...
Create a rule task to send a file to an Internet Content Adaptation Protocol server for antivirus scanning to an ICAP server.
Verify that an infected file is reported and blocked.
Access the scanning details for of the file.
Overview
The Internet Content Adaptation Protocol (ICAP) is a lightweight HTTP-like protocol specified in RFC 3507. ICAP is generally used to implement virus scanning and content filters in transparent HTTP proxy caches.
ICAP integration is a common feature of MFT solutions to trigger that triggers an antivirus scan before sending a file or after receiving a file. The file can be forwarded to an ICAP server with the ICAP protocol. The ICAP server proceeds with the antivirus scan and reports back the result results in the ICAP response message.
...
The ICAP integration has been tested with the c-icap server and follows the protocol standards.
Configuring UDMG to Send File to ICAP
...
Server
ICAP Processing Task
The UDMG ICAP task allows the exchange with a server complying with the RFC 3507 standard known as ICAP. It is used to transfer the contents of the a file to an ICAP service via a RESPMOD command and to obtain validation of this the file by the service (status 204).
...
The table below shows the list of parameters that are accepted by the ICAP task. Please check for the values that are relevant to your setup with the ICAP antivirus server administrator.
Parameter | Description |
---|---|
| The actual path of the file on the disk, the substitution variable #TRUEFULLPATH# that will be replaced by the actual location of the file being transferred. |
| The hostname or IP address of the ICAP; server , default defaults to "localhost". |
| The port of the ICAP server, default ; defaults to 1344. |
| The name of the ICAP service on the endpoint, default ; defaults to "avscan". |
| The timeout while waiting for a response from the ICAP server, in seconds, default ; defaults to 10s. |
| The number of time times allowed to retry after a connection's failure, default ; defaults to 1. |
| The identifier of the partner who requested the transfer. |
| Specifies the receive size to use, default ; defaults to 65536 bytes. |
| Specifies the send size to use for chunk-encoding, default ; defaults to 8192 bytes. |
| Do not raise an error if the file cannot be sent to the ICAP server due to network issue issues or the server is not available. Default ; defaults to false. |
| Do not raise an error if the file is too big for scanning, bigger than maxSize. Default ; defaults to false. |
Step 1 | From the UDMG Admin UI navigation pane, select Management > Rules. The Rule Rules list displays. | |||||
---|---|---|---|---|---|---|
Step 2 | select Select a rule or create a new one. The Rule Details panel displays. | |||||
Step 3 | Scroll down to the Post-Tasks box on the Rule | detail Details panel.
| ||||
Step 4 | Click Save and Confirm. | |||||
Step 5 | The rule is updated to include the ICAP task as part of the UDMG file transfer workflow. The task tab shows a green dot to indicate that a task is configured. | |||||
Step 6 | Proceed with attempting to transfer the EICAR Anti-Virus Test File. | |||||
Step 7 | After the file upload, it is transferred to the ICAP antivirus server during the post-task processing and stops in ERROR status. The Error Message indicates that an infection is found. If not infection was found by the ICAP antivirus server does not find an infection, then the transfer would is considered complete with a successful status. | |||||
Step 8 | The infection error details can be forwarded to UAC as a universal event, see . See the Universal Event Integration, and further documentation for the list of corrective actions that can be triggered by the Controller. | |||||
Step 9 | The scanning details from the interrogation to the ICAP antivirus server are kept as transfer metadata with the "udmg_icap" prefix. In particular, the X-headers show the type of infection as reported by the server. They The scanning details can be displayed , for example here with using the command line interface using and the ‘transfer get’ command.
Or on the Info tab of the transfer details on UDMG Admin UI. The transfer log also shows an error with an infection detection. |
Panel | ||
---|---|---|
| ||
|
Checking
connectivityConnectivity to ICAP
serverServer
A simple ICAP client tool is provided with the UDMG software package to test the connectivity and the validity of the configuration options.
Panel |
---|
|
See more additional details on the utilities reference Utilities Reference Guide page: icap-client.