We have hundreds of workstations, tens of servers, both Windows and Linux, in tens of premises, with centralized logs. And we have an internal rule that says the antivirus shall be centralized. I would like to understand the rationals for it and what does it mean exactly.

  • Is it to benefit from an alert by enriching all local antivirus instance with new IOC, avoiding propagation in other premises?
  • Is it to ease the updates?

2 Answers 2


The biggest benefit is reporting. Without central control, you have no idea if an endpoint is updated, having problems, on an old version of a client, whether there is a high-risk endpoint getting hit, or if there is a certain endpoint with a higher than average number of hits, etc.

If your AV solution allows you to distribute IoCs, then yes, that's a value, but that's not normal.

Endpoints should update themselves, so that's not an issue.

  • Doesn't all of this visible in the logs which are centralized and monitored?
    – lalebarde
    Commented Sep 26, 2018 at 13:35
  • 1
    If the logs contain that data, and it is possible to report on all those dimensions, which can be tricky, then centralised AV control can be replicated through logging and remote administration (for client management) in general. Many AV solutions provide lots of features, but that's outside of your question scope.
    – schroeder
    Commented Sep 26, 2018 at 13:50
  1. Reporting
  2. ease of use
  3. updating
  4. license management
  5. "Single Pane Window" - aka view your entire environment from one screen, view trends, analyze data quicker
  6. ease of deployment
  7. one throat to choke - if something breaks, you know where to go

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .