0

We have hundreds of workstations, tens of servers, both Windows and Linux, in tens of premises, with centralized logs. And we have an internal rule that says the antivirus shall be centralized. I would like to understand the rationals for it and what does it mean exactly.

  • Is it to benefit from an alert by enriching all local antivirus instance with new IOC, avoiding propagation in other premises?
  • Is it to ease the updates?
Improve this question

2 Answers 2

Reset to default
1

The biggest benefit is reporting. Without central control, you have no idea if an endpoint is updated, having problems, on an old version of a client, whether there is a high-risk endpoint getting hit, or if there is a certain endpoint with a higher than average number of hits, etc.

If your AV solution allows you to distribute IoCs, then yes, that's a value, but that's not normal.

Endpoints should update themselves, so that's not an issue.

Improve this answer
2
  • Doesn't all of this visible in the logs which are centralized and monitored?
    – lalebarde
    Sep 26, 2018 at 13:35
  • 1
    If the logs contain that data, and it is possible to report on all those dimensions, which can be tricky, then centralised AV control can be replicated through logging and remote administration (for client management) in general. Many AV solutions provide lots of features, but that's outside of your question scope.
    – schroeder ♦
    Sep 26, 2018 at 13:50
0
  1. Reporting
  2. ease of use
  3. updating
  4. license management
  5. "Single Pane Window" - aka view your entire environment from one screen, view trends, analyze data quicker
  6. ease of deployment
  7. one throat to choke - if something breaks, you know where to go
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.