Threat prevention and anti-malware configuration
This domain tests whether you can select and tune Harmony Endpoint blades so malware is caught without breaking normal work. You need to know what each blade actually inspects, where prevention becomes detection, and how remediation and performance settings interact.
Core blades and controls
- Anti-Malware scans files on access and on schedule using signatures, heuristics, and behavioral checks. Configure scan scope, removable media, archive handling, and quarantine behavior.
- Anti-Bot detects command-and-control callback patterns. Anti-Exploit protects processes from memory exploitation techniques.
- Anti-Ransomware/Behavioral Guard watches for mass file modification and can protect folders with backup and restore behavior.
- Threat Emulation detonates suspicious files in a sandbox and returns a verdict. Threat Extraction removes active content and delivers a sanitized file while the original is examined.
- Zero Phishing and content disinfection extend protection to web and document vectors.
Tuning rules
Prefer narrow exclusions over disabling a blade. Exclude a specific signed application or folder, not an entire drive. Keep removable-media scanning enabled. Allow sandbox verdicts time to return; do not treat a queued emulation as clean. Quarantine is containment, not proof of remediation.
Worked example
A user downloads a ZIP containing a macro-enabled document. Threat Extraction strips the macro and delivers a safe copy so the user can work, while Threat Emulation detonates the original. The sandbox returns malicious, and the file is quarantined. Reasoning: extraction reduces user downtime, emulation catches unknown or zero-day behavior that signatures miss, and quarantine prevents re-execution. If the document is business-critical but unsigned, the correct response is a scoped exception after validation, not disabling extraction for everyone.
Traps
- Excluding an entire drive or user profile to fix one false positive.
- Disabling Threat Extraction globally because of slow document opening.
- Relying only on signatures and ignoring emulation or behavioral detection.
- Forgetting removable media and archive scanning.
- Releasing a quarantined file without a new scan or vendor confirmation.
- Assuming a blocked download means the endpoint is clean; run a scan and review forensic activity.