CSA and Worms detection

[irelandsky]

Hi all,

could someone tell me how CSA is able to detect worm attack?

Is the agent in communication with Antivirus installed on the system?

Thanks in advance

Marco

[tsteger1]

CSA detects (based on the rules you have in place) suspicious behavior that a worm would produce when it was trying to execute on a machine. It queries the user (if user interaction is enabled) whether they will allow it. The Global Event correlation (if you have it enabled) will notify other machines and prevent the spread of the worm even if it successfully executes. CSA knows about the virus scanner (if you have it configured) and allows it to perform as needed but it is not dependant on it for protection.