Antivirus and AMP scan consulting

[may-ye]

ESA performs antivirus and AMP scans for both the message body and attachments.The customer was intercepted by antivirus due to attachments before, so now we need help to confirm the following problems:

1. When antivirus scan the message body, Will the scan result also be marked as Repair, Unscannable, and Encrypted?

2. Antivirus Result If you run Unscannable or Encrypted and continue to deliver the message, does the AMP scan result remain unchanged?

[UdupiKrishna · Accepted solution]

AV repair action is enforced on infected attachment (not message body) as long as the engine is configured with "scan and repair" under message scanning settings.

Unscannable is when AV reaches its configured scanning timeout (default 60 secs for Sophos) regardless of whether its just message body or message body+attachment

Encrypted detection is when AV is not able to complete a scan due to encrypted contents (PGP or S/MIME). Additionally an email is considered encrypted by AV if it simply contains an encrypted attached (txt, doc, ppt etc)

Speaking about the 2nd question, AMP will scan according to the policy settings regardless of whether AV considered a message unscannable or encrypted.

[may-ye]

Thanks for you support, I got it.