Request info for McAfee AV (ENS) supported on Machine Learning and Artificial Intelligence

[Former Member]

1. Does our McAfee AV (ENS) supported on Machine Learning and Artificial Intelligence for threat detection other than rely on the existing method which is signature based? 2. Is it possible for us to enable the Machine Learning and Artificial Intelligence into our McAfee AV? 3. If yes, how does it work? 4. Will this use up more machine resources? 5. Does the McAfee signature will still be in place on top of these both new features (Machine Learning & Artificial Intelligence) 6. If this can't be enable, does this means our current McAfee product do not support. 7. What is the solution? Update the McAfee AV? 8. Is it necessary to purchase a different McAfee product? 9. If there are different product can we have the any documentation of the new products (features, minimum system requirements etc)

[Hawkmoon]

Hi User92864328,

This is a series of question that would best asked in the ENS forum.

They would be the correct group to answer to the software they support as well have more information to help with this.

[Daveb3d]

First,  ENS uses genetic signatures, so you aren't limited to one hash = one detection. 

Second,  you have machine learning if you use the ATP module.   It comes in two forms. 

The first is static analysis,  which is pre-execution.  If it passes that,  post- execution behavioral ML kicks in for further analysis. 

It possible to not use signature scanning by disabling it and just use ATP scanning,  though certainly not best practice.

[jess_arman]

ATP needs OAS enabled in order to accurately function, so there's not a way to use it independent of Threat Prevention. It's a dependent module, which is why you have to have TP installed before ATP can be installed. 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

[Daveb3d]

I don't agree.  While ATP requires TP to be installed, one can disable OAS via policy so that dat scanning doesn't occur, but ATP scanning and enforcement does.  

Dave

[jess_arman]

Apologies, you're correct. What I should have stated is configured not enabled. In that ATP functions based on the OAS default process policy configuration for inclusions/exclusions

[Former Member]

That would be pretty interesting to see elaborations with current leaders in machine learning and artificial intelligence, considering its rising popularity. I really wonder what would it be in terms of antivirus software, but I guess there are already existing solutions to look for.