FortiNAC Custom Scans - Regular Expressions

[jprocha]

Hello, everyone!

I am facing a question regarding custom scans on FortiNAC.

Currently I have a scan to check for my AV service. Every once in a while the network agent gets updated and the syntax for the service name changes. After that, all my hosts start to fail the scans.

Is there anyway to turn the service name into a regular expression? Let's say, instead of checking for a service "ABC.20.17", am I able to check for "ABC.20.*" for any patch version of the given service? Tried on my lab environment but did't work.

Appreciate the help!

FortiNAC  

[ebilcari]

The Antivirus checks are predefined in FortiNAC and are automatically updated, there is no need to use custom scan to check them. Is this a specific antivirus not supported yet by FortiNAC?

[jprocha]

I use custom scans as a way to make sure the AV is not only installed but also running on the machine and apply monitoring to verify it stays active.

[ebilcari · Accepted solution]

You can schedule the Scan to run every 10~60 minutes, it will check the AV installation, updates and also the status, like for example:

The 'Processes' custom scan would require the full name of the process like 'notepad.exe', as I know it will not accept any wildcard options since it's designed for specific checks.

[jprocha]

Thank you for the return.

Unfortunately looks like the Real-time Protection Check is only available for Windows Defender. Other AVs don't have this option. Might be something nice for a future update.

Appreciate the help!

Regards,