Activate a physical or virtual machine with anti-malware module enabled.
Download the EICAR test file on the virtual machine. The file should be quarantined.
On the DSM console, go to Events & Reports > Anti-Malware Events to verify the record of the malware detection.
On the DSM console, go to Administration tab.
Click Scheduled task > New.
On the DSM console, go to the assigned policy or security profile.
On the Default Real-Time Scan configuration, click Edit.
Go to Exclusions tab, and then expand the Directory List.
Provide a name for this directory list.
On the Directory section, specify the path of the directory you want to exclude from the scan. For example, C:\Test Folder.
Download the EICAR test file and save it in the folder specified on the previous step. The file should be saved and uncaught by the anti-malware.
Perform virus pattern updates on DSM and set up automatic updates.
By default, Deep Security 9.0 has a pre-created scheduled task for Daily Download Security Update and Daily Component Update. To immediately run the task, go to Administration > Scheduled Tasks, and then click Run Task Now.
As an option, you may get a sample virus quarantined by saving to another path and test the Real-time and Scheduled scans.
To check, you can go to the DSM console, select a computer or policy, then click Firewall > Firewall rule > Assign/Unassign.
Evaluate the Secure Shell (SSH) and Remote Desktop Protocol (RDP) rules.
Activate a Windows or Linux virtual machine with the SSH rule.
Using another machine, try to establish SSH connection to the virtual machine.
On the DSM console, go to Events & Reports > Firewall events to view the denied event.
Activate a Windows or Linux virtual or physical machine.
Try to connect to the virtual machine using RDP.
On the DSM console, select the computer or policy.
Click Firewall and go to Firewall Events to view the denied event.
Test the stateful configuration feature.
On the DSM console, select a computer and add the SSH rule to the current firewall rules.
You can also add the rule via Policy/Security Profile to apply it on multiple machines.
Use the pre-created SSH rule that allows incoming SSH traffic.
There should be no firewall rule on outgoing SSH.
From another computer, try to connect to the target computer using an SSH application such as Putty.
Check the firewall events. This should appear as "Out of allowed Policy".
Go back to the Computer/Policy view, and then go to Firewall.
Under Firewall Stateful Configuration, select Enable Stateful Inspection.
Test the port scanning to show running ports and services on a VM.
On the DSM console, go to Computers tab.
Right-click the computer to be scanned and click Scan for Open ports.
From the Computer view, go to the Firewall section to view the result.
Close unused open ports to prevent exposure to malicious attacks, worms, or Trojans.
Test Event Tagging in the DSM console.
On the DSM console, go to Events.
Right-click an event for tagging and click Add tags.
Tick To Selected events check box. The tags will be added to the Tag(s) column.
On the DSM console, go to the Events tab.
Right-click an event and click Add tags.
Select Apply to Selected and Similar System Events.
Filter the Similar System Events criteria, and then click Next.
Tick the Future System Events check box.
Before testing this module, make sure you have Windows VMs with DSA.
On the DSM console, enable Integrity Monitoring.
Click Integrity Monitoring on the left pane.
Under Integrity Monitoring State, select On and click Save.
Add the Microsoft Windows-'Hosts' file modifiedrule to a computer, policy, or security profile.
This protects the Windows host file C:\windows\system32\drivers\etc\hosts.
After the Rebuild Baseline process is completed, modify the C:\windows\system32\drivers\etc\hosts file of the computer.
Verify the events in the Deep Security console. You should see an alert that the file has been modified.
On the DSM console, select a computer or policy.
Enable Log Inspection on the selected computer or policy.
Click Log Inspection on the left pane.
Under Log Inspection State, select On and click Save.
Go to Advanced tab, change the "Store events at the Agent/Appliance for later retrieval by DSM when they equal or exceed the following severity level" to "Low (3)" and click Save.
1002792 - Default Rules Configuration – This is required for all other Log Inspection rules to work.
1002795 - Microsoft Windows Events – This logs events every time the Windows auditing functionality registers an event.
Click OK, and then click Save to apply the rules to the policy.
Generate log and event entries on the VMs, for example changing the Windows Audio Service from "Automatic" to "Manual".
Click Log Inspection > Log Inspection events.
Testing this module requires VMware virtual or physical machine protected by Deep Security.
Click Web Reputation on the left pane.
Under the Web Reputation State, select On and click Save.
Add “http://www.facebook.com” under Blocked URL and click Save.
From a protected computer, open a browser and acecss Facebook. A message denying the access should appear on the client machine.
On the DSM console, go to Web Reputation and click Events to verify if the website blocking is recorded.
Evaluate the Role Based Access Control (RBAC).
Create a user in Deep Security and add roles with limited functionality such as View Only.
Log on as the newly created user and verify the limited functionality. An account with View Only role is allowed to read or view settings but is unable to modify them or perform any administrative task.
Evaluate integration with Active Directory (AD) Users.
Select the appropriate options and click Next.
After the synchronization is completed, click Finish.
Use the newly created Active Directory account to login.
As an option, you may also add SMTP, SNMP, and SYSLOG servers to Deep Security.
To add SMTP account, go to Administration > System Settings > SMTP and provide the necessary information.
To add SNMP account, go to Administration > System Settings > SNMP and provide the necessary information.
To add Remote Syslog Server, go to Administration > System Settings > SIEM and provide the necessary information.
On the DSM console, go to Events & Reports > Generate Reports.
Select a report to generate, such as Firewall Report.
Select a format, such as PDF.
Click Generate, and then click Save.
Check Deep Security synchronization with states of VM on vCenter.
Add, remove, shut down, or start VMs in vSphere client.
Verify if the change reflected in the Deep Security console.
Test the Deep Security tasks for moved or new VM created prior to the tests.
On the DSM console, go to Administration > Event-based task > Computer Created.
Indicate the action to perform, then click Activate a computer & Assign a Policy.
Provide a name for this task and click Finish.
On the DSM console, go to Administration > Event-based task > Computer Moved.
Create a new computer on Vcenter, or Vmotion a computer to another protected ESXi host.
Verify if the VM is automatically activated and assigned the selected policies.
You may opt to resume a suspended VM. A resumed VM is instantly protected with the latest antivirus patterns and DPI rules.
Check both Deep Security consoles if they display same data from the protected environment.
Shut down or disable the network interface on the operating system of one DSM. The second Deep Security console should still function and display data.
Start or enable the first DSM again.
Shut down or disable the network interface on the operating system of the second DSM. The first Deep Security console should still function and display data.
For Deep Security Agent (DSA) users, make sure that the Trend Micro LightWeight Filter Driver is enabled on the interface you want to protect.
For agentless protection users, make sure your Deep Security Virtual Appliance (DSVA) is working normally.
Assign the rule to restrict the download of EICAR file in the IP Rules Assign/Unassign page.
From the DSM console, double-click the protected machine.
Click Intrusion Prevention > Assign/Unassign.
Enable the Rule ID 1005924 Restrict Download of EICAR Test File Over HTTP.
Download the EICAR file to the protected machine.
Check the IPS events to ensure it logs the event for blocking the EICAR file.
Go to Intrusion Prevention > Events.
Click Get Events. When you find the detailed events for blocking the EICAR file, it means the IPS module works fine.
Deep Security 10.0 will be a landmark release for the product, and needs to be noticeably different from previous versions. The goal here is to refresh the skin of DS 10.0 with non-risky changes to flow and relative positioning of items in terms of UX (user experience).
Set up an agentless protection environment.
Install DSA for those protected machine so it runs on combine mode.
Choose protect setting for AM/WRS/FW/IPS/ IM. The settings are located under Settings > Computer.
Verify if the module status in Appliance, or whether the agent changed or not.
In Deep Security 10.0, the application control is newly introduced but only supports Linux.
Install the DSA on Linux machine (feature currently not available for Windows) and turn on the application control feature.
Create a test .jar file and execute it. You will find that it is blocked.
It will be recorded in application control events.
Click Allow All and then run the file again. It will turn out successful.
Install DDA 5.5. Contact Technical Support and ask for TMCM 6.0 SP1 Hotfix 3310 or above to be installed as well.
Register your DDA 5.5 and DS 10 to your TMCM.
Go to TMCM Administration > Managed Servers.
Select Server Type to Deep Discovery Analyzer and add DDA to TMCM.
Select Server Type to Deep Security and add DDA to TMCM.
Go to DSM Administration > System Settings > Connected Threat Defenseand enable the CTD integration settings.
You may get the TMCM API key at the TMCM portal under Administration > Suspicious Objects > Distribution Settings.
Click Add/Update Certificate first to import the certificate for DDA and TMCM.
Enable the Advanced Threat Detection and turn on aggressive rule for Real-time scan of your test machine.
Enable document exploit protection and Behavior monitoring.
In Computer level, go to Anti-Malware > CTD.
Ensure that SandBox Analysis and Suspicious Objects List uses “Inherit (Yes)”.
In the Advanced tab, scroll down until you see the Document Exploit Protection Rule Exceptions section. You may add any rules that have raised false alarms, in this section.
Contact Technical Support for getting test samples.
Go to the quarantine files tab, right click and choose Analyze to submit sample to DDA.
Login DDAN web page and go to Summary > Dashboard Summary > View Suspicious Objects.
Go to DDA portal “Virtual Analyzer” > Submissions, and you will find that the sample is uploaded to DDA.
Wait for a minute until the DDA finishes analyzing the sample file. You may see the details once done.
Wait for a while while DDA uploads the suspicious object to TMCM automatically. Go to TMCM portal under Administrations > Suspicious Objects > Virtual Analyzer Objects.
You will see a new SO once the object is uploaded to TMCM.
Click Configure Scan Action and setup “Quarantine” for selected files. Click Apply.
Double check whether the scan action is set to “Quarantine”.
Click Send Policies to computersonce new updates have been received.
Go back to the test machine and extract the sample virus again. This time, it should be quarantined as configured if DSM has received the new suspicious objects from TMCM.