ISE posture for av installation check

[xili5]

We have a lot of system-provided condition to do AV installation checking. I'd like to down how to check av installation,check specific file existence, process or service? Then we could easily troubleshoot when we find check result is not what we expect.

[Jason Kunst · Accepted solution]

This all depends on the anti-malware provider and is not something documented.

[xili5]

Hi Jason,

I know it is not documented and that is why I raise question here.

So is there any basic concept of how to check it?  Because customer always asks if the service is stopped or process is killed, does anyconnect deem this checking as not compliant or not.

[Jason Kunst]

This mechanism is handled by a 3rd party and offloaded for that process. Customer can check with their specific vendor for the detailed information on what the service/application and process states are. This is not something exposed or documented as this process is offloaded.

I will double check with our SME on this piece of the product

[Nidhi]

When we create a condition to check if a specific software is installed, AC usually checks the installed program list.

And as Jason mentioned , If the customer is concern about checking if the service is running, then the process name has to be known first  from the Vendor and you can create a service condition to check if it is running or not.

Thanks,

Nidhi