Acronis Cyber Protect Antivirus

The Acronis Cyber Protect Antivirus check monitors local antivirus protection on Windows devices: Acronis services, the AV engine, a Microsoft Defender conflict and the Windows Security Center registration. It runs every 15 minutes by default. Signature age is not evaluated. The separate Acronis Cyber Protect Cloud check evaluates backups and cloud alerts; the Acronis Backup check monitors local backup jobs.

Prerequisites

• A Windows device with the octoja agent (x64 or ARM64) and Acronis Cyber Protect.
• Access to the device and permission to manage monitoring checks.

Steps

1. Open the device under Devices and select Checks → Add Check.
2. Choose Acronis Cyber Protect Antivirus.
3. Set how Microsoft Defender in Normal mode should be evaluated: Off, Warning (default) or Critical.
4. Save with Add Check.
5. Open the result after execution. It shows detected services, the AV engine and, where available, Defender mode and Security Center registration.

For multiple devices, assign the check through a config package.

Settings

Results

The highest detected severity determines the overall result. Security Center is not checked on Windows Server. A failed Security Center query on a client means unknown, not “Acronis not registered”. A Security Center entry whose name contains “Acronis” or “Cyber Protect” counts as an Acronis registration.

For a reported issue, first inspect the affected services and protection state on the device.

FAQ

Does an OK result mean Acronis has detected no threats?

No. This local check evaluates services and protection components, not malware detections or quarantine entries. Review those in Acronis. To monitor active cloud alerts in octoja, configure the separate Acronis Cyber Protect Cloud check; its result depends on the alerts available through the integration and the configured severity.