Use case

The company network rules prohibit registered hosts on the network from having LimeWire installed on the host. Hosts are required to have a Persistent Agent and are scanned daily to maintain compliance. If LimeWire is installed, the host will receive three warnings before being removed from the network.

To set up a custom scan to enforce this rule:

1. Create a custom scan for registry key, enter the details for LimeWire, set Prohibit to True, and set the Severity Level to Warning. See Windows or macOS.
2. Create a regular scan and enable the custom scan within that scan. See Add or modify a scan.
3. Schedule the regular scan to be rerun daily. See Schedule a scan.
4. Create an endpoint compliance policy that contains the regular Scan. See Endpoint compliance policies.
5. Map the Security Risk Host event to an alarm that will take action on the third occurrence of the event, and set the host At Risk and Send a message. See Add or modify alarm mapping.
6. Configure the Persistent Agent Properties Warning message block. See Properties.

7. Configure the web page that the host will be redirected to when moved to Remediation. The web page used is created outside the program. In order to keep this page from being overwritten during an upgrade, it should be stored in /bsc/Registration/registration/site. Then, return to your custom scan and modify it to contain the new web address.

   If the host fails the scan, the first two times, the Warning message is sent. On the third failure, the host is sent the Warning message, is marked At Risk, and moved to Remediation. The web page informs the user about the failure to meet policy requirements. The host self-remediates and rescans. When the host passes the policy, the host is moved back to the production network.