Endpoint Security for Endpoint Manager tools and features

The underlying tool of Ivanti® Endpoint Security for Endpoint Manager is called Patch and Compliance. For information about security content and supported device platforms, and how to use the Patch and Compliance tool to perform security and compliance scanning and remediation, view scan results, generate security reports, and configure ongoing system security, see Patch and Compliance.

This help topic includes brief overviews of the following security management tools provided by the Ivanti® Endpoint Security for Endpoint Manager, with links to the tool's overview topic:

• Patch and Compliance
• CVE naming standard compliance
• Federal Desktop Core Configuration (FDCC) standards compliance
• Security Activity
• Agent Settings
• Endpoint Security
  • Application control overview
  • Agent settings: Ivanti Firewall
  • Device Control overview
• Ivanti Antivirus
• Common Ivanti tools included with Endpoint Security for Endpoint Manager
• Other Ivanti® Endpoint Manager features included with Endpoint Security for Endpoint Manager
• Where to go for more information

Patch and Compliance

Use Patch and Compliance to download the latest known vulnerability definitions (and other security content type definitions) and their associated patches. Scan managed devices, as well as core servers and consoles, for Ivanti software updates. Configure and run customized security assessment scans for known platform-specific vulnerabilities, spyware, system configuration security threats, antivirus scanners, and blocked or unauthorized applications.

With the Patch and Compliance tool, you can also:

• Create your own custom security definitions to scan devices for specific, potentially threatening conditions.
• Research, prioritize, download, and deploy and install patches.
• Create and run scheduled tasks and policies that remediate detected security risks.
• Configure whether the security scanner displays on end user devices during scan and repair processes, device reboot options, and the level of user interaction.
• View comprehensive security and patch information for scanned devices.
• Enable security alerting.
• Generate security reports.

For more information, see Patch and Compliance.

CVE naming standard compliance

Ivanti® Endpoint Security for Endpoint Manager products support the CVE (Common Vulnerabilities and Exposures) naming standard. With Patch and Compliance you can search for vulnerabilities by their CVE names, and view CVE information for downloaded vulnerability definitions.

For more information about the CVE naming convention, Ivanti compatibility with the CVE standard, and how to use CVE identification to find individual vulnerabilities in Patch and Compliance, see Search for vulnerabilities by CVE name.

Federal Desktop Core Configuration (FDCC) standards compliance

Ivanti® Endpoint Security for Endpoint Manager now provides extended support for the Federal Desktop Core Configuration (FDCC) Initiative.

In order to perform FDCC security scanning and remediation tasks, you must have a Ivanti® Endpoint Security for Endpoint Manager content subscription that allows you to download the FDCC-specific content, which includes: FDCC scanner detection and installation; FDCC compliance scanning and status reporting; and FDCC-certified vulnerability scanning and remediation by component.

With the FDCC-certified scanner and security content, you can scan your managed devices to ensure they comply with the Federal Desktop Core Configuration standards and requirements.

Security Activity

The Security Activity tool lets you view critical activity and status information for several security components and services. Security Activity provides a single tool window where you can easily see Ivanti Antivirus scan results, HIPS preventions, Ivanti Firewall preventions, Device Control blocked devices, and more.

For more information, see Security Activity overview.

Agent Settings

The Agent Settings tool let you create and manage settings files for several security components and services. Configurations (i.e., settings files) control how security services operate on managed devices.

With the Agent Settings tool, you can deploy security agent/services and their associated settings to your managed devices as part of the initial agent configuration, separate install or update tasks, and change settings tasks.

For more information, see Agent Settings overview.

Endpoint Security

The Endpoint Security tool protects your managed devices from zero-day attacks, firewall intrusions, prohibited application and process actions and behaviors, and unauthorized network and device connections.

Endpoint Security is comprised of customized settings files (saved feature and option configurations) that can be deployed to target devices for the following security components:

• Location awareness (network connection control via trusted locations)
• Host Intrusion Prevention System (HIPS)
• Ivanti Firewall
• Device Control
• Trusted File Lists

Application Control

Ivanti Application Control provides an additional layer of protection that proactively secures systems and applications from zero-day attacks (i.e., malicious unauthorized behavior). Using customized rules and file certifications, HIPS continuously monitors specified processes, files, applications, and registry keys, and blocks prohibited actions and behaviors. With Application Control, you can control which applications run on devices and how they are allowed to execute. Application Control lets you protect the file system, registry, system startup, and even detect stealth rootkits.

Because Application Control is a rule-based system, instead of a definition-based (i.e., signature-based) system such as known vulnerability, spyware, and antivirus scanning, it doesn't require ongoing file updates. You configure and deploy your own customized level of system security.

For more information, see Application control overview.

Ivanti Firewall

Ivanti Firewall lets you create and configure proprietary firewall settings to prevent unauthorized application behavior on your managed devices.

For more information, see Agent settings: Ivanti Firewall.

Device Control

Device Control adds another level of security to your Ivanti network by allowing you to monitor and restrict access to managed devices through I/O devices. With Device Control, you can restrict the use of devices that allow data access to the device, such as ports, modems, drives, USB devices, and wireless connections.

For more information, see Device Control overview.

Ivanti Antivirus

Ivanti Antivirus lets you protect all of your managed devices from the latest known viruses as well as suspected infections. Antivirus scans can also check for riskware (via an extended database). Ivanti Antivirus is a configurable virus protection tool that is fully integrated with both Ivanti® Endpoint Security for Endpoint Manager and Ivanti® Endpoint Manager.

Ivanti Antivirus provides a wide range of antivirus features, including: scheduled antivirus scans, on-demand scans, red-button scans, real-time file and email protection, automated downloading of virus definition file updates (the Ivanti virus signature database contains the very latest known virus definitions and is renewed several times a day), configuration of antivirus scan behavior and end user options, scan exclusions, as well as antivirus alerts and reports.

Additionally, you can view real-time antivirus information for scanned devices in both the main console and the web console's executive dashboard to quickly identify virus outbreaks and see virus control over a specified period of time.

For more information, see Ivanti Antivirus overview.

Common Ivanti tools included with Endpoint Security for Endpoint Manager

Common Ivanti tools provide the underlying device configuration and management capabilities in both Endpoint Manager and Endpoint Security for Endpoint Manager. The following tools are available in a Ivanti® Endpoint Security for Endpoint Manager implementation, appearing in the Tools menu in the console.

Agent Configuration

Use Agent Configuration to create custom agent configurations to deploy and install the necessary Ivanti agents required to manage and protect your network devices. These agents are the standard Ivanti agent (that includes the inventory scanner, local scheduler, bandwidth detection, and security scanner), the software distribution agent, and the software license monitoring agent (used for application blocking).

Reports

Use the Reports tool to generate and publish a wide variety of specialized reports that provide useful information about your managed devices, including several predefined Patch and Compliance, Antivirus, and Compliance reports.

Scheduled Tasks

Use Scheduled Tasks to create recurring tasks specifically related to security and patch management, remediation, compliance security enforcement, antivirus scans, and more. You can configure the task's targeted devices and scheduling options.

Unmanaged Device Discovery

Use Unmanaged Device Discover (UDD) to locate devices on your network that haven't submitted an inventory scan to the core database.

Extended device discovery (XDD) works outside the normal scan-based discovery methods used by UDD. Managed devices with the extended device discovery agent on them listen for ARP (Address Resolution Protocol) broadcasts and maintain a cache (both in memory and in a file on the local drive) of devices that make them. Extended device discovery can also detect WAP (wireless access point) devices.

Role-based administration

The User Management tool let you add users to Endpoint Security for Endpoint Manager management roles, and configure their access to specific tools and managed devices based on their administrative role.

With role-based administration, you assign roles (with their associated rights) to determine the tasks users can perform, and scopes (based on device groups, queries, LDAP directories, or custom directories) to determine the devices a user can view and manage. Roles that are available with Endpoint Security for Endpoint Manager include: Patch and Compliance, Network Access Control, Agent Settings, Software Distribution, Public Query Management, and Unmanaged Device Discovery.

Local accounts

Local accounts is an administrative tool used to manage the users and groups on local machines on your network. From the console, you can add and delete users and groups, add and remove users from groups, set and change passwords, edit user and group settings, and create tasks to reset passwords for multiple devices.

Other Ivanti® Endpoint Manager features included with Endpoint Security for Endpoint Manager

In addition to the tools listed above that appear in the console Tools menu, Endpoint Security for Endpoint Manager provides the following common Ivanti features:

• Windows console, additional consoles, web console
• Custom console layouts
• Network view for managed devices and queries
• Shortcut menus for managed devices and queries
• Service configuration
• Inventory
• Database queries
• Software distribution
• Software license monitoring
• Alerting
• Content replication and preferred servers

Where to go for more information

Following the security tool help topics, the remainder of the linked help topics are found in the Ivanti® Endpoint Manager help sections that cover the common Ivanti tools mentioned above (including information about understanding and using the console and network view).

Related topics

Welcome to Ivanti® Endpoint Security for Endpoint Manager