How To Install & Use Metascan With Policy Patrol

Transcription

1 Policy Patrol 9 technical documentation June 16, 2014 How To Install & Use Metascan With Policy Patrol No antivirus engine is perfect. With over 220,000 new threats emerging daily, it would be impossible for any single antivirus product to provide guaranteed detection 100% of the time. Using Metascan technology, Policy Patrol can quickly scan attachments with multiple anti-malware engines to detect and block advanced threats. By using multiple anti-malware engines, Metascan increases detection rates for all types of malware without the hassle of licensing and maintaining multiple antivirus engines. Metascan can also perform file sanitization and file type checking, preventing zero-day and targeted attacks. Metascan can be purchased as an add-on for Policy Patrol, and is available in packages with 4, 8, 12, and 16 anti-malware engines. If needed, more engines can be added up to a total of 30 engines. More information about the different packages can be found on the following page: This guide describes how to install and use Metascan with Policy Patrol. Step 1. Install Metascan In order to use Metascan with Policy Patrol, you need to install Metascan on your network. Metascan can be installed on the same machine as Policy Patrol, but it can also be installed on a separate machine. If Metascan is installed on a separate machine, you must configure Policy Patrol to connect to the Metascan server. Note: File sanitization is only available if you install Metascan on the same machine as Policy Patrol. To obtain your Metascan trial version, go to Fill out the form and follow the instructions in the to download Metascan. You may also need to install a Policy Patrol Metascan update depending on your Policy Patrol version. Instructions are provided in the of 11 -

2 Once you have downloaded Metascan, follow the next steps: Note that Metascan requires.net Framework 4.0 or later to be installed on the system. 1. Double-click on the executable. The welcome screen will appear. Click on Start and wait until the Metascan prerequisites are installed. 2. When the Setup Wizard appears, click Next. 3. Select Accept the terms in the License Agreement and click Next. 4. Choose which components of Metascan you would like to install. - 2 of 11 -

3 5. Click Next. 6. Click Install. 7. Click Finish to complete the installation. 8. Go to Start > OPSWAT > Metascan Management Console. The console will open in a browser. You can configure scanning options from Workflow in the top menu. 9. If you installed Metascan on a different machine than Policy Patrol: Go to Clients in the top menu. - 3 of 11 -

4 Copy the link from the Metascan Server box for entering in Policy Patrol (see below). Make sure you open the port specified in the URL in order to allow Policy Patrol to remotely connect to this server (in the screen above this is port 8008). Tip: Metascan clients are also available for the Metascan server, allowing you to scan endpoint systems for advanced threats. Step 2. Enable Metascan in Policy Patrol After installing Metascan, you must enable Metascan in Policy Patrol. Follow the instructions below depending on whether you have installed Metascan on the same machine as Policy Patrol or on a separate machine. If Metascan is installed on the same machine as Policy Patrol: If Metascan is installed on the same machine as Policy Patrol you can enable Metascan multi anti-virus scanning by going to Anti-Virus > Metascan and selecting the option Enable Metascan. Note: You must restart the Policy Patrol Server service from services control panel in order for Policy Patrol to detect that Metascan has been installed on the same machine. - 4 of 11 -

5 If Metascan is installed on a separate machine: If Metascan is installed on a different machine than Policy Patrol, enable Metascan multi anti-virus scanning by following the next steps: 1. Go to Anti-Virus > Metascan and select the option Configure remote Metascan connection. - 5 of 11 -

6 2. Specify the URL of the machine where Metascan is installed. This URL can be found in the Metascan Management Console > Clients > Metascan Server. Make sure that the port in the URL is open (in this example it is port 8008). - 6 of 11 -

7 3. Click Test connection. A message box will appear saying that the connection was successfully created. Click OK. 4. Now select the option Enable Metascan. Step 3. Configure Actions In Configure actions.. you can select what actions to take on each message that has been detected as containing a known or possible virus. Policy Patrol includes the following anti-virus categories: Infected, Suspicious, Password protected and Spoofed file types. To view which actions have been configured for the category, click on the Browse button next to the anti-virus category, right-click the category in the list and select Edit. - 7 of 11 -

8 In Primary action, the following options are available: Delete message: Select this option to delete the message. Note that if you select to delete the message, you will only be able to configure the secondary actions Add sender s address to black list and Add sender s IP address to black list. Redirect message: Select this option to redirect the message to another mailbox. Enter or select the address to redirect the messages to. Move to folder: Select this option if you wish to quarantine the message in a monitoring folder. Select the appropriate folder by clicking on the button. Accept message: Select this option if you wish to accept the message and apply only the secondary action(s). - 8 of 11 -

9 In Secondary actions, the following options are available: Add x-header to message: If you select this option Policy Patrol will add an X- header to the message. Enter the header name and value you wish to add, for instance X-PP-VIRUS = TRUE. Add tag to subject: This option will add a tag to the subject. Select the tag template to be used by clicking on. Add sender s address to black list: Select this option to add the sender s address to the black list. Add sender s IP address to black list: Select this option to add the sender s IP address to the black list. In Notifications, specify the sender and recipient(s) for the notifications: Enter or select a From: address. If you wish a display name to appear in the notification message, enter Display name < address>, e.g. "John Doe" <John.Doe@company.com>. Now specify who should receive the notification (Sender, Recipient, Administrator*, Sender s Manager**, Recipient(s) Manager** or Other(s)) and select the template to be used for each recipient. If you wish to use a new template, click New. * The Administrator address(es) are taken from <server name> > Advanced > System configuration > System notifications. ** The manager s address will be taken from the Active Directory user properties. If the sender or recipient is external, no notification is sent since the manager of an external recipient is not known. - 9 of 11 -

10 Step 4. Configure File Type Spoofing In addition to anti-malware scanning, Metascan can verify and detect spoofed attachment types, preventing for instance.exe files posing as.txt files from entering your organization. To specify which attachment types should be checked for spoofing, go to Configure actions and select Spoofed file types. You will be able to select which file types need to be verified for file type spoofing. If Metascan determines that a file is spoofed, Policy Patrol will take the actions as specified in the Spoofed file types anti-virus category. Step 5. Configure File Sanitization To prevent advanced threats that might be missed by anti-malware engines, Metascan can sanitize potentially dangerous file types, thwarting zero-day and targeted attacks by converting to a different file type (e.g. DOC to PDF) and eliminating any embedded objects and macros. Note: File sanitization is only available if you install Metascan on the same machine as Policy Patrol. The file sanitization option is available as an action in the Security rule: 1. In Rule Actions, select the secondary action Convert attachments with Metascan of 11 -

11 2. You will be able to select from a list of attachment formats to convert to another format. In the From format column, select the original file format that should be converted. In the To format column, select the file format that the attachment should be converted to. Click on Add to add another file format to convert. Tick the option Compress converted attachment(s) into zip archives if you would like to compress all attachments into a zip archive after they have been converted of 11 -