Documentation | Support

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Working with Filters and Policies > Managing filters > Creating and configuring a filter > Antivirus
Antivirus
Administrator Help | Forcepoint Email Security | Version 8.5.x
Antivirus analysis checks email and any attachments for the presence of email-borne viruses and threats. Configure the antivirus filter on the page Main > Policy Management > Filters > Add (or Edit) Filter.
If your subscription includes the Forcepoint Email Security Hybrid Module, the email hybrid service analysis score can be used in addition to the on-premises email security system antivirus analysis.
The antivirus filter can be configured to specify the type and sensitivity of analysis, as well as the response of the filter.
Configure antivirus filter analysis
1.
From the section Filter Properties, mark the check box for one or both options under Filter analysis:
*
Treat errors as infected
If antivirus analysis encounters errors, the email is handled as if is infected. This setting is enabled by default.
*
Analyze message body for viruses
The message content is analyzed for embedded malicious scripts or attachments that cannot be examined properly. If message format problems cause attachments to be viewed as part of the message body, the attachments are analyzed and viruses are detected. This setting is disabled by default.
2.
From the section Filter Properties, select one or both of the options under Tools:
*
Standard analysis
Performs standard email content and attachment analysis for virus threats.
*
Advanced analysis
Performs email attachment analysis for Microsoft Office documents and macros.
Either one or both types of analysis can be selected, along with the sensitivity level of each analysis type. If you select both types of analysis, standard analysis is performed first, then advanced analysis. The higher the sensitivity level, the larger the volume of email that is designated as virus. Enabling the advanced antivirus engine may affect system performance.
3.
From the section Sensitivity Level, select Low, Medium, or High.
4.
From the section Filter Properties, select one option under Filter response:
*
Remove infected attachments
Deletes the attachment that triggers the antivirus filter.
*
Take no action
This is the default action. The attachment and virus are stored in a predefined location (see Creating and configuring a filter action). If required, a message may be sent to the administrator stating that a virus has been found.
5.
From the bottom of the section Filter Properties, click Advanced.
The Advanced settings display. These settings are used to add a notification to a suspected virus email, to alert the recipient that the message may be infected.
6.
Mark the check box Notify recipient that the delivered email message may contain a virus.
7.
In the text box, enter the desired notification text.
The maximum length is 8192 characters total, up to 990 characters per line; a line break is two characters.
8.
Select where the notification should appear; Insert notification at top of message or Insert notification at bottom of message.
The default location is at the top of the message.
9.
Configure additional filter settings and click OK.
The antivirus filter settings are saved.

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Working with Filters and Policies > Managing filters > Creating and configuring a filter > Antivirus
Copyright 2022 Forcepoint. All rights reserved.