This document lists the tables in the Ivanti EPM Database that are related to the Ivanti Antivirus product:

Within this document you can click the images for a full-size version.

The following are the tables used for Ivanti Antivirus:

Antivirus table

The information from this table shows up in the Antivirus Licensing information in the Ivanti Antivirus Action Center, in the Inventory of each client, and in the Antivirus License section of the Security activity tool.  This table records the inventory information for not only the Ivanti Antivirus product but also for other 3rd party Antivirus products.  This table is updated by an Inventory Scan or sent directly to the Core Server through the WSVulnerabilityCore web service by the Ivanti Antivirus Service.  This information is sent under the following conditions:

• After AV installation
• After activating with a new license
• After a scanning task is done
• After pattern files are updated

In addition you can run "LDAV.EXE /submitallavdata" to send this information manually.

When this information is sent to the core it will log into the LDAV.LOG as "("Submitting all Antivirus table information...")

For an Inventory Scan this information is gathered through LDAVHLPR.DLL.  Periodic updates of this .DLL are provided within Ivanti Patch Content to support gathering information on newer versions of Antivirus Software.  The information gathered can from each 3rd party vendor can vary.  Some information may not be applicable or available to gather through the Ivanti Inventory or Patch and Compliance scan processes.

This information shows up in the Inventory of a client in this manner:

This table consists of the following columns:

AntivirusPatches table

This table lists the patches for the Antivirus product that are installed on the client.

This information is sent to the Core when an Inventory Scan runs.

This shows up in the Client Inventory in this location:

The LANDESK Antivirus service logs patch information every time it starts during the initialize period to HKEY_CLASSES_ROOT\Installer\Products\<product guid>\patches and it then stored in HKLM\Software\LANDESK\ManagementSuite\WinClient\Antivirus\Patches

InfectedFiles table

This information shows up in the Security Activity tool under Ivanti Antivirus - Infections by Computer, and Ivanti Antivirus - Infections by Virus

This table consists of the following columns:

QuarantinedFiles table

This information shows up in the Security Activity tool under Ivanti Antivirus - Quarantined Infections by computer and Ivanti Antivirus - Infections by virus

This table stores both information about files that have been Quarantined or files that have been moved into the Backup folder.

This table consists of the following columns:

This information shows up in the Inventory of the client under Security - Quarantined Files.  Each file is listed as a separate entry under Quarantined Files and shows the values for Date Quarantined, Filename, GUID Filename, Original Location, Status, and Virus

SecurityAction table

This information shows up in the Security Activity Tool under Ivanti Antivirus - Activity, Activity by computer, and activity by virus.  In addition, LANDESK Endpoint Security activity information is stored in the SecurityAction table.

The information in this table makes up most of the Ivanti Antivirus information shown in the Security Activity tool.  This information is stored in ActionHistory.XML files on the client and sent to the core server every 2 minutes by Softmon, or when a Security and Compliance scan runs.

The exception would be the licensing information which is stored in the Antivirus table and is sent by the Ivanti Antivirus Service on the client WSVulnerability web service on the core server.

The following are the codes returned to the core server and their meanings:

TrustedItem table

Trusted items are a list of objects that Ivanti Antivirus does not monitor or control.  This list is populated with a list of Ivanti EPM client files at the time of Ivanti Antivirus install, and can be added to by a settings update, or by a user on the client computer if that permission is given.

You can add a trusted item and it will block Ivanti Antivirus access to that item, however you must be very sure that it does not represent any threat.

On the client side these are the entries from the Exclusion Rules or Trusted Applications

This information shows up in the Inventory of the client under Security - Trusted Items.  Each file is listed as a separate entry under Trusted Items and shows the values for Folder, Item, Object Type and Status

Security Activity

When an event happens with Ivanti Endpoint Security (Application blocked, device blocked, startup module added, etc) this information is sent to the core server and is then able to be viewed within the Security Activity tool and is stored in the database.

How actions are sent from the Client to the core server

Whenever an action takes place (A device is blocked, shadow copy activity takes place, etc) this activity is recorded in the ActionHistory.(ClientIPAddress).ID#.xml file.  If no further activity takes place within 2 minutes, Softmon will send this information to the core server.  Otherwise, every time Vulscan runs it gathers the ActionHistory information and sends it to the core server.  This ActionHistory information gets stored in the SecurityAction table in the database and is displayed in the Security Activity window.  After the ActionHistory is sent, the .XML is renamed to .SENT.XML.  11 copies of this file are kept on the client.  .sent and then .sent #'s 1-10.

If ActionHistory is sent during a Vulnerability Scan, this action will be logged in the Vulscan.log file

If ActionHistory is sent via Softmon, this is logged in the Softmon.log file

───────────────────────────────────────

The following SQL query will return all of the Endpoint Security related activity.

select * from patchhistory where Actioncode IN (10,11,12,13,14,15,16,17,18.19.20.21,22,23,24,25,26,27,28.... etc through to 45)