topic Re: How to test AV Functionality when Eicar is not recognised? in General Topics

How to test AV Functionality when Eicar not in signatures?

rkra — Tue, 01 Dec 2015 23:02:49 GMT

How to test AV Functionality when Eicar is not recognized by the Firewall?

Roman

Re: How to test AV Functionality when Eicar is not recognised?

Raido_Rattameister — Tue, 01 Dec 2015 17:48:33 GMT

Identify what policy allows traffic.

Do you have antivirus security profile attached to this policy?

Is Eicar downloaded over web-browsing or inside ssl traffic?

Re: How to test AV Functionality when Eicar is not recognised?

gwesson — Tue, 01 Dec 2015 18:37:07 GMT

Eicar is the only safe way to test AV functionality. The Eicar files are recognized by the firewall's AV, so it should be a valid test for you as long as you are scanning for the traffic (i.e., make sure you have an AV profile for the traffic type, make sure you're decrypting SSL if it's on an SSL page, etc.).

Anything else you do can potentially be dangerous to your network. If the firewall is misconfigured and you use a live malware file, you risk compromising your environment.

Cheers,

Greg

Re: How to test AV Functionality when Eicar is not recognised?

rkra — Tue, 01 Dec 2015 23:06:22 GMT

Hello,

recognized by the Firewall = not in the signatures in last months, please see here

https://live.paloaltonetworks.com/t5/General-Topics/Eicar-no-longer-in-AV-signatures/m-p/66700/highlight/true#M39288

Does your firewall find eicar here ? https://www.etes.de/downloads/eicar-testvirus/

Roman

Re: How to test AV Functionality when Eicar is not recognised?

gtomte — Wed, 02 Dec 2015 07:52:30 GMT

There was a bug in the AV signature update for Eicar a while ago, but it's working fine again now. I'm right now using AV version 1707-2185. Are your AV signatures updated?

Go to Monitor -> URL Filtering, and filter out "( referer eq 'http://www.eicar.org/85-0-Download.html' )". You could perhaps also add "and ( url eq 'www.eicar.org/download/eicar.com' )" if you clicked the first test object on Eicar.

Check the column "Rule", to see which rule it hits.

Then check the policy, and the correct Rule, to see if you have a working AV profile there. Action "allow" in the profile will most likely not log anything.

When everything is working, you should be able to click the magnifier for the selected logs in URL filtering, and in there see related logs, and there the Eicar virus.

Re: How to test AV Functionality when Eicar is not recognised?

rkra — Wed, 02 Dec 2015 11:32:57 GMT

Thanks, I will test it.

Roman