Are real-time scans different from scheduled scans?

[stipend]

This VMware article says to exclude certain files from real-time scanning. Is that different from scheduled scans?

Are the two different? I'm guessing they are since for AMP to work and detect malicious files and processes, it needs to be conducting real-time scanning.

https://techzone.vmware.com/resource/antivirus-considerations-vmware-horizon-environment#virtual-machines:~:text=Exclude%20low%2Drisk%20files%20and%20folders%20from%20real%2Dtime%20scans%20on%20single%2Duser%20View%20virtual%20machines%20or%20RDSH%20...

[Roman Valenta · Accepted solution]

Hi,

This paragraph should answer both of your questions:

Scheduled Scans is something that you will configure in the policy and it will be conducted periodically. We have two Full Scan and Flash Scan.

Scheduled scans are not necessary for the operation of the connector because files are being reviewed as they are copied, moved, and executed. Files are also reviewed again for 7 days using Retrospective. Full Scan is recommended when you install connector for the first time.

More about Scheduled Scans can be found here:

User Guide
https://docs.amp.cisco.com/AMP%20for%20Endpoints%20User%20Guide.pdf

Rule of thumb, always go by vendor specific request to avoid complication if they provide list of exclusion apply them.

As far for Secure Endpoint and Horizon, we do also have Cisco Maintained exclusion already included in the portal so you can start there.

 

Hope this help,

Regards,

Roman

[Ken Stieers]

Yes real time scanning is different, in that before the requesting app is allowed to access a file, the security product will hold it while it scans it, while a scheduled scan won't necessarily prevent something else from acceaaa file while it's running.

AMP has an extensive set of Cisco-maintained exclusions so the VMware agent may already be covered so that AMP doesn't break stuff.