Problem Description
The DMG agents scan currently runs full scan all files on the device on the targetted directories every time, regardless of whether they've changed since the last scan. On machines with large filesystems, many packages, or deep node_modules/venv trees, this makes full scans slow and resource-intensive, even though most files are static between scans.
Proposed Solution
Add a configurable option (e.g. a policy/config setting such as fullScanModifiedSince) that lets admins define a cutoff, either a relative window (e.g. "only scan files modified in the last N days") or "since the last successful scan", so that during a full scan, the agent skips files whose last-modified timestamp falls outside that window. Newly created/modified files would still always be scanned. This should be opt-in and configurable per policy, not a replacement for true full-coverage scans.
Alternatives Considered
Always defaulting to incremental scans was considered, but that could reduce detection coverage for cases where full re-scans are required for compliance. Making it an explicit, configurable option preserves the choice for admins who need guaranteed full coverage vs. those optimizing for speed.
Additional Context
No response
Problem Description
The DMG agents scan currently runs full scan all files on the device on the targetted directories every time, regardless of whether they've changed since the last scan. On machines with large filesystems, many packages, or deep node_modules/venv trees, this makes full scans slow and resource-intensive, even though most files are static between scans.
Proposed Solution
Add a configurable option (e.g. a policy/config setting such as
fullScanModifiedSince) that lets admins define a cutoff, either a relative window (e.g. "only scan files modified in the last N days") or "since the last successful scan", so that during a full scan, the agent skips files whose last-modified timestamp falls outside that window. Newly created/modified files would still always be scanned. This should be opt-in and configurable per policy, not a replacement for true full-coverage scans.Alternatives Considered
Always defaulting to incremental scans was considered, but that could reduce detection coverage for cases where full re-scans are required for compliance. Making it an explicit, configurable option preserves the choice for admins who need guaranteed full coverage vs. those optimizing for speed.
Additional Context
No response