Title

(U) The Trellix ENS Threat Prevention On-Demand Scan must be enabled to use scan cache. (Cat II impact)

Discussion

(U) Using the scan cache will prevent duplicate scanning of files while also improving performance. In addition, the ENS module will check the local reputation cache for the file hash. If the file hash is found, the module gets the reputation data for the file from the cache.

Check Content

(U) Access the ePO server console. Select Menu >> Policy >> Policy Catalog From the "Product" list, select "Endpoint Security Threat Prevention". From the "Category" list, select "On-Demand Scan". Select each configured On-Demand Scan policy. Verify Performance >> "Use the Scan Cache" is selected. If Performance >> "Use the Scan Cache" is not selected, this is a finding.

Fix Text

(U) Access the ePO server console. Select Menu >> Policy >> Policy Catalog From the "Product" list, select "Endpoint Security Threat Prevention". From the "Category" list, select "On-Demand Scan". Select each configured On-Demand Scan policy. Select the Performance >> "Use the Scan Cache" option. Click "Save".

Additional Identifiers

Rule ID: SV-228270r944500_rule

Vulnerability ID: V-228270

Group Title: SRG-APP-000277

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.