ZyXEL ZyWALL ATP700 User Guide - Page 579

Chapter 27 Anti-Malware The following table describes the labels in this screen. Table 221 Configuration > Security Service > Anti-Malware LABEL DESCRIPTION General Setting Enable Select this checkbox to activate the anti-malware feature to protect your connected network from infection and the installation of malicious software. Scan and detect EICAR test virus Selecting this checkbox also activates Threat Intelligence Machine Learning (TIML). TIML signatures come from the sandboxing inspection results and helps the Zyxel Device block possible malicious or suspicious files. Select this option to have the Zyxel Device check for an EICAR test file and treat it in the same way as a real malware file. The EICAR test file is a standardized test file for signature based anti-malware scanners. When the scanner detects the EICAR file, it responds in the same way as if it found real malware. The EICAR file can also be compressed to test whether the anti-malware software can detect it in a compressed file. The EICAR test string consists of the following humanreadable ASCII characters. Scan Mode Express Mode Stream Mode Hybrid Mode File Type For Scan Available File Types X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* In this mode you can define which types of files are scanned using the File Type For Scan fields. The Zyxel Device then scans files by sending each file's hash value to a cloud database using cloud query. This is the fastest scan mode. In this mode the Zyxel Device scans all files for viruses using anti-malware signatures to detect known virus pattens, and Threat Intelligence Machine Learning. Threat Intelligence Machine Learning is a master cloud database containing malware patterns learned from all Zyxel Devices. This is the deepest scan mode. In this mode you can define which types of files are scanned using the File Type For Scan fields. The Zyxel Device then scans files by sending each file's hash value to a cloud database using cloud query. It also scans files using anti-malware signatures, and Threat Intelligence Machine Learning. This mode combines Express mode and Stream mode to offers a balance of speed and security. File types that can be checked by the Zyxel Device are listed here. Note that the files on this list are currently bypassed. To use this feature on a specific file type, click this file type and then click the right arrow button. Applied File Types Destroy infected file Log See available file types in Table 220 on page 576. File types that will be checked are listed here. If you don't want a file type to be checked, click this file type and then click the left arrow button. When you select this check box, if a malware signature is matched, the Zyxel Device overwrites the infected portion of the file with zeros before being forwarded to the user. The uninfected portion of the file will pass through unmodified. These are the log options: Check White List Add Edit Remove • no: Do not create a log when a packet matches a signature. • log: Create a log on the Zyxel Device when a packet matches a signature. • log alert: An alert is an emailed log for more serious events that may need more immediate attention. Select this option to have the Zyxel Device send an alert when a packet matches a signature(s). Select this check box to have the Zyxel Device not perform the anti-malware check on files with names that match the white list patterns. Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. ZyWALL ATP Series User's Guide 579