Monitor Securepoint Antivirus Pro on your devices

The Securepoint Antivirus Pro check runs on the device itself and reports the GuardX service, real-time protection, signature age and threats to octoja.

Written By Stefan Steuer

Last updated 8 days ago

The Securepoint Antivirus Pro check runs directly on the device. The octoja agent reads the local state of Securepoint Antivirus Pro on Windows — the GuardX service, real-time protection, the age of the virus definitions, the quarantine folder and active threats — and reports it back to octoja. Securepoint offers no cloud API for Antivirus Pro, so reading the endpoint locally is the only possible source for this data. There is nothing to connect: no portal account, no access token, no customer matching.

Your existing assignments keep working

The check kept its identifier, so every assignment carries over on its own. Devices that already had Securepoint Antivirus Pro assigned keep it, config packages that contain it stay valid, and the check history is preserved. There is nothing to migrate and nothing to re-create.

Prerequisites

A Windows device. The check ships for Windows on x64 and Arm64 only. On any other operating system it reports the failure This check runs only on Windows.
Securepoint Antivirus Pro installed in its default location, C:\Program Files\Securepoint Antivirus Pro. The check reads the log, bin and quarantine folders below that path.
The octoja agent running on the device. It executes the check locally and needs to read the GuardX service, the Windows Application event log and the quarantine folder.
Permission to assign checks — either directly on a device or through a config package.

Add the check to your devices

For a single device: open the device in octoja, go to its checks and add Securepoint Antivirus Pro.
For many devices at once: put the check into a config package and assign the package — see Assign checks with config packages.

The check runs every 15 minutes and works with its defaults — you only need to open the settings if you want to change thresholds or severities.

What the check reports

Value	What it means and where it comes from
GuardX service	Shows Running when the GuardX Windows service is running, or when the `guardxservice_x64` process is present. Otherwise Not running.
Real-time protection	Active or Inactive, taken from the most recent on/off entry that Securepoint Antivirus Pro wrote to the Windows Application event log.
Definitions	Current or Outdated, followed by the signature age in hours. The age comes from the last change to the Securepoint update log; if that file is missing, the check falls back to the last definitions-updated entry in the event log.
Active threats	Clean unless the newest infection entry in the event log is newer than the newest all-clear entry and falls inside the active-threat window.
Quarantine	Clean, or the number of isolated files in the Securepoint quarantine folder. Database, log, temporary and index files are not counted.
Last update	When the virus definitions were last updated.
Version and host name	The product version read from the installed GuardX service program file, plus the Windows computer name of the device.

Configuration options

All seven settings are optional. Two of them sit behind Show advanced options.

Setting	Default	What it does
Signature warning age (hours)	24	Warn when the virus definitions are older than this many hours.
Signature critical age (hours)	48	Raise critical when the virus definitions are older than this many hours. If you set it below the warning age, the check swaps the two values.
Treat disabled real-time protection as critical	On	When on, inactive real-time protection reports critical; when off, it reports only a warning.
Treat active threats as critical	On	When on, an active infection reports critical; when off, only a warning. Quarantined files always stay a warning — Securepoint has already isolated them.
Warn on quarantined files	On	Raise a warning when the quarantine folder contains isolated files. Turn it off if you clear quarantine on a schedule and do not want the reminder.
Active-threat window (hours) (advanced)	24	Report an infection as active only when Securepoint last detected it within this many hours. Older detections without a newer clean result count as historical. Raise it — 720 for 30 days, for example — to flag every detection Securepoint has not confirmed as resolved.
Query timeout (seconds) (advanced)	60	How long the check waits for the local Securepoint query to finish. Values below 10 seconds are raised to 10.

Status messages and what to do

Message	Severity	What to do
Securepoint Antivirus Pro is not installed.	Critical	Install Securepoint Antivirus Pro, or remove the check from devices that are not meant to run it. Nothing else is reported for this device.
The GuardX service is not running.	Critical	Start the GuardX service on the device and check why it stopped. The device is unprotected while it is down.
Real-time protection is inactive.	Critical or warning	Re-enable on-access scanning in Securepoint Antivirus Pro. The severity follows Treat disabled real-time protection as critical.
An active infection was detected.	Critical or warning	Handle the infection on the device. The message clears once Securepoint records an all-clear result, or once the detection falls outside the active-threat window.
A number of file(s) in quarantine.	Warning	Review and empty the quarantine folder. Securepoint has already isolated these files, so this is a reminder rather than an incident.
Securepoint reported the definitions as outdated.	Warning	Securepoint itself flagged the definitions. Run a definitions update and confirm the device reaches the update servers.
Signatures are a number of hours old.	Warning	The definitions passed the warning age. Usually the device was offline; if it repeats, check the update path.
Signatures are severely outdated.	Critical	The definitions passed the critical age. Treat the device as under-protected until the update succeeds.
Signature age could not be determined.	Warning	Neither the update log nor an update entry in the event log was readable. Verify the installation path and that the Application event log is not cleared aggressively.

When the check cannot run at all

These are failures of the check itself, not findings about the antivirus. No values are reported alongside them.

Message	What to do
This check runs only on Windows.	The check was assigned to a Linux or macOS device. Remove it there.
The Securepoint query timed out.	The local query did not finish in time — common on busy devices with a very large Application event log. Raise Query timeout (seconds).
The Securepoint query returned no output.	The query ran but produced nothing. Confirm that the octoja agent may run local scripts on the device.
The Securepoint query failed.	The query reported an error, usually a permission problem reading the event log or the quarantine folder.
An unexpected error	The original error text is shown with the message. If it repeats, send it to support together with the device name.

Do not confuse it with these two

Three things in octoja carry a similar name. They are unrelated and can run side by side:

Antivirus Status is the generic endpoint check. It reads what Windows Security Center knows about whichever antivirus is installed — Microsoft Defender, Bitdefender, Sophos, ESET, SentinelOne, CrowdStrike and others. It gives you a vendor-independent overview, but none of the Securepoint-specific detail such as the GuardX service, the quarantine count or the update log.
Securepoint UTM (SNMP) is a vendor option inside the Network Firewall (Appliance) check. It monitors a Securepoint firewall appliance over SNMP — throughput, sessions, VPN, high-availability state and licensing. It has nothing to do with endpoint antivirus and is not assigned to workstations.