Again, they're available to protect both Windows NT and Windows 2000 systems, with Solaris agents also available in the latest 2.0 release. All are self-contained and don't need the console in order to provide protection, only communicating back to the console to advise of threats and to pull down new attack definitions and protection policies. In the latest release there's also protection against Trojans, especially useful given that these often go undetected by virus scanners. With the Web Server Edition of this package, specific protection is afforded to Web servers and Web-based applications. Currently the Web Server Edition is only available for use with Microsoft IIS, but Apache support is expected soon.
Installation is straightforward with the console loaded first then the agents.
The only complication is the need to configure a path to the public key used by the console, with triple-DES encryption used to protect communications between console and agents. Once loaded, the Security Event monitor is the default window in the entercept console, displaying information about suspicious events logged by each of the agents. A range of actions can be taken, from logging the event to terminating affected processes, with the usual options to generate alerts via pager and email. To deal with false alarms there's an exception facility, where activity normally deemed suspicious can be allowed through. It's also possible to modify the security levels applied to specific events.