Enable the anti-malware feature on engines

To use anti-malware, you must enable the anti-malware feature in the Engine Editor.

For more details about the product and how to configure features, click Help or press F1.

Steps

Select Configuration.
Right-click an NGFW Engine, then select Edit <element type>.
In the navigation pane on the left, browse to Add-Ons > Anti-Malware.
Select Enable.
Select the log level from the Malware Log Level drop-down list.
- The log levels are the same as used in Access rules.
- If you selected Alert in the Malware Log Level drop-down list, select the Alert element from the list.
In the Malware Signature Update Settings section, select how often the engine checks for updates to the anti-malware database.

Note: The engine queries DNS servers to resolve the anti-malware database URLs. Define at least one DNS IP address on the General branch of the Engine Editor.
Enter the URL of the anti-malware database mirror in the Mirror(s) field.
The engines contact the mirror to update the anti-malware database. Separate multiple addresses with commas.
Continue the configuration in one of the following ways:
- If you have not yet defined when to use anti-malware inspection, edit the rules in the File Filtering Policy.
- Otherwise, click Save and Refresh to transfer the changes.

Use this branch to enable and change settings for anti-malware checks on the engine.

Option	Definition
Enable	Enables anti-malware checks.
Malware Log Level	The log level for anti-malware events. None — Does not create any log entry. Transient — Creates a log entry that is displayed in the Current Events mode in the Logs view (if someone is viewing it) but is not stored. Stored — Creates a log entry that is stored on the Log Server. Essential — Creates a log entry that is shown in the Logs view and saved for further use. Alert — Triggers an alert entry.
Alert	When Alert is selected as the log level, specifies the Alert element that is sent.

Option	Definition
Malware Signature Update Settings section
Update Frequency	Defines how often the engine checks for updates to the anti-malware database. Never — The engine does not check for updates. You must update the anti-malware database manually. When Anti-Malware Daemon Starts — The anti-malware daemon starts, for example, when the anti-malware feature is enabled or when the engine restarts. Every Hour — The engine checks for updates once an hour. Daily — The engine checks for updates once a day. Set the Time of day that the engine checks for updates. Weekly — The engine checks for updates once a week. Set the Day and Time of day that the engine checks for updates.

Option

Definition

Malware Signature Update Settings section

Update Frequency

Defines how often the engine checks for updates to the anti-malware database.

Never — The engine does not check for updates. You must update the anti-malware database manually.
When Anti-Malware Daemon Starts — The anti-malware daemon starts, for example, when the anti-malware feature is enabled or when the engine restarts.
Every Hour — The engine checks for updates once an hour.
Daily — The engine checks for updates once a day. Set the Time of day that the engine checks for updates.
Weekly — The engine checks for updates once a week. Set the Day and Time of day that the engine checks for updates.

Option	Definition
Malware Signature Mirror Settings section
Mirror(s)	Enter the URL of the anti-malware database mirror that the engine contacts to update the anti-malware database. Separate multiple addresses with commas.
Use HTTP Proxy (Optional)	Specifies that the engine uses an HTTP proxy to connect to the anti-malware database mirrors.
Host	The IP address or DNS name of the HTTP proxy.
Port	The listening port of the HTTP proxy.
Username	The user name for authenticating to the HTTP proxy.
Password	The password for authenticating to the HTTP proxy.
Hide	Prevents the password from being shown as plain text. Deselect this option to show the password. Selected by default.