DATA S H E E T

VMware vShield Endpoint

Enhanced Endpoint Security and Performance for Virtual Datacenters

AT A G L A N C E
What is vShield Endpoint?
vShield Endpoint revolutionizes the thinking behind how to protect
VMware vShield™ Endpoint strengthens security
for virtual machines while improving performance
guest virtual machines from viruses and malware. The solution
for endpoint protection by orders of magnitude. optimizes antivirus and other endpoint security for use in VMware
vShield Endpoint offloads antivirus and anti-malware vSphere® and VMware View™ environments.
agent processing to a dedicated secure virtual vShield Endpoint improves performance by offloading virus-
appliance delivered by VMware partners. The scanning activities from each virtual machine to a secure virtual
solution is designed to leverage existing investments
appliance that has a virus-scanning engine, as well as the stored
by allowing customers to manage antivirus and anti-
antivirus signatures. For antivirus and anti-malware functions,
malware policies for virtualized environments with
this architecture eliminates the software agent footprint in guest
the same management interfaces they use to secure
virtual machines, frees up system resources, improves performance
physical environments.
and eliminates the risk of antivirus “storms” (overloaded resources
during scheduled scans and signature updates). Because the secure
Key BENEFITS virtual appliance - unlike a guest virtual machine – doesn’t go
offline, it can continuously update antivirus signatures, giving
• Improve consolidation ratios and performance uninterrupted protection to the virtual machines on the host. Also,
by eliminating antivirus agents from guest new virtual machines (or existing virtual machines that went offline)
virtual machines. are immediately protected with the most current antivirus
• Streamline antivirus and anti-malware deployment signatures when they come online.
and monitoring in VMware environments. vShield Endpoint enhances security with a hardened, tamper-proof
• Improve security by consolidating antivirus software secure virtual appliance (delivered by VMware partners) that uses
agents to reduce the attack surface. the robust and secure hypervisor introspection capabilities in
• Satisfy compliance and audit requirements through vSphere, reducing the vulnerability of the antivirus and anti-malware
logging of antivirus and anti-malware activities. service itself.
vShield Endpoint also provides VMware partners with interfaces
to implement not just file scanning, but also memory and process
scanning. Organizations can simultaneously use multiple security
solutions; for example, they can use the sensitive data discovery
capability in VMware vShield App with Data Security in one secure
virtual appliance while using an antivirus solution in another secure
virtual appliance.
Organizations can demonstrate compliance and satisfy audit
requirements through detailed logging of activity from the
antivirus or anti-malware service.
Administrators can centrally manage vShield Endpoint through
the included vShield Manager console, which integrates seamlessly
with VMware vCenter™ Server to facilitate unified security
management for virtual datacenters.

vShield Endpoint improves performance and consolidation ratios for antivirus and
anti-malware in virtualized environments.

P R O D U C T DATA S H E E T / 1
 VMware vShield Endpoint

How Does vShield Key Features

Endpoint Work?
Antivirus and Anti-Malware Offloading
vShield Endpoint plugs directly into vSphere and consists of
• vShield Endpoint improves performance by using the vShield
three components:
Endpoint ESX module to offload virus-scanning activities to
• Hardened secure virtual appliances, delivered by VMware partners a secure virtual appliance where the antivirus scanning is enforced.
• Thin agent for virtual machines to offload security events • Tasks such as file, memory and process scanning are offloaded
(included in VMware Tools) from virtual machines to a secure virtual appliance through a
• VMware Endpoint ESX® hypervisor module to enable thin client agent and partner ESX module.
communication between the first two components at the • vShield Endpoint EPSEC manages communication between
hypervisor layer virtual machines and the secure virtual appliance, using
For example, in the case of an antivirus solution, vShield Endpoint introspection at the hypervisor layer.
monitors virtual machine file events and notifies the antivirus • Antivirus engine and signature files are updated only within the
engine, which scans and returns a disposition. The solution security virtual appliance, but policies can be applied across all
supports both on-access and on-demand (scheduled) file scans virtual machines on a vSphere host.
initiated by the antivirus engine in the secure virtual appliance.
When remediation is necessary, administrators can specify actions Remediation
to take using their existing antivirus and anti-malware management • vShield Endpoint enforces antivirus policies that dictate
tools, and vShield Endpoint manages remediation actions within the whether a malicious file should be deleted, quarantined or
affected virtual machines. otherwise handled.
• Thin agent manages file remediation activity within the
virtual machine.
How is vShield Endpoint Partner Integrations
Used? • The EPSEC API enables VMware anti-virus partners to integrate
The management console provided by the VMware partner is with vShield Endpoint by providing introspection into file
used to configure and control the partner’s software hosted in activity in the hypervisor. Essential anti-virus functions are
the secure virtual appliance. VMware partners can provide a supported through this API.
user interface that makes the management experience (including
policy management) exactly like managing software hosted on a vShield Manager, Policy Management and
dedicated physical security appliance. Automation
Virtual infrastructure administrators have a vastly reduced level of • vShield Manager provides full-featured deployment and
effort because virtual machines have no antivirus agents to manage. configuration of vShield Endpoint.
Instead, the partner’s management console is used to manage the • Representational State Transfer (REST) APIs allow
secure virtual appliance. This approach also avoids the need to customized, automated integration of vShield Endpoint
administer frequent updates per virtual machine. For deployment, capabilities into solutions.
VMware Tools includes the thin agent, and the ESX module enables • Monitoring reports provided.
hypervisor introspection.
• vShield Manager can be leveraged as a vCenter plug-in.
Virtual infrastructure administrators can easily monitor
deployments to determine, for example, whether an antivirus Logging and Auditing
solution is operating properly.
• Event logging is based on industry-standard syslog format.

P R O D U C T DATA S H E E T / 2
 VMware vShield Endpoint

Supported Releases
For information on supported releases of vSphere, ESX, and
View environments, visit http://vmware.com/products.

Related Products
The vShield family of security products also includes VMware
vShield Edge for perimeter security; vShield App with Data
Security to protect applications from network-based attacks
and discover sensitive data; vShield Manager; and vShield
Bundle, which includes all products.

Find Out More

For information or to purchase VMware products, call
877-4-VMWARE (outside North America, +1-650-427-5000),
visit http://www.vmware.com/products, or search online for
an authorized reseller. For detailed product specifications
and system requirements, refer to the VMware vShield
Administration Guide at http://www.vmware.com/pdf/
vshield_41_admin.pdf.
For additional information on vShield products,
visit http://vmware.com/products.

VMware, Inc. 3401 Hillview Avenue Palo Alto CA 94304 USA Tel 877-486-9273 Fax 650-427-5001 www.vmware.com
Copyright © 2011 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed
at http://www.vmware.com/go/patents. VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be
trademarks of their respective companies. Item No: VMW-DS-vSHLD-ENDPT-USLET-103