Skip to main content
HS08
HS08
Visitor III
July 2, 2026
Solved

FNAC Compliance Parameter

  • July 2, 2026
  • 3 replies
  • 54 views

I use persistent agent to checking antivirus on the client before the client can connect to the network.

My question is what parameter will be checking by PA? Is antivirus realtime protection is on/off, is antivirus batabase signature updated or not, or something else?

Best answer by HS08

It’sdone by pointing the rule to internal web server or checking. Thanks

3 replies

AEK
SuperUser
AEK
SuperUser
July 6, 2026

I think this should be customized under Compliance Scan > Windows > Antivirus.

AEK
HS08
HS08Author
Visitor III
July 6, 2026

No, I just found the captive portal use URL http://www.google.com/images/srpr/logo11w.png to detect the network was change to production or not.

We can see theis from portal setting - configuration - registration - success. Now how we can change the javascript so for detection will use ping to specific internal ip such as ping to 10.10.10.10?

     * The URL to request as a means of detecting when the user has been
     * successfully switched to production.  If you do not allow them external
     * access, change this to an internal URL which they do not have access to
     * without authentication.  Changing this from loading jQuery will require
     * changing SR.isSuccessfulRequest.  NOTE: This should be the URL of a
     * JavaScript library or image on the web!
     *
     * @type string
     */
    detectionReferenceURL = "http://www.google.com/images/srpr/logo11w.png",

    /**
     * Use img tag to detect
     *
     * @type boolean
     */
    useImage = true,

    ebilcari
    Staff
    ebilcari
    Staff
    July 8, 2026

    Technically, this is JavaScript and can be customized but as far as I know, it does not provide the ability to perform a traditional ping. It would be easier to change the URL to point to an object or resource hosted on an internal website.

    Emirjon
    AEK
    SuperUser
    AEK
    SuperUser
    July 6, 2026

    I currently don’t have FNAC in my lab, but in case you don’t find how to customize it on the WebUI then try access CLI ”exec enter-shell” and try some command like shown blow to find which file contains this setting:

    grep -rnw ‘/some/path’ -e ‘logo11w.png’ 2>/dev/null

    AEK
    HS08
    HS08AuthorAnswer
    Visitor III
    July 7, 2026

    It’sdone by pointing the rule to internal web server or checking. Thanks

    ebilcari
    Staff
    ebilcari
    Staff
    July 8, 2026

    Depending on the antivirus vendor, a specific set of registry values is checked on the end host. The results can be seen in the Agent logs after a scan is triggered, similar to the following:

        <section group="kes12" instr="sma/antivirusdefs.jsp" name="Kaspersky Endpoint Security 12 Definitions" prohibit="false">
            <or>
                <GetRegistryEntry action="match" keyName="SOFTWARE\KasperskyLab\protected\KES\Data" longValue="1780928423" matchOper="gte" rootKey="HKEY_LOCAL_MACHINE" valueName="LastSuccessfulUpdate"/>
                <GetRegistryEntry action="match" keyName="SOFTWARE\KasperskyLab\protected\KES.12.12\Data" longValue="1780928423" matchOper="gte" rootKey="HKEY_LOCAL_MACHINE" valueName="LastSuccessfulUpdate"/>
                <GetRegistryEntry action="match" keyName="SOFTWARE\KasperskyLab\protected\KES.12.11\Data" longValue="1780928423" matchOper="gte" rootKey="HKEY_LOCAL_MACHINE" valueName="LastSuccessfulUpdate"/>
                <GetRegistryEntry action="match" keyName="SOFTWARE\KasperskyLab\protected\KES.12.10\Data" longValue="1780928423" matchOper="gte" rootKey="HKEY_LOCAL_MACHINE" valueName="LastSuccessfulUpdate"/>

     

    Emirjon
    Terms & ConditionsAccessibility statement