Revamped Mac scan engine - OneView

As part of our ongoing commitment to enhancing endpoint protection, ThreatDown is introducing a new scan engine for macOS devices. This new scanning engine for Mac comes with full disk scan capabilities for enhanced threat detection and comprehensive protection while offering 3 types of scans to provide flexible scanning options.

Overview

The previous scanning engine only included one scan type. The new scan engine includes these scan types.

• Hyper Scan: This is a quick scan that resembles the existing scanning engine. It targets Adware, Potentially Unwanted Programs (PUPs), and traces and is used to assess the endpoint's general health.
• Threat Scan: This is a comprehensive scan that checks for Adware, PUPs, traces, and advanced macOS malware.
• Custom Scan: An exhaustive deep scan on a specific directory chosen by the admin.

Requirements

The new scanning engine is supported on macOS v11 and above.

Verify installation

Once you've waited enough time for the installation to complete, verify that the endpoints are using the new scanning engine:

1. Log in to OneView.
2. Go to Manage > Endpoints.
3. Click on an endpoint in the new group.
4. Click See more detaills.
5. Under Agents and plugins, check for the following versions:
   • Endpoint Protection: 1.7.206 and above.
   • Protection service version: 5.7.3 and above.

If the plugins aren't updated even after waiting for a while, confirm your endpoints meet the network access requirements. For more information, see Network access requirements and firewall settings for OneView.

If you still need assistance, contact Support.

Enable Full Disk Access

You can skip this step if you've already completed it for your endpoints previously. To see if any endpoints are missing Full Disk Access, check the Manage > Endpoints page in OneView. Check if any endpoints have the Needs Attention status indicating Full Disk Access is missing. For more information, see the following:

• Grant Full Disk Access on Mac devices in OneView
• Grant Full Disk Access for Mac endpoints using UAMDM - OneView
• Mac endpoint missing Full Disk Access in OneView

Configure scheduled scans

With the new scan engine running on some of your Mac devices, you can now configure the type of scan run on a scheduled frequency with scheduled scans. choose between Hyper, Threat, or Custom scans. 

1. Log in to OneView.
2. Go to Configure > Schedules.
3. Click the plus button to add a new schedule.
4. In the Schedule name and type tab, choose between Hyper, Threat, or Custom scan for macOS.
5. In the Schedule groups tab, select the test group of Mac endpoints with the new scanning engine.
6. In the Schedule frequency tab, select how often this scan runs.
7. Click Save. 

Mac devices with the new scanning engine will begin scanning with the chosen scan type at the next scheduled interval.