Anti-Malware and Advanced Threat Protection
Domain 5 covers the DVS anti-malware pipeline, reputation lookups, AMP file analysis, and outbound scanning. Expect questions about where scanning occurs, what happens to unscannable files, and which license enables which verdict source.
Scanning pipeline
- The DVS engine scans while the object streams to the client in a single pass; multiple engines (Sophos and McAfee) can be enabled and their verdicts combined.
- Web Reputation is checked first, so a high-risk site can be blocked before any download starts.
- File Reputation sends the SHA-256 hash to Talos cloud services; known-malicious files are blocked and unknown files can be sent for File Analysis (Threat Grid) when AMP is licensed.
- Scanning limits include maximum file size, scanned MIME/file types, and archive depth. Unscannable files - encrypted archives and unrecognized types - are handled by an explicit allow-or-block setting.
- Outbound Malware Scanning inspects the request body of HTTP POST/PUT uploads.
- HTTPS content must be decrypted to be scanned; otherwise only connection metadata is available.
Worked example
A user downloads a 40 MB ZIP from an allowed site, but the appliance is limited to 32 MB scanned files, and the policy is set to block unscannable content. Reasoning: the access policy allowed the URL; the anti-malware action is configured separately per policy, so the file is blocked as unscannable. Raising the size limit globally is costly; the better answer is to allow unscannable files only for the identity that needs them.
Traps that cost marks
- Believing AMP replaces the anti-malware engines; it adds reputation and analysis.
- Forgetting that HTTPS downloads need decryption to be inspected.
- Missing outbound firewall rules for AMP/Threat Grid cloud connectivity.
- Overlooking file-size and archive-depth limits when a malware test file is not caught.
- Confusing Monitor verdicts with blocking actions in the policy.