Check Point HARMONY R81 Administration Manual page 362

Option
Registry Key
Registry
Value
Check File
File Name
File Path
Check File
Properties
Match File
Version
Match MD5
Checksum
File is not
older than
5. Optional: You can select or define a Remediation action for this Check object.
The Remediation action applies only to this Check object and overrides the Remediation
action specified in the rule. To define a Check object Remediation action, select a
Remediation action from the list or click Remediation tab > New to define a new one.
Description
Enter the registry key.
Enter the registry value to match.
Select one of these options to check if an application is running or if a
file exists:
File is running at all times - For example, make sure that Endpoint
Security client is always running.
File exists - For example, make sure that the user browsing history is
always kept.
File is not running - For example, make sure that DivX is not used.
File does not exist - For example, make sure that a faulty DLL file is
removed.
Enter the name of the file or executable to look for. To see if this file is
running or not, you must enter the full name of the executable,
including the extension (either .exe or .bat).
Enter the path without the file name.
Select the Use environment Variables of logged in user option to
include paths defined in the system and user variables.
Do not add the "\" character at the end of the path.
Additional options to check for an existing or non-existing file.
Make sure that a specific version or range of versions of the file or
application complies with the file check.
Find the file by the MD5 Checksum. Click Calculate to compare the
checksum on the endpoint with the checksum on the server.
Select this option and enter the maximum age, in days, of the target
file. If the age is greater than the maximum age, the computer is
considered to be compliant. This parameter can help detect recently
installed, malicious files that are disguised as legitimate files.
R81 Harmony Endpoint Server Administration Guide | 362
Compliance Action Rules