How to test AV Functionality when Eicar not in signatures?

[rkra]

How to test AV Functionality when Eicar is not recognized by the Firewall? 

Roman

[Raido_Rattameister]

Identify what policy allows traffic.

Do you have antivirus security profile attached to this policy?

Is Eicar downloaded over web-browsing or inside ssl traffic?

[gwesson]

Eicar is the only safe way to test AV functionality. The Eicar files are recognized by the firewall's AV, so it should be a valid test for you as long as you are scanning for the traffic (i.e., make sure you have an AV profile for the traffic type, make sure you're decrypting SSL if it's on an SSL page, etc.).

Anything else you do can potentially be dangerous to your network. If the firewall is misconfigured and you use a live malware file, you risk compromising your environment.

Cheers,

Greg

[rkra]

Hello,

recognized by the Firewall = not in the signatures in last months, please see here

https://live.paloaltonetworks.com/t5/General-Topics/Eicar-no-longer-in-AV-signatures/m-p/66700/highl...

Does your firewall find eicar here ? https://www.etes.de/downloads/eicar-testvirus/

Roman

[gtomte]

There was a bug in the AV signature update for Eicar a while ago, but it's working fine again now. I'm right now using AV version 1707-2185. Are your AV signatures updated?

Go to Monitor -> URL Filtering, and filter out "( referer eq 'http://www.eicar.org/85-0-Download.html' )". You could perhaps also add "and ( url eq 'www.eicar.org/download/eicar.com' )" if you clicked the first test object on Eicar.

Check the column "Rule", to see which rule it hits.

Then check the policy, and the correct Rule, to see if you have a working AV profile there. Action "allow" in the profile will most likely not log anything.

When everything is working, you should be able to click the magnifier for the selected logs in URL filtering, and in there see related logs, and there the Eicar virus.

[rkra]

Thanks, I will test it.

Roman