Antivirus

Administrator Help | TRITON AP-EMAIL | Version 8.3.x

Antivirus analysis checks email and any attachments for the presence of email-borne viruses and threats.

If your subscription includes the Email Hybrid Module, you can mark the Use hybrid service analysis results check box to use the email hybrid service analysis score in addition to the on-premises email protection system antivirus analysis.

Configure how you want the filter to examine messages for viruses from among the Filter analysis options:

Treat errors as infected. If antivirus analysis encounters errors, the email is handled as if it is infected. The default setting is on.

Treat encrypted files as infected. A message that is encrypted in a way that the antivirus engine does not understand is treated as infected. The default setting is on.

Analyze message body for viruses. Message content is analyzed for embedded malicious scripts or attachments that cannot be examined properly. If message format problems cause attachments to be seen as part of the message body, the attachments are analyzed and viruses are detected. Default setting is off.

The Main > Policy Management > Filters > Add (or Edit) Filter page includes the following types of analysis:

Standard analysis. Performs standard email content and attachment analysis for virus threats

Advanced analysis. Performs email attachment analysis for Microsoft Office documents.

You may select either one or both types of analysis to perform, along with the sensitivity level of each analysis type. If you select both types of analysis, standard analysis is performed first, then advanced analysis. The higher the sensitivity level, the larger the volume of email that is designated as virus. Note that enabling the advanced antivirus engine may affect system performance.

Configure 1 of the following filter responses:

Remove infected attachments. Deletes the attachment that triggers the antivirus filter.

Take no action. This is the default action. The attachment and virus are stored in a predefined location (see Creating and configuring a filter action for information). If required, a message may be sent to the administrator stating that a virus has been found.

You may also add a notification to a suspected virus email, to alert a recipient that the message may be infected. Use the Advanced settings to configure the notification function:

Mark the Notify recipient check box to enable the notification function.

Enter the desired notification text in the entry field below the check box (maximum length of 8192 characters total, up to 990 characters per line; a line break is 2 characters).

Specify whether the notification should appear at the top of the message or at the bottom. Default location is at the top of the message.