what's the difference between these two packages?

[huanzhou1]

rsaMalwareDevice.x86_64 : RSA NetWitness Spectrum :: Server

rsaMalwareDeviceCoLo.x86_64 : RSA NetWitness Spectrum :: Server

[ChrisThomas]

rsaMalwareDevice.x86_64 - is the package for the standalone RSA Malware Analysis Appliance (for continuous scanning)

rsaMalwareDeviceCoLo.x86_64 - is the package for the Malware Analysis engine that is Co-Located on the SA Server appliance (for adhoc scans)

[huanzhou1]

do you mean rsaMalwareDeviceCoLo.x86_64 is required for ad-hoc scan? if the package not there can it work?

[ChrisThomas · Accepted solution]

The rsaMalwareDeviceCoLo.x86_64 package is used to upgrade the Malware Analysis service that is running on the SA Server. This service can be used for AdHoc scans.

The rsaMalwareDevice.x86_64 package is used to upgrade the Malware Analysis service running on a standalone Malware Analysis appliance. This service can be used for AdHoc scans or for Continuous scans also.

So if you don't have a Malware Analysis appliance, and you want to do Malware Scans, then you need to have that package on the SA Server. Hope that helps.

[huanzhou1]

Other than the name, are they same? I tried to install both on the SA server, looks like same.

[huanzhou1]

Can i still use it for Continuous scan if installed on SA server? Thanks.

[ChrisThomas]

Continuous scanning is only available with a dedicated Malware Analysis appliance.

[huanzhou1]

do you mean RSA only support this? or the software limitation? I'm able to configure the Continuous scanning using the Malware device on SA head unit.