Guest Introspection offloads antivirus and anti-malware agent processing to a dedicated secure virtual appliance delivered by VMware partners. Since the secure virtual appliance (unlike a guest virtual machine) doesn't go offline, it can continuously update antivirus signatures thereby giving uninterrupted protection to the virtual machines on the host. Also, new virtual machines (or existing virtual machines that went offline) are immediately protected with the most current antivirus signatures when they come online.
Guest Introspection health status is conveyed by using alarms that show in red on the vCenter Server console. In addition, more status information can be gathered by looking at the event logs.
Important: Your environment must be correctly configured for Guest Introspection security:
- All hosts in a resource pool containing protected virtual machines must be prepared for Guest Introspection so that virtual machines continue to be protected as they are vMotioned from one ESXi host to another within the resource pool. In NSX 6.4.1 and later, virtual machine hardware must be at v9.0 or above for Guest Introspection to support VM protection during migration (vMotion) of VMs from one host to another.
- Virtual machines must have the Guest Introspection thin agent installed to be protected by Guest Introspection security solution. Not all guest operating systems are supported. Virtual machines with non-supported operating systems are not protected by the security solution.
