Xcitium Enterprise

• Introduction To Xcitium Client Security
  • Special Features
  • System Requirements
  • Install Xcitium Client Security
  • Start Xcitium Client Security
  • The Main Interface
    • The Home Screen
    • The Tasks Interface
    • The Widget
    • The System Tray Icon
  • Understand Security Alerts
  • Password Protection
• General Tasks - Introduction
  • Scan And Clean Your Computer
    • Run A Quick Scan
    • Run A Full Computer Scan
    • Run A Rating Scan
    • Run A Custom Scan
      • Create, Schedule And Run A Custom Scan Profile
    • Automatically Scan Unrecognized And Quarantined Files
  • Instantly Scan Files And Folders
  • Process Infected Files
  • Manage Virus Database Updates
  • Manage Blocked Autoruns
  • Manage Quarantined Items
• Firewall Tasks - Introduction
  • Configure Internet Access Rights For Applications
  • Stealth Your Computer Ports
  • Manage Network Connections
  • Stop All Network Activities
  • View Active Internet Connections
• Containment Tasks - Introduction
  • Run An Application In The Container
  • Reset The Container
  • Identify And Kill Unsafe Running Processes
  • Open Shared Space
  • The Virtual Desktop
    • Start The Virtual Desktop
    • The Main Interface
    • Run Browsers Inside The Virtual Desktop
    • Open Files And Run Applications Inside The Virtual Desktop
    • Pause And Resume The Virtual Desktop
    • Close The Virtual Desktop
• DLP Tasks - Introduction
  • Run Data Loss Prevention Scans
  • Manage DLP Quarantined Files
• Advanced Tasks - Introduction
  • Create A Rescue Disk
    • Download And Burn Comodo Rescue Disk
  • Remove Deeply Hidden Malware
  • Manage XCS Tasks
  • View XCS Logs
    • Antivirus Logs
    • VirusScope Logs
    • Firewall Logs
    • HIPS Logs
    • Containment Logs
    • Website Filtering Logs
    • Device Control Logs
    • Autorun Event Logs
    • Alerts Logs
    • XCS Tasks Logs
    • File List Changes Logs
    • Vendor List Changes Logs
    • Configuration Changes Logs
    • Virtual Desktop Event Logs
    • Data Loss Prevention Event Logs
    • Search And Filter Logs
  • Submit Files For Analysis To Xcitium
  • View Active Process List
• XCS Advanced Settings
  • General Settings
    • Customize User Interface
    • Configure Virus Database Updates
    • Log Settings
    • Manage XCS Configurations
      • Xcitium Preset Configurations
      • Personal Configurations
    • Manage Performance
  • Antivirus Configuration
    • Real-time Scanner Settings
    • Scan Profiles
  • Firewall Configuration
    • General Firewall Settings
    • Application Rules
    • Global Rules
    • Firewall Rule Sets
    • Network Zones
      • Network Zones
      • Blocked Zones
    • Port Sets
  • HIPS Configuration
    • HIPS Settings
    • Active HIPS Rules
    • HIPS Rule Sets
    • HIPS Groups
      • Registry Groups
      • COM Groups
  • Protected Objects
    • Protected Objects - HIPS
      • Protected Files
      • Blocked Files
      • Protected Registry Keys
      • Protected COM Interfaces
    • Protected Objects - Containment
      • Protected Files And Folders
      • Protected Keys
  • Data Loss Prevention
    • DLP Monitoring Rules
    • DLP Discovery Rules
    • DLP Keyword Groups
  • Containment Settings
    • Containment Settings
    • Auto-Containment Rules
    • Virtual Desktop Settings
    • Containment - An Overview
    • Unknown Files - The Scanning Processes
  • File Rating Configuration
    • File Rating Settings
    • File Groups
    • Submitted Files
  • Advanced Protection
    • VirusScope Settings
    • Scan Exclusions
    • Device Control Settings
    • Script Analysis Settings
    • Miscellaneous Settings
  • Web Filter Settings
    • Website Filtering Rules
    • Website Categories
• Appendix 1 - XCS How To... Tutorials
  • Enable / Disable AV, Firewall, Auto-Containment And VirusScope Easily
  • Set Up The Firewall For Maximum Security And Usability
  • Block Internet Access While Allowing Local Area Network (LAN) Access
  • Block / Allow Specific Websites To Specific Users
  • Set Up HIPS For Maximum Security And Usability
  • Create Rules To Auto-Contain Applications
  • Run An Instant Antivirus Scan On Selected Items
  • Create An Antivirus Scan Schedule
  • Run Untrusted Programs Inside The Container
  • Run Browsers Inside The Container
  • Restore Incorrectly Quarantined Items
  • Submit Quarantined Items To Xcitium Verdict Cloud For Analysis
  • Enable File Sharing Applications Like BitTorrent And Emule
  • Block Any Downloads Of A Specific File Type
  • Disable Auto-Containment On A Per-application Basis
  • Switch Off Automatic Antivirus Updates
  • Suppress XCS Alerts Temporarily
  • Control External Device Accessibility
• Appendix 2 - Xcitium Secure DNS Service
  • Router - Manually Enable Or Disable Xcitium Secure DNS
  • Windows - Enable Xcitium Secure DNS
• About Xcitium

File Rating Settings

 

Click 'Settings' > 'File Rating' > 'File Rating Settings'

• A file rating determines how XCS interacts with a file:

• 'Trusted' files are safe to run.

• 'Untrusted' files are malware so they get quarantined or deleted.

• 'Unknown' files are run in the container until they get rated as trusted or untrusted.

• The rating of a file can change over time, especially in the case of 'unknown' files. For example, an unknown file might be re-classified as 'trusted' or 'untrusted' after it has been tested.

• You can also configure whether XCS should auto-upload unknown files to Xcitium for analysis.

Open the 'File Rating Settings' interface

• Click 'Settings' on the XCS home screen
  
  
• Click 'File Rating' > 'File Rating Settings'
  
  

 

• Enable Cloud Lookup - XCS checks a file's trust rating on our cloud severs as part of the real-time scan process. (Default and recommended = Enabled) 

• Analyze unknown files in the cloud by uploading them for instant analysis - XCS uploads files with an 'unknown' trust rating to Xcitium for further analysis. Our experts will analyze the file, award it a trust rating, and add it to the global whitelist or blacklist as appropriate. (Default = Disabled)

• Upload metadata of unknown files to the cloud - Metadata is basic file information such as file source, author, date of creation and so on. If enabled, XCS will also send the file metadata when uploading unknown files to Xcitium. (Default = Enabled)

• Do not show popup alerts - Whether or not XCS should show an alert when malware is detected by the cloud scanner (FLS). (Default = Enabled)

• Enabled - No alerts are shown. This minimizes disturbances but at some loss of user awareness.

XCS will automatically block and quarantine the threat.

• Disabled - A rating scanner alert is shown for malicious files.

You can choose from these actions:

• Clean - The program is blocked and quarantined

• Ignore - Allows the file to run. Does not attempt to clean the file or move it to quarantine. Only click 'Ignore' if you are absolutely sure the file is safe. Clicking 'Ignore' will open three further options:

 

• Ignore Once - The file is allowed to run this time, but it will still be flagged as a threat by future scans.

• Ignore and Add to Exclusions - The file is allowed to run this time, and will not be flagged as a threat in future scans. The file is placed on the Exclusions list, meaning it is ignored permanently by the scanner.

• Ignore and Report as a False Alert - The file is allowed to run this time, and submitted to Xcitium for analysis. Select this option if you think the file is safe, and that XCS was wrong to flag it as a threat. Xcitium will re-examine the file.
  
  
• Terminate the entire process chain of malware detected by rating scan - When a malicious process is detected, the entire process tree can be terminated instead of the only termination of the Malicious process. 

• Rate applications according to their vendor rating - XCS will give files the same rating as the trust rating of the publisher (software creator). For example - if the vendor is trusted, then all files created by the vendor will be trusted. (Default =Enabled)

• The vendor is the software company who created and digitally signed the file.

• You can view vendor trust ratings in 'Advanced Settings' > 'File Rating' > 'Vendor List'.

• XCS ships with a list of vendors with 'Trusted' status. You can add new vendors to the list and set your own vendor ratings as required.

• The vendor rating priority is shown below:

• Admin

• User

• Xcitium

• Click the 'Vendor Rating' link to open the 'Vendor List' screen. 

• Trust files installed by trusted installers - XCS awards trusted status to files whose parent applications are listed in the 'Installer or Updater' rule in HIPS Rules. (Default = Enabled)

• Detect potentially unwanted applications (PUA) - XCS scans will flag applications that:

(i) a user may or may not be aware is installed on their computer

(ii) may contain functionality and objectives that are not clear to the user. 

Example PUA's include adware and browser toolbars. 

PUA's are often installed as an additional extra when the user is installing an unrelated piece of software. Unlike malware, many PUA's are legitimate pieces of software with their own EULA agreements. However, the true functionality of the software might not have been made clear to the end-user at the time of installation. For example, a browser toolbar that tells you the weather may also contain code that tracks your online activity(Default = Enabled).

• Automatically purge unrecognized files every NN hour(s) - XCS periodically checks that all unrecognized files in the list are still installed at the path specified. If not, the file is removed from the list. Select the interval in hours from the drop-down box. (Default = Enabled, 4 Hours)

• Use proxy when performing Cloud Lookup - XCS submits files to FLS for analysis through a proxy. The proxy server is same one that is defined for program and database updates.

• See 'Configure Program and Virus Database Updates' for more details. (Default = Disabled)
  

• Automatically scan unrecognized files at equal intervals - XCS can periodically re-scan unknown files to check whether a new trust rating is available for them. (Default = Enabled and set for every 4 hours).

• Click 'Edit Scan Options' to configure the scan settings and schedule.

 

• Scan Name - The label of the scan. This is pre-configured and cannot be edited.

• Items - The files that are scanned by the profile. 'Unrecognized Files’ is the default. You cannot edit or add files to this profile.

• Scan Options - Configure scan technologies, how to handle threats, and more. See Configure scan options for the profile in Scan Profiles for help with this.

• Schedule - Specify the frequency of the automated scans. See Configure a scan schedule in Scan Profiles for help with this. (Default = Every 4 hours)

• Automatically re-evaluate quarantined files at equal intervals - XCS checks our master online database for the latest trust rating on currently quarantined files. (Default = Enabled and set for once every day)

• Click 'Edit Scan Options' to configure the scan schedule.

• Scan Name - The label of the scan. This cannot be edited

• Items - The files that are scanned by the profile. 'Quarantined Files’ is the default. You cannot edit or add files to this profile

• Schedule - Specify the frequency of the automated scans. See Configure a scan schedule in Scan Profiles for help with this. (Default = Once every day)

• Click 'OK' to save your changes

• Click 'OK' in the 'Advanced Settings' screen for your settings to take effect.