Use an Existing Advanced Threat Defense Scanning Report

Options for using an existing scanning report

There are several options for using an existing scanning report to handle access to web objects.

• Allow a file when a scanning report shows that it is not infected — There are files that are uploaded manually to Advanced Threat Defense where they are scanned and a report is generated. Web Gateway then allows users to download such a file if a report exists for it and this report shows that the file is not infected.

If a scanning report does not exist for a web object, the Antimalware.ATD.GetReport property can still be used in suitable rules. In these rules, the value of this property is false, as no scanning report was retrieved.

• Allow a file if no scanning report is available and scan this file offline — If no scanning report exists for a file that was requested for downloading, are rule can allow a user to download the file and let an offline scan be performed. After the scanning, a report is generated and forwarded to the administrator of the user's network.
• Block a file if no scanning report is available and scan this file offline — If no scanning report exists for a file that was requested for downloading, a rule can block access to the file and let an offline scan be performed. After the scanning, a report is generated and forwarded to the administrator of the user's network .

Sample rules for using an existing scanning report

There is no preconfigured rule set for using an existing Advanced Threat Defense scanning report in the default rule set system or the rule set library. You can, however, create suitable rules and a rule set for them on your own.

The following sample rules implement the solution that lets files be uploaded manually to Advanced Threat Defense. Downloading a file is allowed if the report that was generated by Advanced Threat Defense shows that the file is not infected.

The name of the rule set might be Use Existing Advanced Threat Defense Scanning Report. It must have the same criteria regarding media types as the Advanced Threat Defense library rule set and apply for all processing cycles.

The rule set should contain the following rules:

• A rule that uses the Antimalware.ATD.GetReport property to retrieve an existing scanning report
• A rule that evaluates files using this report and blocks access if the report shows that they are infected

The rule that retrieves the report might look as follows:

The rule blocks access to a file if no report exists for it. In this case, the next rule is not processed. This rule valuates a report. It might look as follows:

In both rules, a counter records how often files were blocked when Advanced Threat Defense functions were used.