We have hundreds of workstations, tens of servers, both Windows and Linux, in tens of premises, with centralized logs. And we have an internal rule that says the antivirus shall be centralized. I would like to understand the rationals for it and what does it mean exactly.
- Is it to benefit from an alert by enriching all local antivirus instance with new IOC, avoiding propagation in other premises?
- Is it to ease the updates?