Views:
WARNING
WARNING
Do not enable Auto apply core Endpoint & Workload rules when using enhanced recommendation scan.
Auto apply core rules and enhanced recommendation scan are two separate features that both assign rules to a computer. Auto apply core rules applies core rules whenever a security update marks a rule as core, regardless of whether enhanced recommendation scan recommends that rule for the computer. If both features are enabled, computers receive rules outside of the recommended set, reducing the resource efficiency and accuracy benefits of the enhanced recommendation scan, and makes it harder to tell why a given rule was assigned.
Disabling Auto apply core rules does not prevent enhanced recommendation scan from applying rules. Automatic implementation of recommended rules is controlled by the Automatically implement... recommendations (when possible) in each supported security module.
Important
Important
  • Agents automatically transition to using enhanced recommendation scan when they update to a supported agent version.
  • Agents run the first enhanced recommendation scan within one hour of activation.
  • After an agent transitions to using enhanced recommendation scan, the first set of recommendations is implemented immediately rather than at the next scheduled time.
  • Enhanced recommendation scan does not use the scheduled task or ongoing scan settings to trigger scans. Scans always happen at least once every 24 hours after the first scan. The settings instead affect when recommendations are implemented (assigned or unassigned).
  • Configure either a scheduled task or ongoing scan to apply recommendations, but not both.
  • You must set Automatically implement... recommendations (when possible) to Yes for at least one of the supported security modules (Integrity Monitoring, Log Inspection, Intrusion Prevention). If all are set to No, the recommendation scan still runs, but cannot apply recommendations.
  • After transitioning to enhanced recommendation scan, a previously scheduled recommendation scan appears to stop running according to the configured schedule. This is an expected behavior and does not indicate an issue with the feature or agent.
The enhanced recommendation scan improves upon the classic recommendation scan in the following ways:
  • Automatically runs within an hour after activation and at least once every 24 hours. This scan is short and efficient to avoid disrupting operations.
  • Improved efficiency allows more frequent scans for improved protection. Expect significantly lower use of system resources.
  • Reliable scans. Fewer failed scans means you can rely on the enhanced recommendation scan to provide regular recommendations.
  • More accurate with fewer incorrect or unnecessary recommendations.
  • Optimized performance with recommendations based on security rules that you require.
  • Fewer limitations than the classic recommendation scan:
    • Can recommend new web application rules, if applicable.
    • Applications like Red Hat JBoss, Apache Struts, Oracle Weblogic, CMS applications, and other applications no longer have unnecessary recommendations.
    • On Linux systems, better detection for software that is not installed through the operating system's default package manager.
Enhanced recommendation scans configured to automatically implement recommendations do so immediately for the first scan, as soon as new recommendations are received. These scans do not wait for an ongoing or scheduled scan to be run.
The enhanced recommendation scan has the following requirements:
  • Agent version 20.0.1-21510 or later (see supported features by version for Linux, Windows, or Windows Server)
  • For agents earlier than version 20.0.2-4960, Activity Monitoring enabled
  • Internet of Things (IoT) traffic to Amazon Web Services (AWS) permitted through firewalls
    If the agent does not receive any recommendations for 36 hours and either IoT traffic to AWS is not permitted through the firewalls or the enhanced recommendation scan fails, the agent automatically falls back to the classic recommendation scan. Upon receiving recommendations from the enhanced recommendation scan, the agent immediately resumes using the enhanced recommendation scan.
Agents that do not meet the requirements for the enhanced recommendation scan automatically use the classic recommendation scan instead.
Related information

Implement enhanced recommendations

The enhanced recommendation scan automatically scans at least once every 24 hours to provide regular recommendations. Its execution timing cannot be controlled by creating a scheduled task. Scheduled tasks and ongoing scans implement enhanced recommendation scans independently using their own settings.

Procedure

  1. Enable and configure automatic rule implementation.
  2. Choose one of the following:
    Important
    Important
    Use either scheduled tasks or ongoing scans, but not both.

Manually run an enhanced recommendation scan

This scan for recommendations is similar to the classic recommendation scan but with a timeout for receiving results within 10 minutes. Clicking Scan for Recommendations disables the button during this timeout. If the recommendation scan results take longer than 10 minutes, the button becomes available so you can try again.
Enable Automatically implement rule recommendations to automatically implement recommendations based on the results of the manual scan.

Procedure

  1. Click the module where you want to run the scan:
    • Integrity Monitoring
    • Intrusion Prevention
    • Log Inspection
  2. On the General tab under Recommendations, click Scan for Recommendations.
    The results of the latest enhanced recommendation scan appear on the General tab of the Intrusion Prevention, Integrity Monitoring, or Log Inspection protection module.