Antivirus Decoder Action

[mrsoldner]

I feel silly asking this - wouldn't you want a deny on any decoder where a virus is detected rather than allowing the traffic and just throwing an alert?

[HULK]

Hello mrsoldner,

As per my understanding, action is taken based on the different severity level of that virus. If that virus is having typically very little impact /or no impact on an organization's infrastructure. Then the action will be set to "alert".

Thanks

[jtyler]

Setting a block for viruses on smtp will cause the originating server to keep trying to relay the email until a timeout occurs. This could potentially cause a lot of unwanted traffic pointed at your smtp server that is getting blocked over and over by the firewall. That may still be preferred to allowing a virus in via smtp, but it's just something to be aware of.

[HULK]

Hello jtyler,

It's a good example.

Thanks

[mrsoldner]

Is there somewhere that Virus severity is noted?