New Technical Paper: Considerations for configuring antivirus software for ArcGIS Enterprise hosts

[RandallWilliams]

Esri Software Security and Privacy has recently released a new technical paper:

Considerations for configuring antivirus software for ArcGIS Enterprise hosts

This document augments the existing kB: FAQ: Which ArcGIS Enterprise directories should be excluded for security or antivirus software? And is a valuable resource for teams installing, configuring, and administering ArcGIS Enterprise

Hosted in the customer only section of the ArcGIS Trust Center documents repository, this paper dives deep into:

• Defining Risk Factors that influence virus scanning decisions
• Differentiating between Anti-Virus tools and methods
• Describing workflows where virus scanning activities should be relaxed
• Identifying files, directories, and processes to exclude from active scans

[DrewDowling]

@RandallWilliams Is there a link to this document? I'm not seeing it and I searched the Trust center for the paper name and nothing is showing up.

'

[NicholasEverdell]

@DrewDowling - I found it in here - Secure Documents | ArcGIS Trust Center | Documentation

[BaileyBellavance]

Neither of these links work to access these articles, and I can't find it in the knowledge base. Can you please re-share these?

[DrewDowling]

@BaileyBellavanceThe document seems to have been moved to the "Customer Documents" section.

Try this link. I think you need to be logged in with an AGOL account.

https://trust.arcgis.com/en/customer-documents/ArcGIS_Enterprise_AV_Guidance.pdf

[chriscothran1]

None of these links appear to work now, and I don't see a document listing antivirus software exclusions for ESRI Enterprise solutions.

[RandallWilliams]

Link changed w/ version 3.1:

https://trust.arcgis.com/en/customer-documents/ArcGIS_Vulnerability_Scanning_Guidance_v31.pdf

Check out the other resources in the customer exclusive area of the ArcGIS Trust Center. You may also find the WAF guide helpful. 

[chriscothran1]

@RandallWilliams Sir,  I don't see anything in that pdf listing exclusions for antivirus software.  Your original post in 2020 references a document and a KB that addressed what should be ignored by antivirus software.  Those documents seem to have been removed, and searches within ESRI's documentation have not produced relevant findings for me.  Thanks for your time. 

Respectfully, Chris

[RandallWilliams]

OOPS, I'm forever tranposing the vuln scan guidnce and the AV guidance and the link is indeed broken.

I'll work with our doc team to get this fixed. 

[Leighton]

@RandallWilliams Any update on this? I have urls that used to contain this info, they no longer work: https://support.esri.com/en-us/knowledge-base/000015732 and https://support.esri.com/en/technical-article/000015732. Not sure if that helps your work with the doc team?

[RandallWilliams]

There is an updated version in the customer exclusive documents repository in the ArcGIS Trust Center. 

https://trust.arcgis.com/en/customer-documents/

[JeffClough]

Hi @RandallWilliams , I'm not able to locate this updated document after logging into the trust center and performing a search.  Can you please post a direct link?

And, of course I found the document just after posting the above.  Please disregard.

[RandallWilliams]

No worries, here's the link:

https://trust.arcgis.com/en/customer-documents/ArcGIS_Enterprise_AV_Guidance.pdf

[StephenKaranja]

Thanks @RandallWilliams for the link.

[chriscothran1]

https://trust.arcgis.com/en/customer-documents/ArcGIS_Enterprise_AV_Guidance.pdf

This link no longer works.  Does ESRI have a new list for Anti-virus exclusions?

Respectfully,

Chris

[George_Thompson]

@chriscothran1 the link works, but you must sign into the site first. Look in the upper right hand corner.

[chriscothran1]

Good morning George,

I've tried the link multiple times and it redirects me to Secure Documents | ArcGIS Trust Center | Documentation

which is the customer library.  I can go to any of the other pdf docs in that library.  It looks the file is no longer in the trust center.

Chris

[RandallWilliams]

Link works for me. If you're taken to the customer exclusive docs, this is the one you want. 

[AngusHooper1]

Is there more specific documentation or guidance for Linux hosts as opposed to Windows?

[BrendanBladdickEsri]

@RandallWilliams this is the only one I could find https://community.esri.com/ccqpr47374/attachments/ccqpr47374/arcgis-enterprise-questions/34728/1/Arc...
is this up to date? Or is there a newer one, I have been searching for a while and this is the only thing I can come across with information on which folders to exclude.

[JamieKellyMOD]

That tile does not appear to be working currently, I'm logged in and I click on it, it attempts to load the referred to PDF path, but then redirects back to that same Security Documents page.

Need to get this looked at ASAP as all of a sudden for the last couple of days the on access scanner is awfully busy on that server despite never being an issue previously.  So I need to ensure we put in place any necessary exclusions to ensure it's not affecting the server or it's performance for our stakeholders.

[RandallWilliams]

It's in the customer exclusive area of the ArcGIS Trust Center document repository. Current version 4.3.

ArcGIS Vulnerability Scanning guidance

[JamieKellyMOD]

Yes, I'm aware, I'm in the customer documents section, I can see and click on the tile you have referenced labelled "Considerations for configuring antivirus software for ArcGIS Enterprise hosts", which links to https://trust.arcgis.com/en/customer-documents/ArcGIS_Enterprise_AV_Guidance.pdf

However that URL does not load and instead redirects back to the documents portal page again.

[RandallWilliams]

Works for me, please clear your browser cache. 

[JamieKellyMOD]

I've not only tried that, I've tried another browser and even another workstation

[RandallWilliams]

Attempted to DM, but recd message "None of the users have PM enabled. Message will not be sent". Please enable DM and I'll send it. 

[JamieKellyMOD]

I don't seem to have any private message panel nor the options in my settings to either enable or disable it.

[NicholasEverdell]

Please Sign in at the top before accessing this link:

https://trust.arcgis.com/en/customer-documents/ArcGIS_Vulnerability_Scanning_Guidance.pdf

PDF should download automatically.

[ChristinaKellum]

It does not download automatically in Chrome, but opens up in Edge.

[JamieKellyMOD]

In the end I tried an older trick or right clicking on that tile link and chose to Save Link As directly instead of attempting to allow the browsers to open it.  That allowed me to save the PDF I needed anyway.