ManageEngine Malware Protection

See the Gap That Patching Leaves

Patch management and malware protection do two different jobs. Patching removes known weaknesses — the unpatched service, the old Office build — and it works before an attack, only against holes that already have a fix. It cannot judge what a program does after it starts: a normal-looking file a user downloaded an hour ago, or a fileless attack running code straight from memory, where no suspicious file ever lands on disk for a signature scan to find.

That is why a fully patched PC can still run brand-new malware — and why this video looks at the layer that watches behaviour at run time.

Know the Two Engines the Add-on Switches On

ManageEngine Malware Protection is not a separate antivirus you install next to Endpoint Central — it is an add-on module that switches on inside the same console and agent you already use. In ManageEngine's own documentation it bundles two engines: Next-Gen Antivirus (NGAV) — signature scanning plus behaviour analysis and machine-learning models, aimed at known and unknown malware including fileless attacks — and Anti-Ransomware, a behaviour analytics engine that watches for encryption-style activity and can respond when it fires.

Know What Happens When It Fires

Detection is only half of the product. When something fires, the documented response side is: instant quarantine of the infected file — and, if needed, of the whole device, so one bad PC cannot spread the problem sideways across the network; real-time alerts by email or the mobile app, sent when the detection happens rather than in tomorrow's report; and incident forensics mapped to the MITRE ATT&CK framework, so an incident is described in the standard attack-technique language instead of a vague “virus found”.

ManageEngine also states the agent keeps monitoring without an internet connection, so laptops away from the office network are not blind spots — they report when they reconnect.

Check the Licence Before Anything Else

ManageEngine's own FAQ is blunt: Malware Protection is always a separate add-on licence. It is not bundled with any Endpoint Central edition — not Standard, not Professional, not Enterprise. So before hunting for settings, check what you own: in the console, open the Profile icon → License and look at the Malware Protection – Add-on managed-computers count. If it shows 0, the add-on is not purchased, whichever edition you run.

The one documented exception: the Free edition includes Malware Protection for up to 25 devices at no extra cost — enough for a genuine trial on real machines. After purchase, the add-on switches on during the next agent refresh cycle (about 90 minutes); if it does not appear, wait for a refresh before raising a ticket.

Roll Out to a Pilot Group First

Do not enable behaviour protection on every PC at full strength on day one — that is how false positives turn into angry phone calls. Start with a pilot group: your IT machines plus a handful of normal user PCs, and let it run for at least a few days before going any wider.

Watch Detections Daily and Tune Exclusions Narrowly

During the pilot, watch the detections every day. Note every false positive by its exact file and path — you will need that precision for exclusions. Add exclusions only for confirmed business software, and keep them as narrow as the evidence allows.

Expand in Waves — and Keep the Layers Around It

Once the pilot is quiet, expand one department at a time, keeping the same watch-and-tune habit for each wave. Turn on the email and mobile-app alerts to a person who will actually read them — an alert nobody sees is not protection.

And keep the honest bottom line in view: this add-on does not replace patching, application control or device control — the strongest setups use them together. Behaviour blocking reduces ransomware risk, but tested backups remain the only guaranteed recovery from a successful encryption, and least-privilege user accounts still limit the damage any one PC can do.