Manage and run recommendation scans

Deep Security can run recommendation scans on computers to identify known vulnerabilities. The operation scans the operating system but also installed applications. Based on what is detected, Deep Security will recommend security rules that should be applied.

During a recommendation scan, Deep Security Agents scan:

• the operating system
• installed applications
• the Windows registry
• open ports
• the directory listing
• the file system
• running processes and services
• users

Recommendation scans can be initiated manually or you can create a scheduled task to periodically run scans on specified computers.

In this topic:

• Recommendation scan limitations
• Manually run a recommendation scan
• Create a schedule to run a recommendation scan on a regular basis
• Cancel a recommendation scan
• Manage the recommendation scan results
• Configure recommended rules
• Troubleshooting: Recommendation Scan Failure

Recommendation scan limitations

On Linux, the recommendation scan engine may have trouble detecting applications that have been installed with kernel or software libraries not supported by the application being installed. Applications installed using standard package managers will not be a problem.

The Deep Security Virtual Appliance can perform agentless recommendation scans on virtual machines but only on Windows platforms and is limited to scanning:

• the operating system
• installed applications
• the Windows registry
• the file system

Manually run a recommendation scan

1. In the Deep Security Manager, go to the Computers page.
2. Select the computer or computers you want to scan.
3. Right-click the selection and choose Actions > Scan for Recommendations.

Create a schedule to run a recommendation scan on a regular basis

1. In the Deep Security Manager, go to the Administration > Scheduled Tasks page.
2. Click New on the toolbar and select New Scheduled Task to display the New Scheduled Task wizard.
3. Select Scan Computers for Recommendations from the Type menu and select how often you want the scan to occur. Click Next.
4. The next page will let you be more specific about the scan frequency, depending on your choice in step 3. Make your selection and click Next.
5. Now select which computer(s) will be scanned and click Next.
   As usual, for large deployments it's best to perform all actions through policies.
6. Finally, give a name to your new scheduled task, select whether or not to Run Task on 'Finish', click Finish.

Cancel a recommendation scan

You can cancel a recommendation scan before it starts running.

1. In the Deep Security Manager, go to the Computers page.
2. Select the computer or computers where you want to cancel the scans.
3. Click Actions > Cancel Recommendation Scan.

Manage the recommendation scan results

Deep Security can be configured to automatically implement recommendation scan results when it is appropriate to do so. Not all recommendations can be implemented automatically. The exceptions are:

• Rules that require configuration before they can be applied.
• Rules that have been automatically assigned or unassigned based on a previous recommendation scan but which a user has overridden. For example, if Deep Security automatically assigns a rule and you subsequently unassign it, the rule will not get reassigned after the next recommendation scan.
• Rules that have been assigned at a higher level in the policy hierarchy cannot be unassigned at a lower level. A rule assigned to a computer at the policy level must be unassigned at the policy level.
• Rules that Trend Micro has issued but which may pose a risk of producing false positives. (This will be addressed in the rule description.)

The results of the latest recommendation scan are displayed on the General tab of the protection module in the Computer or Policy editor You can change these settings for a policy or for a specific computer. To change the settings for a policy, go to the Polices page and double-click the policy that you want to edit (or select the policy and click Details). To change the settings for a computer, go to the Computers page and double-click the computer that you want to edit (or select the computer and click Details)..

Once a recommendation scan is complete, open the policy that is assigned to the computers you have just scanned. Navigate to Intrusion Prevention > General. Click Assign/Unassign to open the rule assignment window. Sort the rules By Application Type and select Show Recommended for Assignment from the display filter menu: