Forum Discussion
keefyweefy
Nimbostratus
NimbostratusEndpoint AV failures
Hi
We're having problems with endpoint security within Firepass.
Firepass v6.0.3
Client:
Vista
Avira AntiVir
Using the default AV Check the client falls through to fallback. I've placed a write to logon log on the fallback path with:
monitor: %session.av.summary.monitor%
count: %session.av.summary.count%
The output into the logs is:
pre-logon: monitor: 0
count: 0
So it would appear the AV check isn't detecting the AV software on the client.
Any advise would be appreciated.
2 Replies
VictorS_96310Try this for your AV rule:
(session.av.summary.monitor >= 1) AND (NOT(EXIST(session.av_scan.infected) AND (session.av_scan.infected != 0)))
And try this for your logger:
Antivirus: %session.detected_av.av_1.name%,
%session.detected_av.av_1.monitor%,
Antivirus2: %session.detected_av.av_2.name%,
%session.detected_av.av_2.monitor%,
Mike_61719Cirrus
It is an Opswat issue, install the latest version. You will have issues with Opswat and the engine versions of software, best case is to install an AV solution that rarely changes versions.
