Securepoint Antivirus Pro

Monitor the GuardX service, real-time protection, definitions, quarantine and active threats of Securepoint Antivirus Pro locally on Windows devices.

The Securepoint Antivirus Pro check runs directly on the Windows device (x64 and Arm64), every 15 minutes. The octoja agent reads the local state of Securepoint Antivirus Pro — the GuardX service, real-time protection, the age of the virus definitions, the quarantine folder and active threats — and reports it back to octoja. Securepoint offers no cloud API for Antivirus Pro, so reading the endpoint locally is the only possible source for this data. There is nothing to connect: no portal account, no access token, no customer matching.

Prerequisites

A Windows device. The check ships for Windows on x64 and Arm64 only. On any other operating system it reports the failure This check runs only on Windows.
Securepoint Antivirus Pro installed in its default location, C:\Program Files\Securepoint Antivirus Pro. The check reads the log, bin and quarantine folders below that path.
The octoja agent running on the device. It executes the check locally and needs to read the GuardX service, the Windows Application event log and the quarantine folder.
Permission to assign checks — either directly on a device or through a config package.

Steps

Go to Devices and open the device.
Click the Checks tab → Add Check → Securepoint Antivirus Pro.
Keep the defaults — you only need to change the settings if you want to adjust thresholds or severities.
Click Add Check.

For many devices at once, put the check into a config package and assign the package — see Assign checks with config packages.

Settings

All eight settings are optional. Two of them sit behind Show advanced options.

Field	Type	Required	Default	Description
Signature warning age (hours)	Integer	No	24	Warn when the virus definitions are older than this many hours.
Signature critical age (hours)	Integer	No	48	Raise critical when the virus definitions are older than this many hours. If you set it below the warning age, the check swaps the two values.
Treat disabled real-time protection as critical	Boolean	No	On	When on, inactive real-time protection reports critical; when off, it reports only a warning.
Treat unknown real-time protection as critical	Boolean	No	Off	Enable to report an unknown state as critical. Otherwise it remains neutral without an alert. Unknown confirms neither active nor disabled protection.
Treat active threats as critical	Boolean	No	On	When on, an active infection reports critical; when off, only a warning. Quarantined files always stay a warning — Securepoint has already isolated them.
Warn on quarantined files	Boolean	No	On	Raise a warning when the quarantine folder contains isolated files. Turn it off if you clear quarantine on a schedule and do not want the reminder.
Active-threat window (hours) (advanced)	Integer	No	24	Report an infection as active only when Securepoint last detected it within this many hours. Older detections without a newer clean result count as historical. Raise it — 720 for 30 days, for example — to flag every detection Securepoint has not confirmed as resolved.
Query timeout (seconds) (advanced)	Integer	No	60	How long the check waits for the local Securepoint query to finish. Values below 10 seconds are raised to 10.

Results

Value	What it means and where it comes from
GuardX service	Shows Running when the GuardX Windows service is running, or when the `guardxservice_x64` process is present. Otherwise Not running.
Real-time protection	Active, Inactive or Unknown. The check remembers the last observed on/off entry from the Windows Application event log across log rollover. Last confirmed shows that event's time, not a fresh confirmation on every check run. Without an observed state, the value remains unknown.
Definitions	Current or Outdated, followed by the signature age in hours. The age comes from the last change to the Securepoint update log; if that file is missing, the check falls back to the last definitions-updated entry in the event log.
Active threats	Clean unless the newest infection entry in the event log is newer than the newest all-clear entry and falls inside the active-threat window.
Quarantine	Clean, or the number of isolated files in the Securepoint quarantine folder. Database, log, temporary and index files are not counted.
Last update	When the virus definitions were last updated.
Version and host name	The product version read from the installed GuardX service program file, plus the Windows computer name of the device.

Message	Severity	What to do
Securepoint Antivirus Pro is not installed.	Critical	Install Securepoint Antivirus Pro, or remove the check from devices that are not meant to run it. Nothing else is reported for this device.
The GuardX service is not running.	Critical	Start the GuardX service on the device and check why it stopped. The device is unprotected while it is down.
Real-time protection is inactive.	Critical or warning	Re-enable on-access scanning in Securepoint Antivirus Pro. The severity follows Treat disabled real-time protection as critical.
Real-time protection state is unknown.	Critical	Reported only when Treat unknown real-time protection as critical is switched on. The check has not yet observed a Securepoint on/off entry in the Windows Application log. Check real-time protection directly in Securepoint Antivirus Pro.
An active infection was detected.	Critical or warning	Handle the infection on the device. The message clears once Securepoint records an all-clear result, or once the detection falls outside the active-threat window.
A number of file(s) in quarantine.	Warning	Review and empty the quarantine folder. Securepoint has already isolated these files, so this is a reminder rather than an incident.
Securepoint reported the definitions as outdated.	Warning	Securepoint itself flagged the definitions. Run a definitions update and confirm the device reaches the update servers.
Signatures are a number of hours old.	Warning	The definitions passed the warning age. Usually the device was offline; if it repeats, check the update path.
Signatures are severely outdated.	Critical	The definitions passed the critical age. Treat the device as under-protected until the update succeeds.
Signature age could not be determined.	Warning	Neither the update log nor an update entry in the event log was readable. Verify the installation path and that the Application event log is not cleared aggressively.

When the check cannot run at all

These are failures of the check itself, not findings about the antivirus. No values are reported alongside them.

Message	What to do
This check runs only on Windows.	The check was assigned to a Linux or macOS device. Remove it there.
The Securepoint query timed out.	The local query did not finish in time — common on busy devices with a very large Application event log. Raise Query timeout (seconds).
The Securepoint query returned no output.	The query ran but produced nothing. Confirm that the octoja agent may run local scripts on the device.
The Securepoint query failed.	The query reported an error, usually a permission problem reading the event log or the quarantine folder.
An unexpected error	The original error text is shown with the message. If it repeats, send it to support together with the device name.

Your existing assignments keep working

The check kept its identifier, so every assignment carries over on its own. Devices that already had Securepoint Antivirus Pro assigned keep it, config packages that contain it stay valid, and the check history is preserved. There is nothing to migrate and nothing to re-create.

Do not confuse it with these two

Two other things in octoja carry a similar name. They are unrelated to this check and can run alongside it:

Antivirus Status is the generic endpoint check. On Windows client editions it reads what Windows Security Center knows about whichever antivirus is installed — Microsoft Defender, Bitdefender, Sophos, ESET, SentinelOne, CrowdStrike and others; on Windows Server, where the Security Center is not available, it queries each supported vendor directly. It gives you a vendor-independent overview, but none of the Securepoint-specific detail such as the GuardX service, the quarantine count or the update log.
Securepoint UTM (SNMP) is a vendor option inside the Network Firewall (Appliance) check. It monitors a Securepoint firewall appliance over SNMP — CPU, RAM, sessions, interfaces, VPN, high-availability state and licensing. It has nothing to do with endpoint antivirus and is not assigned to workstations.

Was this helpful?

Still need help? Ask the team