topic Re: AntiMalware - Definition checks - Posure in Network Access Control

AntiMalware - Definition checks - Posture

Srinivasan Nagarajan — Sun, 09 May 2021 08:36:01 GMT

Hi Experts,

We're running ISE 2.6 with Patch 8 installed. AnyConnect is 4.8 and the Compliance Module is 4.3.X. I've been asked to configure a New AV Posture policy Definition check for Windows Defender.

Name: AV_Def_5days

Compliance Module: 4.X or later

Operating System: Windows All

Vendor: Microsoft Corporation

Check Type: Definition

Allow Virus Definition to be 5 days older than the Current system date

1. With the above config, I assume users should be having the Definition file date which are no longer older than the current system date (running on users PC). Is that correct?

2. What if the vendor isn't updating their AV database every 5 days once? Will the ISE mark them as non-compliant?

Thanks in advance

Re: AntiMalware - Definition checks - Posure

Damien Miller — Sun, 09 May 2021 06:11:09 GMT

Yes your assumptions are correct, but with Windows Defender the risk of the definitions being older than five days is very low since Microsoft updates on a 2 hour schedule. I still prefer to use 5 days from the last known definition date because of this though, not every AV/AM is as frequent as Microsoft.

Re: AntiMalware - Definition checks - Posure

Srinivasan Nagarajan — Mon, 10 May 2021 01:31:59 GMT

Thanks Damien.

We're also looking for the other option "Latest file date" which I guess implies, the virus definition files installed on the machine are no more 5 days older than the versions that ISE knows about. Is it correct?

Cheers,