Scanning
Quick, full, system and scheduled scans according to group policies.
Where the module helps during an attack
Antivirus mainly acts when malicious code reaches and executes on a device. This is an indicative view, not a measurement.
| Area | Level |
|---|---|
| Reconnaissance | no direct role |
| Initial access | additional protection |
| Execution and persistence | primary role |
| Escalation and lateral movement | additional protection |
| Impact | additional protection |
| Investigation and recovery | additional protection |
Layered endpoint protection
Next-Gen Antivirus checks files and processes, quarantines malicious content locally and reports findings to the console.
The vendor describes three scanning layers: signature-based static analysis, real-time behavioural scanning and cloud lookups. XTP adds behaviour assessment using MITRE ATT&CK techniques.
XTP
Detection of suspicious behaviour, such as credential theft attempts or remote execution.
Remote Access Protection
Login monitoring and blocking of brute-force attacks and unauthorised remote sessions.
Firewall
Console management of Windows Firewall rules and isolation of suspicious computers.
Automatic response with context for administrators
The module is enabled in Heimdal agent policy. Administrators define scan profiles, schedules, exclusions and actions users may initiate.
When a threat is detected, it can quarantine files, isolate devices or terminate remote sessions without manual intervention. The console shows what happened and on which device.
- The firewall manages Windows Firewall and blocks the remote desktop port after repeated failed logins.
- Bulk exclusion imports help avoid disruption to approved applications.
- XTP enriches events with investigation context.
One console instead of multiple antivirus tools
The module suits businesses consolidating varied antivirus or separate tools into central endpoint management. Alongside other Heimdal modules, it forms the foundation of an EDR package.
Remote access protection helps where servers or computers are accessible through remote desktop or other administration tools.
- Different antivirus tools run without shared visibility.
- Servers are accessible through remote desktop.
- The team needs detections and quarantine in one place.
Deployment with APPSEC
Heimdal provides detection technologies and updates. APPSEC provides policy design, deployment and support as agreed. Your team decides exclusions and responds to alerts unless a managed service is contracted.
Baseline
We review existing antivirus, exclusions, sensitive applications and servers.
Migration plan
We agree group rollout order and removal of existing protection without leaving devices unprotected.
Pilot
We verify policies and exclusions on a smaller group and refine reporting.
Handover
We demonstrate detection, quarantine and isolation handling. Post-deployment support is specified in the proposal.
Things to consider
- The vendor compatibility matrix lists antivirus for Windows and macOS, and firewall for Windows only. This module does not cover Ubuntu.
- Two active antivirus tools may conflict. We therefore migrate by device group.
- Automatic isolation must match operational rules, especially for servers.
- Ransomware Encryption Protection is a separate module, assessed independently.
