Service Composer can identify infected systems on your network with 3rd party antivirus solutions and quarantine them to prevent further outbreaks.

Our sample scenario shows how you can protect your desktops end to end.

Configuring Service Composer
workflow
Service Composer Conditional Workflow
test

vShield Endpoint and a partner solution have been installed on the cluster where the desktops need to be protected.

1

Install, register, and deploy the Symantec Antimalware solution.

2

Create a security policy for your desktops.

a

Click the Security Policies tab and click the Add Security Policy icon.

b

In Name, type DesktopPolicy.

c

In Description, type Antivirus scan for all desktops.

d

Change the weight to 51000. The policy precedence is set very high so as to ensure that it is enforced above all other policies.

e

Click Next.

f

On the Add Endpoint Service page, click add and fill in the following values.

Option

Value

Action

Do not modify the default value

Service Type

Anti Virus

Service Name

Symantec Antimalware

Service Configuration

Silver

State

Do not modify the default value

Enforce

Do not modify the default value

Name

Desktop AV

Description

Mandatory policy to be applied on all desktops

g

Click OK.

h

Do not add any firewall or network introspection services and click Finish.

3

Create a security policy for infected virtual machines.

a

Click the Security Policies tab and click the Add Security Policy icon.

b

In Name, type QuarantinePolicy.

c

In Description, type Policy to be applied to all infected systems..

d

Do not change the default weight.

e

Click Next.

f

On the Add Endpoint Service page, do not do anything and click Next.

g

In Firewall, add three rules - one rule to block all outgoing traffic, the next rule to block all traffic with groups, and the last rule to allow incoming traffic only from remediation tools.

h

Do not add any network introspection services and click Finish.

4

Move QuarantinePolicy to the top of the security policy table to ensure that it is enforced before all other policies.

a

Click the Manage Priority icon.

b

Select QuarantinePolicy and click the Move Up icon.

5

Create a security group for all desktops in your environment.

a

Log in to the vSphere Web Client.

b

Click Networking & Security and then click Service Composer.

c

Click the Security Groups tab and click the Add Security Group icon.

d

In Name, type DesktopSecurityGroup.

e

In Description, type All desktops.

f

Click Next on the next couple of pages.

g

Review your selections on the Ready to Complete page and click Finish.

6

Create a Quarantine security group where the infected virtual machines are to be placed.

a

Click the Security Groups tab and click the Add Security Group icon.

b

In Name, type QuarantineSecurityGroup.

c

In Description, type Dynamic group membership based on infected VMs identified by the antivirus scan.

d

On the Define membership Criteria page click add and add the following criteria.quar

e

Do not do anything on the Select objects to include or Select objects to exclude pages and click Next.

f

Review your selections on the Ready to Complete page and click Finish.

7

Map the DesktopPolicy policy to the DesktopSecurityGroup security group.

a

On the Security Policies tab, ensure that the DesktopPolicy policy is selected.

b

Click the Apply Security Policy (apply) icon and select the SG_Desktops group.

c

Click OK.

This mapping ensures that all desktops (part of the DesktopSecurityGroup) are scanned when an antivirus scan is triggered.

8

Navigate to the canvas view to confirm that QuarantineSecurityGroup does not include any virtual machines yet.

a

Click the Information Security tab.

b

Confirm that there are 0 virtual machines in the group (vm)

9

Map QuarantinePolicy to QuarantineSecurityGroup.

This mapping ensures that no traffic flows to the infected systems.

10

From the Symantec Antimalware console, trigger a scan on your network.

The scan discovers infected virtual machine and tags them with the security tag AntiVirus.virusFound. The tagged virtual machines are instantly added to QuarantineSecurityGroup. The QuarantinePolicy allows no traffic to and from the infected systems.