TrendMicro Officescan Updates aren´t recognized correctly

[VUGD]

Hey folks,

I´ve been having some trouble regarding TrendMicro Officescan.

I made a policy which allows ‘trendmicro’, ‘trendmicro-officescan’ and ‘web-browsing’. The reason for adding ‘web-browsing’ was, that trendmicro usually get updates via normal http on Port 8080. I did this even though ‘trendmicro-officescan’ lists tcp port 8080 as one of the used ports in the application description. Besides that, I set application-default option for the used ports.

What I now experience is that the update connections get recognized as ‘web-browsing’. However, in my understanding, they are supposed to be identified as ‘trendmicro-officescan’. The second problem is, that the session gets blocked, even though web-browsing is in the allowed application list. A potential reason for that could be the application-default option, which allows makes web-browsing only on tcp/80.

Does anyone here have an idea, or made the same experience with TrendMicro officescan?

Is there any way I can make one policy for Officescan with application-default enabled? Or is it necessary to declare all ports individually?

[panos]

did you replicate this after updating applications to last version ?

still having the issue ?

[hyadavalli]

Hello,

If you are specifying application-default in service column that means web-browsing should be identified on port 80 not on port 8080.

Please use service column as any and verify it is working or not.

Adding to that if you are on OS 5.0.x version application should be identified as trendmicro-officescan after the first packet it received on web-browsing traffic.

Please make sure you are on latest Apps & Threats version and if you still see the similar behavior please open a case with support and they can forward to App team to modify the signature.

Regards,

Hari Yadavalli