For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

VictorS_96310's avatar
VictorS_96310
Icon for Nimbostratus rankNimbostratus
Jun 09, 2009
Try this for your AV rule:

 

(session.av.summary.monitor >= 1) AND (NOT(EXIST(session.av_scan.infected) AND (session.av_scan.infected != 0)))

 

 

And try this for your logger:

 

Antivirus: %session.detected_av.av_1.name%,

 

%session.detected_av.av_1.monitor%,

 

 

Antivirus2: %session.detected_av.av_2.name%,

 

%session.detected_av.av_2.monitor%,