I am looking for a new Antivirus Solution for ArcGIS Enterprise.
Let me know what you are using!
I saw people posting that Sophos and Crowdstrike are good. Please do not believe it. I have seen both render Portal broken and inaccessible. Those are literally the biggest two to absolutely avoid. Just run Defender. Any AV could mess up your enterprise, honestly and all of them will slow it down.
I understand your frustration. I had many challenges with Anti-Virus and ArcGIS software myself. During the ArcGIS Enterprise upgrade the best approach is to temporarily disable the Anti-Virus if possible. Please, see the white paper below. I hope this helps.Technical Paper: Considerations for configuring antivirus software for ArcGIS Enterprise hosts
https://community.esri.com/t5/esri-software-security-privacy-blog/new-technical-paper-considerations-for-configuring/bc-p/1500566/highlight/trueUse this link to open the PDF document - ArcGIS Antivirus GuidanceHere is a link highlighting the document in trust center:
https://trust.arcgis.com/en/customer-documents/?p=0.2941289993696301#:~:text=Considerations%20for%20...
FAQ: How Do I Troubleshoot ArcGIS pro Performance Issues Related to Antivirus Software (Ex
The whole reason for my original question was because our IT department installed Sophos and it corrupted our Portal. We had thousands of orphaned SOC processes that would never end and would run the machine out of resources. It also caused issues during upgrades that absolutely rendered the Portal inaccessible. We did have IT implement the white list and still had tons of issues that broke ArcGIS Enterprise. So I cannot get on board with Sophos and ArcGIS Enterprise compatibility claims.
We made IT uninstall Sophos and we were able to restore our Portal and start using it again without issues. Now our IT department now wants to force CrowdStrike on us. We are already running it on our workstations and (again, white list exceptions are already in place) we see nothing but issues. Projects locking up and crashing constantly. Simple attribute edits that take minutes to commit. With the issues we have with Pro I am very hesitant to have it installed on our ArcGIS Enterprise servers.
I should point out that there are several typos in the white list and we had to navigate to every single folder to get the actual path (not just blindly copying and pasting the bad paths with typos into the exceptions.)
I am starting to believe that ESRI just doesn't care about their customers as their software is getting progressively worse over time (not better as one would expect from a company with such a large market). Pro (the most user unfriendly software ever developed) and ArcGIS Enterprise are so bug ridden now that it makes me want to retire early.
I have used Sophos and Crowdstrike, and worked with customers using these Anti-Viruses software. The trick is that the IT department needs to white-list the ArcGIS Enterprise software installation folders, the configure store folder. Then, there will not be any issue with ArcGIS Enterprise performance. More info at ArcGIS security—ArcGIS Trust Center | DocumentationPlease, see the white paper below.Technical Paper: Considerations for configuring antivirus software for ArcGIS Enterprise hosts
https://community.esri.com/t5/esri-software-security-privacy-blog/new-technical-paper-considerations-for-configuring/bc-p/1500566/highlight/trueUse this link to open the PDF document - ArcGIS Antivirus Guidance
Here is a link highlighting the document in trust center:
FAQ: How Do I Troubleshoot ArcGIS pro Performance Issues Related to Antivirus Software (ExI hope this helps.
As a side note: be aware that some Antivirus software will move the Portal content directory into quarantine when installing Portal for ArcGIS. Had this happened to me a few times, causing the installation/update to fail. Some programs are sensitive to the Portal for ArcGIS installer extracting 60.000 files in the contents directory...So make yourself familiar with the software you or your IT department uses and how it may interfere with ArcGIS Enterprise.
Hey @Kathleen_Crombez
Currently, none of the exceptions were made in my AV when assembling ArcGIS Enterprise. We do not exclude any file from being scanned and these scans that take place have not caused any significant strain on the servers that host the environment. I can definitely understand an AV causing issues, as I've worked with quite a few, but this one is quite straight forward! I've had no issues with false positives as well.
Cody
Are Sophos and CrowdStrike both tested and used in production at ESRI?
Yes, we use it internally and have customers that use it too.Do you notice any benefits or downsides from one to the other in comparison?Your IT department will have to evaluate that but usually price is the decision factor.
We were purchased by a bigger company and change to Cortex was due to parent company. I did not do anything to our Esri servers with Crowdstrike or Cortex, as neither of them caused any issues. (We have numerous ArcGIS servers (10.8.1 to 11.3) federated to our 11.3 portal)
@MarceloMarques-
Thank you for the link. I have seen this post in the past but they have updated the link for the ArcGIS Antivirus Guidance document.
Do you notice any benefits or downsides from one to the other in comparison?
Thanks again,
Kathleen
@GregoryCarson-
Thank you!
Was there a reason you switched from CrowdStrike to Cortex? Do you notice any benefits or downsides from one to the other in comparison?
Any issues with installation or upgrades?
Thanks again!
@CodyPatterson-
Thank you for the information!
Did you have to configure all the exceptions as recommended in the ArcGIS Antivirus Guidance
From my past experience most anti-virus software is destructive to the ArcGIS Enterprise suite and makes installation/upgrades downright impossible while the software is active. So I am really happy to receive a recommendation from someone with both GIS and IT experience.
Thank you again!
@Kathleen_Crombez Sophos, CrowdStrikeNew Technical Paper: Considerations for configuring antivirus software for ArcGIS Enterprise hosts (esri.com)
We have used Crowdstrike in the past and now use Cortex without any issues.
My company uses SentinelOne as AV, personally, I've had no issue installing and using the various ArcGIS Enterprise software while this AV is active. I previously worked for IT in the same company, and have found the AV to be quite reliable, I would personally recommend it.
サインインしたメンバーは投稿、更新のフォローなどができます。初めてですか？無料アカウントを登録してください。
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.
transparent.png)
