My customer use Anyconnect hostscan to check Antivirus status before allow login to VPN.
A linux host use Sophos Antivirus - used components:
Sophos Anti-Virus 9.16.0
Cisco AnyConnect client 4.8.03036
Cisco AnyConnect Hostscan 4.8.03036
He found that in attribute endpoint.am.lastupdate is filled with date from Threat data release field instead of Last update
To be exact:
/opt/sophos-av/bin/savdstatus --version Copyright 1989-2019 Sophos Limited. All rights reserved.
Sophos Anti-Virus = 9.16.0
Build Revision = 2821170
Threat detection engine = 3.77.1
Threat data = 5.74
Threat count = 49416392
Threat data release = Tue Mar 31 00:00:00 2020
Last update = Tue Apr 21 09:57:18 2020
and the hostscan attribute endpoint.am.lastupdate shows date "Tue Mar 31 00:00:00 2020".
Is that some bug or can somebody checked this?
Regards
Pavel