SSP : MPS Deep scan not working in onprem mode for custom Mps Profiles

Products

• VMware vDefend Firewall with Advanced Threat Prevention
• VMware vDefend Network Detection and Response

Issue/Introduction

If the customer is creating a custom MpsProfile, then by default, the send files for deep analysis flag will be disabled and will not be available on the UI.

Environment

NSX Manager 4.2.1, NSX Manager 4.2.2, NSX Manager 4.2.3 and  NSX Manager 9.0.x

Cause

By default, the deep scan flag is not visible for custom Profile on the UI and is disabled on the backend side.

Resolution

If Customer want to do a deep scan using a custom profile, then the following steps need to be followed

1. Create Profile in NSX UI 

Go to Security >  IDS/IPS & Malware Prevention > Malware Prevention, click Add Profile, name it <any>, select all File Types and hit Save.

2. SSH into the NSX Manager & Update "detection_type" via CLI 

 Get the Malware Prevention Profile using the Get profile API.

 curl -k -X GET -u '<USER>:<PASSWORD>' "https://<NSX-IP>/policy/api/v1/infra/settings/firewall/security/malware-prevention-service/profiles/<custom_profile_id>" 

If custom_profile_id is not available then use the List API to list all Malware Prevention Profiles and get the Profile_path or the custom_profile_name/custom_profile_id.

curl -k -X GET -u '<USER>:<PASSWORD>' "https://<NSX-IP>/policy/api/v1/infra/settings/firewall/security/malware-prevention-service/profiles"

Update the Profile.

curl -k -X PATCH -u '<USER>:<PASSWORD>' -H "Content-Type: application/json" -d '{"file_type": ["DOCUMENT", "EXECUTABLE", "MEDIA", "ARCHIVE", "DATA", "SCRIPT", "OTHER"], "detection_type": "SIGNATURE_AND_SANDBOXING_BASED"}'  "https://<NSX-IP>/policy/api/v1/infra/settings/firewall/security/malware-prevention-service/profiles/<custom_profile_id>"

3. Verify Final State: Confirm the update was successful:

curl -k -X GET -u '<USER>:<PASSWORD>' "https://<NSX-IP>/policy/api/v1/infra/settings/firewall/security/malware-prevention-service/profiles/<custom_profile_id>" 

Verify in the response that the detection_type is set to 

"SIGNATURE_AND_SANDBOXING_BASED"
{
  "file_type": ["DOCUMENT", "EXECUTABLE", "MEDIA", "ARCHIVE", "DATA", "SCRIPT", "OTHER"],
  "detection_type": "SIGNATURE_AND_SANDBOXING_BASED",
  "resource_type": "MalwarePreventionProfile",
  "id": "test4",
  "display_name": "test4",
  "path": "/infra/settings/firewall/security/malware-prevention-service/profiles/test4",
  "relative_path": "test4",
  "parent_path": "/infra",
  "unique_id": "dd3dc772-e696-4c2e-bd83-babfe05dcd18",
  "marked_for_delete": false,
  "overridden": false,
  "_create_user": "admin",
  "_create_time": 1612371165557,
  "_last_modified_user": "admin",
  "_last_modified_time": 1612371165558,
  "_system_owned": false,
  "_protection": "NOT_PROTECTED",
  "_revision": 0
 }

Note:  if the same profile is edited again,  make sure the detection_type remain as "SIGNATURE_AND_SANDBOXING_BASED" "Because re-editing an existing profile may cause the detection_type to revert from SIGNATURE_AND_SANDBOXING_BASED back to SIGNATURE_BASED.