Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Creating Web or Secure Web Application Defenses
6-14 Configuring Application Defenses
If you select Scan for Known Viruses only, traffic that matches a rule
requiring virus scanning will be scanned for viruses with known
signatures.
If you select Scan for Unknown Viruses only, traffic that matches a
rule requiring virus scanning will be scanned only for unknown
signatures using heuristic methods.
If you select both Scan for Known Viruses and Scan for Unknown
Viruses, traffic that matches a rule requiring virus scanning will be
scanned for both known and unknown virus signatures.
Note: If you do not select at least one scanning option and you have filter rules
configured that require virus scanning, traffic that matches those rules will NOT be
scanned for known virus signatures.
2. Configure the appropriate MIME/Anti-Virus filter rules in the MIME/Anti-
Virus Filter Rules table, as follows:
Create a new filter rule—To create a new filter rule, click New and
see “Configuring MIME filtering rules” on page 6-15.
Modify an existing filter rule—To modify an existing filter rule,
select the rule you want to modify, and click Modify. See
“Configuring MIME filtering rules” on page 6-15. (If you are
modifying the default MIME filtering rule, see “Configuring the
Default filtering rule action” on page 6-17.)
Delete a filter rule—To delete an existing filter rule, select the rule
you want to delete and click Delete. You will be prompted to
confirm your decision.
3. To configure file handling for infected files in the Infected File Handling
area, do the following:
a. Determine how infected files will be handled.
To discard infected files, select Discard.
To remove the virus from the file and then continue processing the
file, select Repair.
b. To quarantine infected files for later viewing, select Quarantine Files.
If you select this option, the files will be quarantined in:
/var/log/vscan/quarantine/