Security checks in the Ransomware Vulnerability Management Packs

Applies to: OpsLogix VMware Management Pack (all versions) with the Ransomware Vulnerability Management Packs V70, V80 and V90 · SCOM 2019, 2022, 2025 · vCenter 7.0, 8.0, 9.0
Last updated: October 2026 · Reading time: 6 minutes

The Ransomware Vulnerability Management Packs check your ESXi hosts, virtual machines and switches against the VMware security configuration guide for your vSphere version. This article lists every check in each pack, its target, and whether it is on by default. For setup steps, see Monitor vSphere for ransomware vulnerabilities.

Which packs are shipped

The release contains three versions. Each version has a monitoring pack and a Groups pack. You find them in the folder Management Packs\Ransomware Vulnerability Monitoring.

Import the pack that matches your vSphere version.

How the checks work

• Interval: every check runs every 6 hours (21,600 seconds).
• Health state: Compliant is Healthy. Non Compliant is Critical. Any other result is Warning. The monitors roll up to the Security health of the object.
• Alerts: raised from Warning and closed automatically when the setting is compliant again.
• Host and switch checks are on by default.
• Virtual machine checks are off by default. A large environment has many VMs, so you turn them on only for the VMs you want to check in detail.
• Overall monitors: each pack has three overall monitors, one each for ESXi hosts, virtual machines and distributed virtual switches. They are on by default. An overall monitor turns Critical when any check for that object is Non Compliant, and the alert lists the failing checks with their current values. The virtual machine overall monitor evaluates all VM checks, even while the individual VM monitors are off.

Number of checks per pack

Turn on the virtual machine checks

Each Groups pack contains a group named VMware V<version> VMs with Full Ransomware Vulnerability Check Enabled. It also contains overrides that set Enabled = True on every VM check for the members of that group.

• V70: the Groups pack is unsealed. Add the VMs you want to check to the group.
• V80 and V90: the Groups packs are sealed, so you can't edit the group membership. The group stays empty. Use this workaround instead:
  1. Create your own group in an unsealed management pack and add the VMs you want to check.
  2. For each virtual machine check in the table below, create an override for your group and set Enabled to True.

Display names in the console

In the SCOM console every check starts with "ESX V<version> Ransomware Vulnerability <object> Status", for example "ESX V90 Ransomware Vulnerability Host Status". The tables below leave that prefix out. Notes:

• In V70 and V80 the console shows question marks instead of quotes in the three switch checks.
• In V70 and V80 the copy check and the paste check have the same display name. The tables add "(copy)" and "(paste)" to tell them apart.
• The overall monitors are named "ESX V<version> Ransomware Vulnerability Host Overall Status", "... VirtualMachine Overall Status" and "... DistributedVirtualSwitch Overall Status".

V70 checks (vSphere 7)

V80 checks (vSphere 8)

V90 checks (vSphere 9, VCF 9.0)

See also

• Monitor vSphere for ransomware vulnerabilities
• Choose which VMware MP files to import
• Rules and monitors in the VMware Management Pack
• VMware Management Pack release notes