07-13-2023 11:23 AM - edited 07-13-2023 11:36 AM
This VMware article says to exclude certain files from real-time scanning. Is that different from scheduled scans?
Are the two different? I'm guessing they are since for AMP to work and detect malicious files and processes, it needs to be conducting real-time scanning.
Solved! Go to Solution.
07-13-2023 11:43 AM
Hi,
This paragraph should answer both of your questions:
Scheduled Scans is something that you will configure in the policy and it will be conducted periodically. We have two Full Scan and Flash Scan.
Scheduled scans are not necessary for the operation of the connector because files are being reviewed as they are copied, moved, and executed. Files are also reviewed again for 7 days using Retrospective. Full Scan is recommended when you install connector for the first time.
More about Scheduled Scans can be found here:
User Guide
https://docs.amp.cisco.com/AMP%20for%20Endpoints%20User%20Guide.pdf
Rule of thumb, always go by vendor specific request to avoid complication if they provide list of exclusion apply them.
As far for Secure Endpoint and Horizon, we do also have Cisco Maintained exclusion already included in the portal so you can start there.
Hope this help,
Regards,
Roman
07-13-2023 11:43 AM
Hi,
This paragraph should answer both of your questions:
Scheduled Scans is something that you will configure in the policy and it will be conducted periodically. We have two Full Scan and Flash Scan.
Scheduled scans are not necessary for the operation of the connector because files are being reviewed as they are copied, moved, and executed. Files are also reviewed again for 7 days using Retrospective. Full Scan is recommended when you install connector for the first time.
More about Scheduled Scans can be found here:
User Guide
https://docs.amp.cisco.com/AMP%20for%20Endpoints%20User%20Guide.pdf
Rule of thumb, always go by vendor specific request to avoid complication if they provide list of exclusion apply them.
As far for Secure Endpoint and Horizon, we do also have Cisco Maintained exclusion already included in the portal so you can start there.
Hope this help,
Regards,
Roman
07-13-2023 01:34 PM
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide