How to set Elements Endpoint Protection real-time scanning to report only

Issue:

How to set Elements Endpoint Protection (EPP for Computers or EPP for Servers) real-time scanning to report only mode, so that it will only monitor and not decide action on infection automatically? We want to manually device what to do with the detected files.

Resolution:

The Real-time scanning feature can be set to report only so that it will not automatically try to delete, disinfect, quarantine, rename or block files. 

Follow these steps to set Real-time scanning to report only:

1. Log in to the Elements Security Center Portal 
2. Go to the Security configurations > Profiles page
3. Click on the profile that is in use on the devices
4. Go to the Real-time scanning settings page
5. Scroll down to the File scanning section
6. Set the Action on infection as Ask after scan
7. Click Save profile

Note: Files which have been classified as riskware or spyware have their own action selections in the File scanning section. They can also be set to Ask after scan.

If you do not want scheduled scans or manually started scans to automatically device action on infection, you can set its Action on infection also to be Ask after scan:

1. Go to the Manual scanning settings page in the profile
2. Scroll down to the Manual scanning section
3. Set Action on infection as Ask after scan
4. Click Save profile

DeepGuard, DataGuard or Web Traffic Scanning features cannot be set to any report only status. All the blocks and detections will be visible in the Elements Endpoint Protection Portal on the Security events page:

1. Log in to the Elements Security Center Portal
2. Go to the Events > Security events page (from the menu on the left)

The Security events page will show all the necessary details of the block or detection for you to be able to create an exclusion if required.