DOCS-11914 BACKPORT (#3186)

Author: Dave Cuthbert

source/administration/production-notes.txt

@@ -161,6 +161,8 @@ engine other than the one specified by :option:`--storageEngine <mongod --storag
 :binary:`~bin.mongod` must possess read and write permissions for the specified
 :setting:`~storage.dbPath`.
 
+.. include:: /includes/security/fact-antivirus-scan.rst
+
 .. _prod-notes-concurrency:
 
 Concurrency

source/administration/security-checklist.txt

@@ -191,6 +191,10 @@ Pre-production Checklist/Considerations
   to learn more about how you can use MongoDB's key security
   capabilities to build compliant application infrastructure.
 
+Antivirus and Endpoint Detection and Response Scanning 
+------------------------------------------------------
+
+.. include:: /includes/security/fact-antivirus-scan.rst
 
 Periodic/Ongoing Production Checks
 ----------------------------------

source/includes/security/fact-antivirus-scan.rst

@@ -0,0 +1,15 @@
+If you use an antivirus (AV) scanner or an endpoint detection and
+response (EDR) scanner, configure your scanner to exclude the
+:setting:`database storage path <storage.dbPath>` and the
+:setting:`database log path <systemLog.path>` from the scan.
+
+The data files in the ``database storage path`` are compressed.
+Additionally, if you use the :ref:`encrypted storage engine
+<security-encryption-at-rest>`, the data files are also encrypted. The
+I/O and CPU costs to scan these files may significantly decrease
+performance without providing any security benefits.
+
+If you don't exclude the directories in your ``database storage path``
+and ``database log path``, the scanner could quarantine or delete
+important files. Missing or quarantined files can corrupt your database
+and crash your MongoDB instance.