows or blocks the applications according to thefollowing priority:
1. Approved List—Mobile Security allows applications that are in
the approved list even if they belong to the category that you
have disabled.
2. Blocked List—Mobile Security blocks applications that are in
the blocked list even if they belong to the category that you
have enabled.
38-30

Trend Micro Mobile Security Policy Settings

3. Application permissions—Mobile Security allows or blocks
applications according to your selected permission status forthe category that they belong to.
• Enable Application Permissions (for Android only): select theapplication services that you want to enable or disable on Android
mobile devices. You can also make the exception by adding theapplications that use these services to the approved or blocked list.
For example, if you have disabled service type Read Data, Mobile
Security will block all the applications that use the Read Data
service, unless any such application exists in the approved list.
Mobile Security allows or blocks the applications according to thefollowing priority:
1. Approved List—Mobile Security allows applications that are in
the approved list even if they use the services that you havedisabled.
2. Blocked List—Mobile Security blocks applications that are in
the blocked list even if they use the services that you haveenabled.
3. Application permissions—Mobile Security allows or blocks
applications according to your selected permission status forthe services that they use.
• Only allow the following applications: add the applications to theapproved list that you want to allow users to use on their mobile
devices. If enabled:• Mobile Security displays a pop-up warning message on Android
mobile devices if it detects applications that are not in theapproved list.
• On iOS mobile devices, if Mobile Security detects any
application that is not in the approved list, Mobile Security
sends an email notification to the user.
• Only block the following applications: add the applications to theblocked list that you do not want users to use on their mobile
devices. If enabled:
38-31

Trend Micro Apex Central™ Widget and Policy Management Guide• Mobile Security displays a pop-up warning message on Android
mobile devices if it detects applications that are in the blocked
list.
• On iOS mobile devices, if Mobile Security detects any
application that is in the blocked list, Mobile Security sends anemail notification to the user.
• Lock to App (for Supervised Mode Only)—restrict the iOS mobile
device to the specified application.
Mobile Security checks for restricted applications and sends email alert tothe users:• automatically according to the Information Collection Frequency
settings in Administration > Communication Server Settings >Common Settings (tab), or• when you update the Information Collection Frequency settings in
Administration > Communication Server Settings > Common Settings(tab).

Volume Purchasing Program Policy
This policy enables the administrator to import the iOS applications to the
Mobile Security administration web console that are purchased through theApple’s Volume Purchase Program. Mobile Security will push all theapplications in the Volume Purchasing Program List to mobile devices in agroup.
To configure Volume Purchasing Program policy:
1. Add applications to the Enterprise App Store. See Adding an Application
on page 38-33 for the procedure.
2. Click Policies, then click the policy name, and then click Volume
Purchasing Program Policy.
3. Click Import and then select applications to import from the Enterprise
App Store.
4. Click Save to push all the applications to the iOS mobile devices.

38-32

Trend Micro Mobile Security Policy Settings

Adding an Application
Procedure
1.

On the Mobile Security administration web console, go to Applications >Enterprise App Store.
The Enterprise App Store screen displays.

2.

Click the Android or iOS tab.

3.

Click Add.
The Add Application window displays.

4.

You can now add an application to the list using one of the following
options:• Add from local computer—select an installation file for Android or
iOS mobile devices.
• Add a Webclip—type the application's URL and the application's
icon will appear on the home screen of user's mobile device, andthe link will open in the default web browser on the mobile device.
• (Android) Add from external application store—type the link to theapplication in an external app store. The application's icon willappear on the home screen of user's mobile device, and the link will
open in the default web browser on the mobile device.
• (iOS) Please input search keyword—type the name of the VPP
application you want to search and select a country to search theapplication in its Apple app store, and then select the application
you want to add from the search results. Once added, the VPP
application is only available in the App Store on Mobile Security
administration web console. To push the application to mobile
devices, you will need to add the application to the Volume
Purchasing Program Policy. See Volume Purchasing Program Policy
on page 38-32 for the procedure.

5.

Click Continue.
The Edit Application screen displays.
38-33

Trend Micro Apex Central™ Widget and Policy Management Guide

6.

Configure the following:• Application name: type a name for the application.
• Application icon: if the application icon does not appear, click
Upload app icon to select and upload the application icon.
• Application ID: if the application ID does not appear, type theapplication ID.
• VPP codes file: For iOS VPP application, upload the Volume
Purchase Code files that you have received from Apple.
• Category: select a category for the application.
Note
You must select a category from the drop-down list. To add or delete
a category, click the Category button.

• Description: type the description for the application.
• Publish: select one of the following:• Do not publish—to upload the application on the server, but
keep hidden from the mobile devices.
• Publish as production version—to upload the application on
the server, and publish it for mobile devices to download.
• Publish as beta version—to upload the application on theserver, and publish it as a beta version for mobile devices todownload.
• Screenshots: select and upload application screenshots.
7.

Click Continue.
The application appears in the applications list.

38-34

Trend Micro Mobile Security Policy Settings

Container Policy
This policy enables you to manage Samsung KNOX container security
settings. You can configure approved list or blocked list for accounts, apply
restrictions, and configure browser, password, and application settings.
Note
You must configure KNOX license in Mobile Security before enabling thispolicy. To configure the KNOX license, navigate to Administration > Product
License on the administration web console.

• Account Settings: Specify accounts that can be added or restricted on
Samsung KNOX containers by using approved and/or blocked lists.
• Restriction Settings: Disable camera or file sharing on Samsung KNOX
containers.
• Browser Settings: Configure security settings for the native Android
web browser on Samsung KNOX containers.
• Password Settings: Configure password security settings for Samsung
KNOX container.
• Application Settings: Configure the following lists:• Filter Applications List: Configure approved list or blocked list to
restrict applications installation on Samsung KNOX container.
• Required Applications: Configure the required applications list to
specify applications that must be installed on Samsung KNOX.
• Disable Applications: Configure the disable applications list to
disable certain applications on the mobile device. If the applications
on this list are installed on the mobile device, they will not be
removed, but the user will not be able to use these applications.
To configure container policy settings, click Policies, then click the policy
name, and then click Container Policy.

38-35

Part XVII
Virtual Mobile Infrastructure
Widgets

Chapter 39

Virtual Mobile Infrastructure Dashboard
Widgets
This section contains help topics for the Virtual Mobile Infrastructure
widgets supported in Apex Central.
Topics include:

39-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Top 5 Trend Micro Virtual Mobile Infrastructure
Launched Applications Widget
This widget displays the top five most launched applications reported byTrend Micro Virtual Mobile Infrastructure servers.
The data is shown in a bar chat. The y-axis displays the application name andthe x-axis displays the amount of times the application was launched.
Change the managed server that the widget uses as its source by clicking thedrop-down menu. In the drop-down menu options, select the IP address ofthe managed server to use as the source.

Top 5 Trend Micro Virtual Mobile Infrastructure
Launched Web Applications Widget
This widget displays the top five launched web applications reported byTrend Micro Virtual Mobile Infrastructure servers.
The data is shown in a bar chat. The y-axis displays the application name andthe x-axis displays the amount of times the application was launched.
Change the managed server that the widget uses as its source by clicking thedrop-down menu. In the drop-down menu options, select the IP address ofthe managed server to use as the source.

Top 5 Trend Micro Virtual Mobile Infrastructure
Online Users Widget
This widget displays the top five most active users who have accessed theirworkspace for the longest period of time reported by Trend Micro Virtual
Mobile Infrastructure servers.
The data is shown in a bar chat. The y-axis displays the user name and the xaxis displays the time in minutes that the user accessed their workspace.
Change the managed server that the widget uses as its source by clicking thedrop-down menu. In the drop-down menu options, select the IP address ofthe managed server to use as the source.
39-2

Virtual Mobile Infrastructure Dashboard Widgets

Trend Micro Virtual Mobile Infrastructure Server
CPU Usage Status Widget
This widget displays the CPU usage of Trend MicroVirtual Mobile
Infrastructure servers.
The data is shown in a graph. The y-axis represents the CPU usage as apercentage and the x-axis represents the time that the CPU usage wasrecorded.
Change the managed server that the widget uses as its source by clicking thedrop-down menu. In the drop-down menu options, select the IP address ofthe managed server to use as the source.

Trend Micro Virtual Mobile Infrastructure Server
Disk Usage Status Widget
This widget displays the disk usage of Trend Micro Virtual Mobile
Infrastructure servers.
The following data is shown in a pie chart:• Free: The amount of available disk storage on the managed server.
• Used: The amount of used disk storage on the managed server.
• Total: The amount of total disk storage on the managed server.
Change the managed server that the widget uses as its source by clicking thedrop-down menu. In the drop-down menu options, select the IP address ofthe managed server to use as the source.

Trend Micro Virtual Mobile Infrastructure Server
Memory Usage Status
This widget displays the memory usage of Trend Micro Virtual Mobile
Infrastructure servers.
The following data is shown in a pie chart:

39-3

Trend Micro Apex Central™ Widget and Policy Management Guide• Free: The amount of available memory on the managed server.
• Used: The amount of used memory on the managed server.
• Total: The amount of total memory on the managed server.
Change the managed server that the widget uses as its source by clicking thedrop-down menu. In the drop-down menu options, select the IP address ofthe managed server to use as the source.

Trend Micro Virtual Mobile Infrastructure User
Status Widget
This widget displays the current users' statuses reported by Trend Micro
Virtual Mobile Infrastructure servers.
The following user statuses are shown in a pie chart:• Active: The user is currently connected to the server and is accessing
the workspace.
• Idle: The user is connected to the server and is not currently accessing
the workspace.
• Offline: The user is disconnected from the server.
• Disabled: The user account has been disabled and the user cannot
access the server.
Change the managed server that the widget uses as its source by clicking thedrop-down menu. In the drop-down menu options, select the IP address ofthe managed server to use as the source.

39-4

Part XVIII
Vulnerability Protection Widgets

Chapter 40

Vulnerability Protection Dashboard
Widgets
This section contains help topics for the Vulnerability Protection dashboard
widgets supported in Apex Central.
Topics include:

40-1

Trend Micro Apex Central™ Widget and Policy Management Guide

Vulnerability Protection Application Type Activity(Detected) Widget
This widget tracks the Application Types associated with IPS (Detected)
Events on the endpoint.
You can choose which Vulnerability Protection installation to use as the data
source for this widget. To select the data source, click the settings icon ( >) and select the source from the provided list.
Tip
This widget can only display data from a single Vulnerability Protection
server. To monitor multiple Vulnerability Protection servers, create a newwidget for each server.

To make a Vulnerability Protection installation available to the Vulnerability
Protection widgets, go to Administration > Managed Servers > Server
Registration and add a new Vulnerability Protection server.
Note
The data displayed in the widgets are restricted to what is permitted by theuser account privileges.

To display the Vulnerability Protection Manager's Events page, filtered toshow the IPS (Detected) Events associated with the specific Application Type,click on a value in the Totals column.
Data

40-2

Description

Application TypeName

The name of the Application Type

Total

Number of Events in the time range and the percentage of the total
Events of this type that it represents

Previous Total

Number of Events in the time period preceding the current time range

Vulnerability Protection Dashboard Widgets

Data
Trend

Description
The percentage change from the previous to the current period

Vulnerability Protection Application Type Activity(Prevented) Widget
This widget tracks the Application Types associated with IPS (Prevented)
Events on the endpoint.
You can choose which Vulnerability Protection installation to use as the data
source for this widget. To select the data source, click the settings icon ( >) and select the source from the provided list.
Tip
This widget can only display data from a single Vulnerability Protection
server. To monitor multiple Vulnerability Protection servers, create a newwidget for each server.

To make a Vulnerability Protection installation available to the Vulnerability
Protection widgets, go to Administration > Managed Servers > Server
Registration and add a new Vulnerability Protection server.
Note
The data displayed in the widgets are restricted to what is permitted by theuser account privileges.

To display the Vulnerability Protection Manager's Events page, filtered toshow the IPS (Prevented) Events associated with the specific Application
Type, click on a value in the Totals column.
Data
Application Type
Name

Description
The name of the Application Type40-3

Trend Micro Apex Central™ Widget and Policy Management Guide

Data

Description

Total

Number of Events in the time range and the percentage of the total
Events of this type that it represents

Previous Total

Number of Events in the time period preceding the current time range

Trend

The percentage change from the previous to the current period

Vulnerability Protection Feature Summary Widget
This widget shows the recent activity of each of the Vulnerability Protection
modules.
You can choose which Vulnerability Protection installation to use as the data
source for this widget. To select the data source, click the settings icon ( >) and select the source from the provided list.
Tip
This widget can display aggregated data from multiple Vulnerability
Protection installations. The Vulnerability Protection installations represented
in this widget are defined on the Server Registration screen. To monitor
multiple Vulnerability Protection installations individually, create a newwidget for each installation.

To make a Vulnerability Protection installation available to the Vulnerability
Protection widgets, go to Administration > Managed Servers > Server
Registration and add a new Vulnerability Protection server.
Note
The data displayed in the widgets are restricted to what is permitted by theuser account privileges.

Use the Range drop-down to select the time period for the data that displays.

40-4

Vulnerability Protection Dashboard Widgets

Data

Description

ModuleThe name of the Vulnerability Protection module

Protected Computers

The current number of managed computers being protected by themodule and the percentage of all managed computers that the
number represents

Event CountThe number of Events generated by the module during the specified
time period

Trend

The percentage change from the previous to the current period

Vulnerability Protection Firewall Event History
WidgetThis widget displays the number of Firewall Events that occur during a
specified time range. The chart shows events triggered by Firewall Rules inboth Detect and Prevent mode.
You can choose which Vulnerability Protection installation to use as the data
source for this widget. To select the data source, click the settings icon ( >) and select the source from the provided list.
To make a Vulnerability Protection installation available to the Vulnerability
Protection widgets, go to Administration > Managed Servers > Server
Registration and add a new Vulnerability Protection server.
Note
The data displayed in the widgets are restricted to what is permitted by theuser account privileges.

To display the Vulnerability Protection Manager's Events page, filtered toshow the Firewall Events (Detect or Prevent) in the selected time range, click
on a section of the bar chart.

40-5

Trend Micro Apex Central™ Widget and Policy Management Guide

Vulnerability Protection Intrusion Prevention
Event History Widget
This widget displays the number of IPS Events that occurred over the
specified time range. The chart displays Events triggered by IPS Rules in both
Detect and Prevent mode.
You can choose which Vulnerability Protection installation to use as the data
source for this widget. To select the data source, click the settings icon ( >) and select the source from the provided list.
To make a Vulnerability Protection installation available to the Vulnerability
Protection widgets, go to Administration > Managed Servers > Server
Registration and add a new Vulnerability Protection server.
Note
The data displayed in the widgets are restricted to what is permitted by theuser account privileges.

To display the Vulnerability Protection Manager's Events page, filtered toshow the IPS Events (Detect or Prevent) during a specific time range, click on
a section of the bar chart.

Vulnerability Protection IPS Activity (Detected)
WidgetThis widget displays the five IPS Rules operating Detect mode that havetriggered the greatest number of Events.
You can choose which Vulnerability Protection installation to use as the data
source for this widget. To select the data source, click the settings icon ( >) and select the source from the provided list.
To make a Vulnerability Protection installation available to the Vulnerability
Protection widgets, go to Administration > Managed Servers > Server
Registration and add a new Vulnerability Protection server.

40-6

Vulnerability Protection Dashboard Widgets

Note
The data displayed in the widgets are restricted to what is permitted by theuser account privileges.

To display the Vulnerability Protection Manager's Events page, filtered toshow the IPS (Detected) Events triggered by the specific rule, click on a value
in the Totals column.
Data

Description

Reason

The name of the Rule

Total

Number of Events in the time range and the percentage of the total
Events of this type that it represents

Previous Total

Number of Events in the time period preceding the current time range

Trend

The percentage change from the previous to the current period

Vulnerability Protection IPS Activity (Prevented)
WidgetThis widget displays the five IPS Rules operating Prevent mode that havetriggered the greatest number of events.
You can choose which Vulnerability Protection installation to use as the data
source for this widget. To select the data source, click the settings icon ( >) and select the source from the provided list.
To make a Vulnerability Protection installation available to the Vulnerability
Protection widgets, go to Administration > Managed Servers > Server
Registration and add a new Vulnerability Protection server.
Note
The data displayed in the widgets are restricted to what is permitted by theuser account privileges.

40-7Trend Micro Apex Central™ Widget and Policy Management Guide

To display the Vulnerability Protection Manager's Events page, filtered toshow the IPS (Prevented) Events triggered by the specific rule, click on avalue in the Totals column.
Data

Description

Reason

The name of the Rule

Total

Number of Events in the time range and the percentage of the total
Events of this type that it represents

Previous Total

Number of Events in the time period preceding the current time range

Trend

The percentage change from the previous to the current period

Vulnerability Protection Key Performance
Indicator Widget
This widget displays the number of Events triggered by Reconnaissance Scan
detection settings that occurred over the specified time range.
You can choose which Vulnerability Protection installation to use as the data
source for this widget. To select the data source, click the settings icon ( >) and select the source from the provided list.
To make a Vulnerability Protection installation available to the Vulnerability
Protection widgets, go to Administration > Managed Servers > Server
Registration and add a new Vulnerability Protection server.
Note
The data displayed in the widgets are restricted to what is permitted by theuser account privileges.

To display the Vulnerability Protection Manager's Events page, filtered toshow the Reconnaissance Scan detection Events during a specific time range,
click on a section of the bar chart.

40-8Vulnerability Protection Dashboard Widgets

Vulnerability Protection Reconnaissance Scan
Event History Widget
This widget displays the number of Events triggered by Reconnaissance Scan
detection settings that occurred over the specified time range.
You can choose which Vulnerability Protection installation to use as the data
source for this widget. To select the data source, click the settings icon ( >) and select the source from the provided list.
To make a Vulnerability Protection installation available to the Vulnerability
Protection widgets, go to Administration > Managed Servers > Server
Registration and add a new Vulnerability Protection server.
Note
The data displayed in the widgets are restricted to what is permitted by theuser account privileges.

To display the Vulnerability Protection Manager's Events page, filtered toshow the Reconnaissance Scan detection Events during a specific time range,
click on a section of the bar chart.

Vulnerability Protection Status Summary Widget
This widget displays the number of Critical and Warning Alerts, as well as apie chart indicating what percentage of endpoints are in a particular state.
You can choose which Vulnerability Protection installation to use as the data
source for this widget. To select the data source, click the settings icon ( >) and select the source from the provided list.

40-9Trend Micro Apex Central™ Widget and Policy Management Guide

Tip
This widget can display aggregated data from multiple Vulnerability
Protection installations. The Vulnerability Protection installations represented
in this widget are defined on the Server Registration screen. To monitor
multiple Vulnerability Protection installations individually, create a newwidget for each installation.

To make a Vulnerability Protection installation available to the Vulnerability
Protection widgets, go to Administration > Managed Servers > Server
Registration and add a new Vulnerability Protection server.
Note
The data displayed in the widgets are restricted to what is permitted by theuser account privileges.
Computer Status

Description

Managed (Green)

Protected and without errors or warnings

Unmanaged (Blue)Not protected

Locked (Gray)

Locked. When a computer is in a locked state, the Vulnerability
Protection Manager will not communicate with the Agent/Appliance orgenerate any computer-related alerts.

Critical (Red)In an error state

Warning (Yellow)

In a warning state

Vulnerability Protection Vulnerable Endpoints
Widget
Use this widget to track vulnerable endpoints.
You can choose which Vulnerability Protection installation to use as the data
source for this widget. To select the data source, click the settings icon ( >) and select the source from the provided list.

40-10

Vulnerability Protection Dashboard Widgets

Tip
This widget can only display data from a single Vulnerability Protection
server. To monitor multiple Vulnerability Protection servers, create a newwidget for each server.

To make a Vulnerability Protection installation available to the Vulnerability
Protection widgets, go to Administration > Managed Servers > Server
Registration and add a new Vulnerability Protection server.
Note
The data displayed in the widgets are restricted to what is permitted by theuser account privileges.

To display the Vulnerability Protection Manager's rule properties page,
showing virtual patched/unprotected endpoints, click on a value in the
Virtual Patched/Unprotected column.
Description

Data
Name

The name of the Intrusion Prevention rule

Severity

The severity level of the Intrusion Prevention rule

CVE

Common Vulnerabilities and Exposure (CVE) number

CVSS Score

A measure of the severity of the vulnerability according to the National
Vulnerability Database

MS ID

Microsoft Security Patch ID

Virtual Patched

Number of endpoints that are assigned the rule after a scan forrecommendations

Unprotected

Number of endpoints that are not assigned the rule after a scan forrecommendations

40-11

IndexA
about
authentication, 28-2
action on monitored system events,
9-8

actions
Data Loss Prevention, 19-10, 35-4
ActiveAction, 10-39
Active Directory
import users, 27-6
agent self-protection, 7-12
Apex Central
integration with Trend Micro
Endpoint Sensor, 30-2
approved list, 14-2
approved programs list, 9-9authentication
about, 28-2

B
Behavior Monitoring
action on system events, 9-8
exception list, 9-9
blocked programs list, 9-9browsing targets, 2-10
Ccache settings for scans, 7-15
call filteringfiltering list configuration, 38-15
filtering list format, 38-17
compliance policy
check list, 38-29
compliance tab, 1-29

components
on the Update Agent, 7-19
compressed files
decompression rules, 19-16
condition statements, 3-30
conventional scan, 21-8
switching to smart scan, 21-8
copying policy settings, 2-13
creating policies, 2-2, 2-18
copying settings, 2-13
settings, 2-4
criteria
customized expressions, 3-18, 3-19
keywords, 3-26, 3-27
customized expressions, 3-18, 3-19, 3-21
criteria, 3-18, 3-19
importing, 3-21
customized keywords, 3-25
criteria, 3-26, 3-27
importing, 3-29
customized templates, 3-30
creating, 3-31
importing, 3-33
D
dashboardtabs, 1-2
adding, 1-2
deleting, 1-3
renaming, 1-2
slide show, 1-2
summary, 1-13
widgets, 1-2
adding, 1-4
modifying product scope, 1-5
IN-1

Trend Micro Apex Central™ Widget and Policy Management Guide

moving, 1-4
Data Discovery, 18-2
creating policies, 18-2
data identifiers, 3-16
expressions, 3-16
file attributes, 3-16
keywords, 3-16
Data Loss Prevention, 3-16, 19-2
actions, 19-10, 35-4
data identifiers, 3-16
decompression rules, 19-16
expressions, 3-17–3-19, 3-21
file attributes, 3-21–3-23
keywords, 3-23–3-27, 3-29
network channels, 19-6, 19-7,
19-13–19-15

policies, 35-2–35-6
actions, 35-4
creating, 35-2
enabling, 35-6
name and priority, 35-6
notifications, 35-5
selecting accounts, 35-2
targets, 35-3
system and application channels,
19-9

templates, 3-29–3-31, 3-33
Data Loss Prevention (DLP), 3-15
Data Protection, 19-2
decompression rules, 19-16
deleting policies, 2-19
deployed targets, 2-23
device control, 13-2, 13-5, 13-7, 13-8, 21-3,
21-4

IN-2

Digital Signature Provider, 13-8
permissions, 13-5, 13-7, 21-4

program path and name, 13-7
requirements, 13-2
storage devices, 13-5, 21-4
wildcards, 13-8
Device List Tool, 19-9
devices
Endpoint Encryption Devices
widget, 27-9
lock, 28-16
digital signature cache, 7-15
Digital Signature Pattern, 7-15
Digital Signature Provider, 13-8
specifying, 13-8
DLP, 3-15
documentation, 2
draft policies, 2-3
DSP, 13-8
E
editing policies, 2-16
email domains, 19-7
Event Monitoring, 9-6
exception list, 9-9
Behavior Monitoring, 9-9expressions, 3-16, 3-17
customized, 3-18, 3-21
criteria, 3-18, 3-19
predefined, 3-17
F
file attributes, 3-16, 3-21–3-23
creating, 3-22
importing, 3-23
wildcards, 3-22
filter by criteria, 2-3
filtered policies

Indexreordering, 2-24
G
General Policy
log settings, 38-4
uninstall protection features, 38-4
update settings, 38-4
I
IPv6 support
limitations, 21-35
K
keywords, 3-16, 3-23
customized, 3-25–3-27, 3-29
predefined, 3-24, 3-25
L
logical operators, 3-30
M
mail scan, 7-18
Malware Behavior Blocking, 9-2
Manual Scan, 10-4
monitored email subdomains, 19-8
monitored system events, 9-6
monitored targets, 19-14, 19-16
N
network channels, 19-6, 19-7, 19-13–19-15
email clients, 19-7
monitored targets, 19-13
non-monitored targets, 19-13
transmission scope
all transmissions, 19-14
external transmissions, 19-15

transmission scope and targets,
19-6

non-monitored email domains, 19-7
non-monitored targets, 19-14, 19-16
O
offline targets, 2-23
on-demand scan cache, 7-16
P
PCRE, 3-18
pending targets, 2-23
Perle Compatible Regular
Expressions, 3-18
permissions
program path and name, 13-7
storage devices, 13-5, 21-4
policies
common, 28-14
creating, 2-2, 2-18
Data Discovery, 18-2
deleting, 2-19
editing, 2-16
Full Disk Encryption, 28-8
reordering, 2-24
user, 28-5
policy list, 2-7, 2-21
policy management, 2-2changing owners, 2-20
copying policy settings, 2-13
creating policies, 2-2, 2-18
deleting policies, 2-19
deployed targets, 2-23
DLP, 3-15
draft policies, 2-3
editing policies, 2-16
IN-3

Trend Micro Apex Central™ Widget and Policy Management Guide

offline targets, 2-23
owner, 2-22
pending targets, 2-23
policy list, 2-7, 2-21
policy priority, 2-9, 2-21
reordering policies, 2-24
settings, 2-4
specified policies, 2-3
targets, 2-23
targets with issues, 2-23
understanding, 2-2
policy priority, 2-21
policy settings
copying, 2-13
policy targets, 2-23
policy types
draft, 2-3
policy priority, 2-21
reordering policies, 2-24
specified, 2-3predefined expressions, 3-17
viewing, 3-17
predefined keywords
distance, 3-25
number of keywords, 3-24
predefined templates, 3-30
privileges
mail scan privileges, 7-18
unload privilege, 7-8
product scopewidgets, 1-5
Qquarantine directory, 10-41
R
Real-time Scan, 10-12
IN-4

reordering policies, 2-24
S
scan cache, 7-15
scan exclusions, 10-47
scan methods
conventional scan, 10-2
smart scan, 10-2
switching scan methods, 10-2
Scan Now, 10-21
scan types, 21-11
Scheduled Scan, 10-29
Security Agentfiles, 7-13
processes, 7-14
registry keys, 7-14
selecting targets
filter by criteria, 2-3
send email alert, 38-32
smart scan, 21-8
switching from conventionalscan, 21-8
spam
SMS, 38-12
filtering list configuration,
38-12

filtering list format, 38-14
WAP Push, 38-14
approved list format, 38-14
specified policies, 2-3priority, 2-9
specify targets
browsing, 2-10
spyware/grayware scan
approved list, 14-2
storage devices

Indexpermissions, 13-5, 21-4
summary tab, 1-13
system and application channels, 19-9Ttabs, 1-2
compliance, 1-29
summary, 1-13
Threat Statistics, 1-35
widgets, 1-2
targets, 2-23
browsing, 2-10
deployed, 2-23
filter by criteria, 2-3
offline, 2-23
pending, 2-23
with issues, 2-23
targets with issues, 2-23
templates, 3-29–3-31, 3-33
condition statements, 3-30
customized, 3-30, 3-31, 3-33
logical operators, 3-30
predefined, 3-30
terminology, 4
Threat Statistics tab, 1-35

W
web reputation, 21-36
Web Reputation, 11-2
Web threat
filtering list configuration, 38-18
filtering list format, 38-19
limited adult content, 38-19
specific website only, 38-19
widgets, 1-2
email messages with advanced
threats, 22-3
Endpoint Encryption Device
Lockout, 27-21
Endpoint Encryption Security
Violations Report, 27-23
Endpoint Encryption Status, 27-14
Endpoint Encryption
Unsuccessful Device Logon, 27-16
Endpoint Encryption
Unsuccessful User Logon, 27-19
top email recipients of advanced
threats, 22-3
wildcards, 3-22
device control, 13-8
file attributes, 3-22

U
uninstallation
using the uninstallation program,
7-9

Update Agent, 7-19
updates
Update Agent, 7-19
users, 28-3
import from AD, 27-6
lockout, 28-16
IN-5

Item Code: APEM89863/231117