On the Device Posture Signal Configuration page, you can configure the following profiles:

• Anti-malware
• Certificate

Configure an anti-malware profile

Anti-malware profiles allow you to configure a set of parameters to verify the presence of active anti-malware software on enterprise devices.

On the Signal Configuration page, under Anti-malware Profiles, you can find all configured anti-malware profiles. With this feature, you can collect anti-malware signals that help you to evaluate the security posture of enterprise devices. There are two types of anti-malware profiles:

• The Any Vendor profile. This profile can be neither modified nor deleted. It checks if any anti-malware software is installed and considered active on the user's device:

  • On macOS, this corresponds to a preset list of anti-malware software that is detected by the EAA Client.

  • On Windows, this indicates any active anti-malware software registered with Windows Security Center.

• Custom anti-malware profiles. You can configure a custom anti-malware profile for a specific vendor per operating system to confirm if its software is installed and considered active on the device.

The following is the list of supported vendors that you can select for each of the operating systems. You can set the same or different anti-malware vendor for macOS and Windows.

You can apply the N/A (Not Applicable) value for one of the operating systems in your custom anti-malware profile if you're not interested in checking the anti-malware status of devices with that OS. N/A means that this profile won't be used to check the presence of active anti-malware software on devices with that operating system. So, for example, if you want to configure an anti-malware profile only for macOS devices, you can set the N/A value for Anti-malware for Windows and Anti-malware for Ubuntu criterion.

📘

You can set up to four additional anti-malware profiles. When you try to create the fifth profile, you receive an error message. In this situation, you have to delete one of the existing profiles, except the Any Vendor profile that cannot be deleted. Then, you can proceed with the creation of the new anti-malware profile.

1. In the Enterprise Center navigation menu, select Application Access > Device Posture > Signal Configuration.

2. Scroll down to Anti-malware Profiles.

3. In the Any Vendor profile, verify that the Any Vendor value is set for macOS, Windows, or Ubuntu.

4. To configure an additional anti-malware profile, click Add Anti-malware Profile (+).

The table below contains parameters that you have to configure for each custom anti-malware profile.

1. Click Save and, next, Create Anti-malware Profile.

Next steps:
After you created an anti-malware profile, signals collected from devices that have installed the selected vendor's anti-malware are checked against anti-malware profile parameters.

Now you may apply your anti-malware profile as a part of tier and tag configuration to evaluate security posture of devices, and allow or deny access to applications. See Configure tiers and tags.

Each device in your deployment will now be evaluated against any configured anti-malware profile and you may also use anti-malware profiles as criteria for creating inventory reports. See Create an inventory report.

The device history report provides you with the names of profiles that are met by a particular device. See Create a device history report.

From both inventory and device history reports, you can display the Device Details report where you can find the following information:

• Anti-malware. Displays the status of the anti-malware software that is installed on the device. The status can be:

  • Active (✓). On macOS, the active status means that Device Posture detected a specific anti-malware program as running on the device. On Windows, the active status means that Device Posture verified that a specific anti-malware program is installed, running and actively protecting the device.

  • Inactive (✗). On macOS, the inactive status is not reported. On Windows, the inactive status means that Device Posture verified that a specific anti-malware program is installed and running but not actively protecting the device.

📘

With versions of EAA Client earlier than 2.4.0, it is not possible to determine which of the installed anti-malware programs is active. The older versions of EAA Client can only confirm that at least one of the supported anti-malware programs installed on the device is active.

As long as one of the program's statuses is active, Device Posture marks the Any Vendor profile as passed.

• Unknown - status cannot be determined (yellow circle).

Refers to Windows devices running the EAA Client version earlier than 2.4.0. For those devices it is not possible to determine which of the installed anti-malware programs is active. Consequently those devices are assigned the unknown status.

The unknown status is not applicable to macOS devices. As mentioned above, macOS devices don't report the inactive status. Consequently, if any anti-malware software is detected on the device, it's always considered active.

• Anti-malware Profile(s). Displays the list of configured anti-malware profiles and their statuses for the selected device.

  • Passed (✓). Identifies the profiles that are met by the selected device.

  • Failed (✗). Identifies the profiles that aren't met by the selected device.

Configure a certificate profile

Certificate profiles allow you to configure a set of parameters to verify certificates present on a device. After you have defined certificate profiles you can apply them to tiers and tags configuration to allow or deny access to applications. Signals collected from enterprise devices can also be monitored in the Device Details report for any device on your system using device posture.

See Certificates in EAA to learn more about the use of certificates in Enterprise Application Access.

📘

This feature does not verify that the browser used for accessing your protected resources is using the certificate specified as part of certificate profiles. It does verify the presence of certificates and related parameters on the device.

Prerequisites

• Upload a Certificate Authority (CA) certificate to verify device certificates.

• Optionally, Create an online certificate status protocol (OCSP) responder to check for revoked certificates.

📘

Only external type OCSP servers can be configured as part of a certificate profile.

You only need to configure OCSP if you are going to select the Check Revocation Status (OCSP Server) option when you're configuring the certificate profile.

Certificate requirements:

• In order to pass verification the device certificate must have a private key and be signed by the configured Certificate Authority (CA).

• EAA Client will verify certificates stored in the following locations on the user's device:

  • macOS: System.keychain located in /Library/Keychains/System.keychain

  • Windows: CERT_SYSTEM_STORE_LOCAL_MACHINE/My located in SystemCertificates. For more information, see Microsoft guide on System Store Locations.

1. In the Enterprise Center navigation menu, select Application Access > Device Posture > Signal Configuration.

2. Go to Certificate Profiles and click Add Certificate Profile (+).
   You may create up to three certificate profiles.

3. Configure certificate profile parameters. The table below includes both mandatory and optional parameters. The obligatory parameters are marked with an asterisk.

4. Click Save.

Next steps:
After you created a certificate profile, signals collected from devices where it is installed are checked against certificate profile parameters.

Now you may apply your certificate profile as a part of tier and tag configuration to evaluate security posture of devices and allow or deny access to applications.

Each device in your deployment is now be evaluated against any configured certificate profiles and you may also use certificate profiles as criteria for creating inventory reports. See Create an inventory report and Create an inventory report for devices matching certificate profiles.