Linux Malware protection ?

Jani

I have installed WithSecure Elements EDR and EPP for Servers Premium to my Linux servers.

Malware protection is Disabled after installation.

Can I somehow get this working?

Ubuntu 20.04.6 LTS , Linux 5.15.0 -72 -generic

DEB packages are compatible with Debian and Ubuntu systems. Client version 12.0.445

JamesC

Hi @Jani ,

Thank you for reaching out to us on WithSecure Community.

Normally, this is caused by the default policy with a blank configuration of "Files and folders to scan" being assigned to the WithSecure™ EPP Elements for Servers (Linux client) or Linux Protection clients.

In order to make the real time scan working, there is a need to clone the default profile and add a path (for example, root directory of "/" for scanning all files) to that configuration in the policy file.

You could perform the following steps to clone the default profile if it has not been done yet, change the configuration for real time scanning, assign the cloned profile and trigger the full status update to solve this issue.

1.  Log in to the Elements Endpoint Protection Portal 
2.  Go to the Profiles page
3.  Click the three dots which are next to the profile you want to clone (WithSecure™ for Linux in this case)
4.  Select Clone Profile
5.  Enter a profile name (Label and description are optional)
6.  Select Real-time scanning in the profile
7.  Click on Add path under Files and folders to scan
8.  Add root directory of "/" to scan all files 
9.  Click Save and Publish
10. Go to the Devices tab
11. Select the affected Linux device
12. Click on Assign > Assign Profile
13. Select the cloned profile from the list
14. Click on Assign button
15. On Devices tab, select the affected Linux device again
16. Choose Send full status update

If the default profile has been cloned before but the configurations for real time scanning are not changed yet, follow the steps below to solve the issue.

1.  Log in to the Elements Endpoint Protection Portal 
2.  Go to the Profiles page
3.  Open the assigned profile
4.  Select Real-time scanning in the profile
5.  Click on Add path under Files and folders to scan
6.  Add root directory of "/" to scan all files 
7.  Click Save and Publish
8.  Go to the Devices tab
9.  Select the affected Linux device
10. Choose Send full status update