SCV - Canonical list of supported/detectable anti-virus clients

Howard_Gyton — Thu, 14 Nov 2024 10:24:23 GMT

We've recently been looking at tightening up our SCV policy for BYOD devices running the standalone VPN client.

Looking over the R81 Remote Access VPN Administration Guide, there is mention of some clients that are supported, but it differs depending on which section you look at.

For example, at the top of the section "Secure Configuration Verification - Advanced", it mentions this:

Anti-Virus Monitor - Verifies that an Anti-Virus is running and checks its version. Supported: Norton, Trend Office Scan, and McAfee.

But when you expand the Anti-Virus monitor section, it mentions this:

Type ("av_type")

Type of Anti-Virus. For example, "Norton", "VirusScan", "McAfee", "OfficeScan", or "ZoneLabs".

In the "local.scv" file itself this is obviously a free text field, but how free? How would we detect "Windows Defender" on a Windows machine, for example, and is that even possible?

Howard

Re: SCV - Canonical list of supported/detectable anti-virus clients

PhoneBoy — Mon, 18 Nov 2024 16:08:31 GMT

This AV check predates what is probably the better way to achieve this: using WindowsSecurityMonitor https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/Content/Topics-VPNRG/Secure-Configuration-Verification.htm
With this, you can use any AV that Microsoft detects, which I assume would also include Defender 🙂
The procedure for finding the exact name to use in SCV is here: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/Content/Topics-VPNRG/Secure-Configuration-Verification-Advanced.htm?tocpath=_____11

topic SCV - Canonical list of supported/detectable anti-virus clients in SASE and Remote Access

SCV - Canonical list of supported/detectable anti-virus clients

Re: SCV - Canonical list of supported/detectable anti-virus clients