0

I've got an application that isn't very robust and, as a result, is very sensitive to anti-virus scanning. I tried both the basic/free Windows Defender and a NextGenAV (i.e., SentinelOne). Both had negative performance impact on the app's servers during business hours. I tried putting scanning exceptions in based on the vendor's and AV support recommendations. Unfortunately, I still ran into performance issues and had to disable AV on the servers supporting the app.

Since I concluded the app can't function with AV running on its servers, I'm wondering if it's possible to at least do an AV scan of an AWS snapshot of the servers that are offline so it won't impact performance. I checked with SentinelOne support and they don't offer that feature. Any other ideas how to accomplish an offline scan of a snapshot?

Improve this question
3
  • Would it be acceptable to have a full scan after hours before taking the snapshot?
    – Martheen
    Commented Dec 5, 2023 at 1:30
  • Possibly...it runs scheduled jobs at night that take a long time that it could conflict with but there may be a window of time I could squeeze in a scan if I can find a product that I can configure to scan only x hours and to stop if takes longer regardless of whether or not it's finished. Another issue with that is I would need a way to tell SentinelOne to scan after hours and not do any monitoring/scanning during the day. It's not designed to work like that so I'll need a different AV product. If you know of a cheap product that would be able to do this, let me know.
    – tyler
    Commented Dec 5, 2023 at 16:02
  • Unfortunately, we can't offer product recommendations.
    – schroeder ♦
    Commented Dec 5, 2023 at 22:26

2 Answers 2

Reset to default
1
  1. Take the snapshot
  2. Spin it up in a testing environment
  3. Scan it normally since app performance doesn't matter

You need space and compute for this new VM, but only for the length of the scan.

Improve this answer
0
  1. Did you disable real-time protection on the antivirus while conducting these trials?
  2. Exceptions specify a path to exclude from scans and interventions. If you're experiencing slowness in server CPU, RAM, and HDD, increasing resources may be an option. If not possible, you can adjust the scan severity to light for your preferred or chosen product.
  3. Try setting working hours and automatically pausing scans during those hours; many products, including Defender, have this feature.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .