Page Comparison

...

Parameter	Description
`path`	The actual path of the file on the disk, use the substitution variable #TRUEFULLPATH# that will be replaced by the actual location of the file being transferred.
`hostname`	The hostname or IP address of the ICAP server, default to localhost
`port`	The port of the ICAP server, default to 1344
`serviceName`	The name of the ICAP service on the endpoint
`timeout`	The timeout while waiting for a response from the ICAP server, in seconds, default to 10s
`retry`	The number of time to retry after a connection's failure, default to 1
`maxSize`	The identifier of the partner who requested the transfer
`receiveSize`	Specifies the receive size to use, default to 65536 bytes
`blockSize`	Specifies the send size to use for chunk-encoding, default to 8192 bytes
`ignoreNetworkError`	Do not raise an error if the file cannot be sent to the ICAP server due to network issue or server not available. Default to false
`ignoreTooBigFileError`	Do not raise an error if the file is too big for scanning, bigger than maxSize. Default to false

Step 1

From the UDMG UDMG navigation pane, select Management > Rules. The Rule list displays.

Step 2

select a rule or create a new one.

The Rule Details displays.

Step 3

Click the Post-tasks tab on the Rule detail panel

Edit the form to add an ICAP task and set the parameters for the ICAP server, see below for an example.

Step 4

Click Save and Confirm.

Step 5

The rule is updated to include the ICAP task as part of the UDMG file transfer workflow.

The task tab shows a green dot to indicate that a task is configured.

Step 6

Proceed with attempting to transfer the EICAR Anti-Virus Test File.

Step 7

After the file upload, it is transferred to the ICAP antivirus server during the post-task processing and stops in ERROR status. The Error Message indicates that an infection is found.

If not infection was found by the ICAP antivirus server, then the transfer would complete with a successful status

Step 8

The infection error details can be forwarded to UAC as a universal event, see Universal Event Integration, and further corrective actions can be triggered by the Controller.

Step 9

The scanning details from the interrogation to the ICAP antivirus server are kept as transfer metadata. They can be displayed, for example here with the command line interface using the ‘transfer get’ command.

In particular the X-headers show the type of infection as reported by the server.

Panel

$ udmg-client transfer get 13
● Transfer 13 (receive as server) [ERROR]
    Remote ID:         1619106277982470144
    Protocol:          sftp
    Rule:              Rec1
    Requester:         user
    Requested:         sftp_server_with_full_path
    Local filepath:    /tmp/sftp_server_with_root/rec1_dir/eicar.com-3
    Remote filepath:   /eicar.com-3
    File size:         68
    Start date:        2023-01-27 22:53:12.865894 +0000 UTC
    End date:          N/A
    Step:              StepPostTasks
    Bytes transferred: 68
    Error code:        TeExternalOperation
    Error message:     Post-tasks failed: Task ICAP @ Rec1 POST[0]: error file infected detected
    Transfer values:
      - Connection: keep-alive
      - Encapsulated: res-hdr=0, res-body=108
      - Istag: CI0001-66wOY91q7DqWWdCBj7SFEgAA
      - Server: C-ICAP/0.5.3
      - X-Infection-Found: Type=0; Resolution=2; Threat=Win.Test.EICAR_HDB-1;
      - X-Violations-Found: 1

...

Versions Compared

Old Version 4

New Version Current

Key