Classic recommendation scan

[!WARNING] Do not enable Auto apply core Endpoint & Workload rules when using classic recommendation scan.

During a recommendation scan, agents scan the following items:

• Installed applications
• Windows registry
• Open ports
• Directory listing
• File system
• Running processes and services
• Environment variables
• Users

Scan limitations

Technical and logical limitations can cause inaccurate or missing recommendations for some types of software.

• Classic recommendation scan does not work on Deep Security Manager versions earlier than 20.0.789 (20 LTS Update 2023-06-28).
• Classic recommendation scans do not include the following:
  • Web application protection rules
  • Most smart rules unless they address a major threat or specific vulnerability. Smart rules address one or more (zero-day) vulnerabilities. Rule lists in Workload Protection identify smart rules with Smart in the Type column.
  • On Windows systems, OpenSSL rules which an application uses internally. The scanner can only make recommendations for OpenSSL if you explicitly install it.
• The scanner may recommend unnecessary rules for the following technologies:
  • Red Hat JBoss
  • Eclipse Jetty
  • Apache Struts
  • Oracle WebLogic
  • WebSphere
  • Oracle Application Testing Suite
  • Oracle Golden Gate
  • Nginx
  • Adobe Flash Player plug-in for Chrome - Recommendations are based on the Chrome version.
  • A content management system (CMS) and any CMS plugins - For a web server with PHP, the scan recommends all intrusion prevention rules related to the CMS.
• On Linux system:
  • If web browsers are the only applicable vector for Java-related
• On Unix or Linux systems:
  • The classic recommendation scan engine might have trouble detecting software that is not installed through the operating system's default package manager. Applications installed using standard package managers do not have this problem.
  • Recommendations do not include rules for desktop application vulnerabilities or local vulnerabilities. For example, browsers and media players.

Run a recommendation scan

Run recommendation scans on a regular basis (the best practice is weekly) because any change to your environment can affect rule recommendations. Ideally, schedule recommendation scans soon after Trend Micro releases new intrusion prevention rules each Tuesday. The use of system resources, including central processing unit (CPU) cycles, memory, and network bandwidth, increases during a classic recommendation scan, so schedule the scans at non-peak times. After running a recommendation scan, alerts appear on all computers that have recommendations.

You need a Workload license to run recommendation scans.

You can run recommendation scans using any of the following methods:

• Create a scheduled task that runs recommendation scans according to a schedule that you configure. You can assign the scheduled task to all computers, one individual computer, a defined computer group, or all computers protected by a particular policy. Scheduled tasks can run classic recommendation scans independently with their own settings. Use either scheduled tasks or ongoing scans, but not both.
• Configure an ongoing scan policy to scan a group of computers for recommendations on a regular basis. You can also configure ongoing scans for individual computers. This type of scan checks the time that the last scan occurred and waits a configured interval to scan. This results in recommendation scans occurring at different times in your environment. Ongoing scans are helpful in environments where an agent might be online for short or intermittent periods. For example, cloud environments that build and decommission instances frequently. Ongoing scans can run classic recommendation scans independently with their own settings. Use either scheduled tasks or ongoing scans, but not both.
• Manually run a single recommendation scan on one or more computers. A manual scan is useful if you have recently made significant platform or application changes and want to force a check for new recommendations instead of waiting for a scheduled task.
• Use the Command line interface (CLI) to initiate a classic recommendation scan.
• Use the Workload Security application programming interaface (API) to initiate a classic recommendation scan.

The results of the latest recommendation scan appear on the General tab of the Intrusion Prevention, Integrity Monitoring, or Log Inspection protection module.

Schedule a recommendation scan

For large deployments, use policies to perform classic recommendation scans.

1. In the Workload Security console, go to Administration > Scheduled Tasks.
2. Select New > New Scheduled Task to display the New Scheduled Task wizard.
3. Select Type > Scan Computers for Recommendations.
4. Select how often you want the scan to occur then click Next.
5. Specify the scan frequency based on your selection then click Next.
6. Select the computers to scan then click Next.
7. Name the new scheduled task.
8. To immediatly run the scan, select Run Task on Finish.
9. Click Finish. The results of the latest recommendation scan appear on the General tab of the Intrusion Prevention, Integrity Monitoring, or Log Inspection protection module.

Configure an ongoing recommendation scan

For large deployments, you should perform all actions, including recommendation scans, through policies.

1. On the Workload Security console, open the editor:
   • For an individual Computer.
   • For all computers that are using a Policy.
2. Click Settings.
3. On the General tab, under Recommendations, use Perform ongoing Recommendation Scans to enable or disable ongoing classic recommendation scans. This setting is inheritable. See Policies, inheritance, and overridess.
4. Specify how often the scans occur using Ongoing Scan Interval. This setting is inheritable. See Policies, inheritance, and overridess.

The results of the latest recommendation scan appear on the General tab of the Intrusion Prevention, Integrity Monitoring, or Log Inspection protection module.

Manually run a classic recommendation scan

1. On the Workload Security console, go to Computers.
2. Select the computers you want to scan.
3. Click Actions > Scan for Recommendations. The results of the latest recommendation scan appear on the General tab of the Intrusion Prevention, Integrity Monitoring, or Log Inspection protection module.

Cancel a classic recommendation scan

You can cancel a classic recommendation scan before it starts running.

1. On the Workload Security console, go to Computers.
2. Select the computer or computers where you want to cancel the scans.
3. Click Actions > Cancel Recommendation Scan.

Exclude a rule or application type from classic recommendation scans

For large deployments without access to the enhanced recommendation scan, create policies to manage recommendations. Policies make rule assignments from a single source rather than needing to manage individual rules on each computer. Consequently, policies may assign some rules to computers which do not need them.

When enabling recommendation scans in policies, use separate policies for scanning Windows and Linux computers to avoid assigning Windows rules to Linux computers or vice-verse.

To prevent recommendation scan results from including a particular rule or application type, create an exclusion:

1. On the Workload Security console, open the editor:
   • For an individual Computer.
   • For all computers that are using a Policy.
2. Select the type of rule you want to exclude:
   • Intrusion Prevention
   • Integrity Monitoring
   • Log Inspection
3. On the General tab, choose one of the following:
   • Assign/Unassign for rules
   • Application Types for application types
4. Double-click the rule or application type that you want to exclude.
5. Click the Options tab.
6. Do one of the following:
   • For rules, set Exclude from Recommendations to Yes or Inherited (Yes). (See policies, inheritance, and overrides.)
   • For application types, select Exclude from Recommendations.

Automatically implement recommendations

You can configure Workload Security to automatically implement recommendation scan results except for the following rules:

• Rules that require configuration before being applied.
• Rules that are excluded from recommendation scans.
• Rules that have been automatically assigned or unassigned, but that a user has overridden. For example, if Workload Security automatically assigns a rule and then you unassign it, the next recommendation scan does not reassign that rule.
• Rules that have been assigned at a higher level in the policy hierarchy cannot be unassigned at a lower level. A rule assigned to a computer at the policy level must be unassigned at the policy level.

• Rules that Trend Micro has issued, but which may pose a risk of producing false positives. This is addressed in the rule description.

• On the Workload Security console, open the editor:

  • For an individual Computer.
  • For all computers that are using a Policy.
• Select type you want to implement automatically:
  • Intrusion Prevention
  • Integrity Monitoring
  • Log Inspection You can change the setting independently for each protection module.
• On the General tab, under Recommendations, choose one of the following:
  • Yes
  • Inherited (Yes) (See policies, inheritance, and overrides.)

Manually assign rules

The example below illustrates how to make a policy to handle recommendation scan results for Intrusion Prevention:

1. After a recommendation scan is complete, open the policy that is assigned to the scanned computers.
2. Go to Intrusion Prevention > General. Any unresolved recommendations appear in the Recommendations section.
3. Click Assign/Unassign to open the rule assignment window.
4. Sort the list of recommended, unassigned rules By Application Type
5. Select Recommended for Assignment from the display filter menu:
   • Recommended rules have a rectangular, or full, flag. ()
   • A triangle, or partial, flag indicates that oly some of the rules for the application type have been recommended. ()
6. To assign a single rule to the policy, select the rule name.
   • Rules with have settings that you must configure before enabling the rule. For example, some log inspection rules require the location of the log files. An alert appears on the computer where the recommendation was made. The text of the alert contains the information required to configure the rule.
   • Rules with have configuration options that you can set.
7. To assign several rules at once
   1. Select multiple rules.
      • To select a group of rules next to each other, press and hold the Shift key.
      • To select separated rules, press and hold th Control key.
   2. Right-click the selection.
8. Click Assign Rule(s).

Implement additional rules for common vulnerabilities

Recommendation scans provide a good starting point for establishing a list of rules that you should implement, but some additional rules for common vulnerabilities are not identified by recommendation scans because they must be carefully configured and tested before being implemented in prevent (block) mode. Trend Micro recommends that you configure and test these rules, then manually enable them in your policies or individual computers.

The table below includes the most common additional rules you should configure. You can find others in Workload Security by searching for rules whose type is Smart or Policy.

Troubleshooting classic recommendation scan

The following tips can help you troubleshoot classic recommendation scans:

• Monitor the CPU and memory resources on the server. If the memory or CPU becomes exhausted during scanning, increase the resources.
• For communication issues, "protocol error" often appears in the body of the error message. To resolve this issue, ensure that you are using agent-initiated communication. See Activate and protect agents using agent-initiated activation and communication.
• If you receive a Recommendation Scan Failure message on your server, create a diagnostic package from the agent and contact support.