How to test AV Functionality when Eicar not in signatures?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

How to test AV Functionality when Eicar not in signatures?

L2 Linker

How to test AV Functionality when Eicar is not recognized by the Firewall? 

Roman

5 REPLIES 5

Cyber Elite
Cyber Elite

Identify what policy allows traffic.

Do you have antivirus security profile attached to this policy?

Is Eicar downloaded over web-browsing or inside ssl traffic?

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

L7 Applicator

Eicar is the only safe way to test AV functionality. The Eicar files are recognized by the firewall's AV, so it should be a valid test for you as long as you are scanning for the traffic (i.e., make sure you have an AV profile for the traffic type, make sure you're decrypting SSL if it's on an SSL page, etc.).

 

Anything else you do can potentially be dangerous to your network. If the firewall is misconfigured and you use a live malware file, you risk compromising your environment.

 

Cheers,

Greg

Hello,

 

recognized by the Firewall = not in the signatures in last months, please see here

https://live.paloaltonetworks.com/t5/General-Topics/Eicar-no-longer-in-AV-signatures/m-p/66700/highl...

 

Does your firewall find eicar here ? https://www.etes.de/downloads/eicar-testvirus/

 

Roman

 

There was a bug in the AV signature update for Eicar a while ago, but it's working fine again now. I'm right now using AV version 1707-2185. Are your AV signatures updated?

 

Go to Monitor -> URL Filtering, and filter out "( referer eq 'http://www.eicar.org/85-0-Download.html' )". You could perhaps also add "and ( url eq 'www.eicar.org/download/eicar.com' )" if you clicked the first test object on Eicar.

 

Check the column "Rule", to see which rule it hits.

 

Then check the policy, and the correct Rule, to see if you have a working AV profile there. Action "allow" in the profile will most likely not log anything.

 

When everything is working, you should be able to click the magnifier for the selected logs in URL filtering, and in there see related logs, and there the Eicar virus.

Thanks, I will test it.

Roman

  • 5345 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!