MOVEit Transfer content scanning enables you to apply content screening at scale using a third-party virus scanner, a third-party DLP (Data Loss Prevention) pattern and expression engine, or both. Content scanning can be used as an extra layer of control to help inspect, analyze, track, and block inbound or outbound file transfer.

You can control data shared from/added to MOVEit Transfer based on user/user group and:

  • Anti-virus (AV) engine scan results.
  • DLP indicators in the form of text patterns (such as business impact or information security classification markings), signatures (such as full MD5 sum), and any other rules you combine to categorize the data and designate relevance to certain users or user groups.
  • Maximum data size (for performance and when 'downstream' applications handle files larger than this threshold).

Content scanning is typically most necessary when MOVEit Transfer data transfers occur across a firewall. Before MOVEit Transfer completes the data transaction, it forwards the data by way of Internet Content Adaptation Protocol (ICAP) to the appropriate scanner (AV or DLP). MOVEit allows or blocks the transfer based on the scan results.

Transfer Direction

Scan Type

Notes

Outbound (share from MOVEit Transfer and Ad Hoc transfers)

Data loss prevention

DLP compliance. Logs or blocks sharing of DLP-rules identified content (for example, privileged or business sensitive data).

Inbound (add to MOVEit Transfer)

Anti-virus, data loss prevention

Protective AV scan.

DLP rules evaluation, tagging and determination of MOVEit Transfer user access based on rule sets.

Third-party AV and/or DLP instances are managed and deployed separately from MOVEit Transfer. Note that different scanning servers might have different capabilities and performance capacity. A server can be configured to do AV, DLP or both. You can configure MOVEit to communicate with multiple different AV and DLP servers. You enable scanning at the system level, but you can have only one AV and one DLP server enabled at a time. You can then disable a specific AV or DLP process at the organization level.

Anmerkung: Wenn sowohl der DLP- als auch der AV-Content-Scan aktiviert und so konfiguriert sind, dass die Datei blockiert (oder implizit aufgrund von Zeitüberschreitung blockiert) wird, können Sie anhand der Protokolle diagnostizieren, welcher Scanprozess die ursprüngliche Fehlermeldung ausgegeben hat, die zur Blockierung der Datei in MOVEit Transfer geführt hat.

Compatible Anti-Virus and Data Loss Prevention Scan Engines

The following major AV and DLP engines are compatible with MOVEit Transfer. Other scanning and compliance engines that support ICAP primitives could also work.

Anti-Virus Scanner

Data Loss Prevention Scanner

McAfee VirusScan Enterprise for Storage

RSA Data Loss Prevention (DLP)

McAfee Web Gateway

McAfee Web Gateway*

Sophos Anti-Virus Dynamic Interface (SAVDI) scanner

Symantec DLP Suite (last tested with 15.x)*

Symantec Protection Engine (last tested with 7.8.0.141)

*DLPBlockedresponses require additional configuration for McAfee and Symantec.

Anmerkung: Note: Check the MOVEit Transfer Release Notes for new additions to these lists and for any specific versioning requirements.

Anti-Virus

Anti-virus scan (SETTINGS > System > Content Scanning > Anti-Virus) allows scanning of incoming files using a remote anti-virus server. MOVEit Transfer submits incoming files to the anti-virus server using the ICAP protocol. Files that are clean are then passed into the MOVEit Transfer filesystem.

What happens when AV content scanning is enabled?

MOVEit Transfer scans uploaded files as follows:

  • Files are scanned during the upload and are not entered into the MOVEit Transfer filesystem until the content scanner returns an indication that the file is not infected.
  • If the file does have a virus, it is rejected, and the user receives an error message.
  • If the ICAP server connection fails or the connection limit is exceeded, or if for some reason the file cannot be checked, the upload is rejected and the user receives an error message.
  • If a maximum file size is configured, files are scanned up to that configured size. You can also elect for no maximum.

Before You Begin

You need the following before you can enable virus scan:

  • A third-party virus scan engine running and on a host accessible to MOVEit Transfer by way of ICAP.
  • Scan engines must support ICAP protocol (RFC3507 for more information), which is required to interface with MOVEit Transfer. (Typical "Desktop" virus scanners from the same vendors will not support the scale needed by MOVEit Transfer.)
Anmerkung: If you are using the AS2 Module to transfer files, be aware that content scanning does not apply to AS2 transfers. Use MOVEit Automation to scan AS2 transfers for viruses.

Configuring Anti-Virus Scanning for MOVEit Transfer Hosts

After you configure the anti-virus server, set up content scanning for your MOVEit Transfer organizations. Anti-virus settings apply to all MOVEit Transfer organizations on the system.

Anmerkung: For more information, see the topic titled Content Scanning.

Data Loss Prevention (DLP)

Data Loss Prevention scans (SETTINGS > System > Content Scanning > DLP) send incoming data from file transfers and Ad Hoc transfers, including subject, note/body and attachments, to an external DLP server so that MOVEit Transfer can:

  • Use the DLP rule set to identify sensitive or valued content and the associated level of user/user role access. (For inbound packages.)
  • Determine whether a package can be shared (based on the current user role and DLP policy requirements. (For outbound packages.)

MOVEit Transfer uses the ICAP protocol to submit incoming data to the DLP server. The DLP server applies configured data protection policies as it scans the data. When the DLP server returns its response, MOVEit configurations determine whether to block, quarantine or allow the transmission. MOVEit logs all DLP policy violations returned by the DLP server.

Anmerkung: If you are using the AS2 Module to transfer files, be aware that content scanning does not apply to AS2 transfers.

Configuring DLP Scanning for MOVEit Transfer Hosts

To implement Data Loss Prevention (DLP) scanning in MOVEit Transfer you must:

  • Install and configure the external and (typically) remote DLP server.
  • Configure DLP servers for a MOVEit system. You can enable only one DLP server at a time.
  • Configure DLP rulesets for user classes or users for each MOVEit organization.

What happens when DLP content scanning is enabled?

MOVEit Transfer scans downloaded files as follows:

  • Files are scanned based on a configured maximum size. See Content Scanning, for more information.
  • Files are scanned during the upload and are not entered into the MOVEit Transfer filesystem until the content scanner returns an indication that the file is not blocked for the user that is uploading the file.
  • If the file violates a DLP policy, it will be processed according to the MOVEit policy and rulesets, and the user attempting to upload will receive an error message. Note that if a virus is found during a concurrent anti-virus scan, the file is automatically blocked from upload.
  • If the ICAP server connection fails or the connection limit is exceeded, or if for some reason the file cannot be scanned, the upload will be rejected and the user will receive an error message.
  • There is no support for re-scanning files, or scanning on downloads. The ability to download files is based on the results of the scan when the file was uploaded and rights for the user attempting the download. Quarantined files may be cleared for download under special circumstances.
Anmerkung: Only one DLP scanner can be enabled on your system at any time.

Scanner Availability

If Content Scanning is enabled, MOVEit Transfer checks every few minutes to make sure the enabled AV and/or DLP scanner is available. This is part of the SysCheck routine (see Advanced Topics - System Internals - Scheduled Tasks), which can generate a built-in notification. It first checks the AV scanner and then the DLP scanner. If the either scanner is unavailable, SysCheck sends an email message to the Send Errors To email address and warns that the MOVEit Transfer server will not be able to transfer files until this situation is addressed. When the scanner becomes available again, SysCheck sends an email that states that scanning is now working.

Anmerkung: The system administrator should always test the connection when configuring a content scanner. They can also run MOVEit Transfer Check on demand.

Logging

If a file was scanned, file detail pages show the anti-virus (AV) or the data loss prevention (DLP) server information.

In the following example, the first line of Content Scanning information is for the AV server and the second line is for the DLP server.

If a file fails the scan, an error message appears on the Home page of the user who uploaded the file.

Log file entries include status, user, and file attributes as well as policy violations (if applicable).

  • AV-Fehler werden anhand von Fehlercodenummern (6100–6103) gemeldet. Dies erleichtert das Filtern von Protokollen. Wenn ein Upload infolge eines Content-Scannings nicht ausgeführt wird, sind in den entsprechenden Protokolltabellendatensätzen der AV-Servername und, sofern verfügbar, der Name des Virus angegeben.

    Verstöße gegen DLP-Richtlinien werden anhand der Fehlercodenummern 0 und 6150 wie folgt gemeldet:

    • Fehlercode 0 weist auf zulässige oder in Quarantäne gestellte Verstöße hin.
    • Fehlercode 6150 weißt auf blockierte Verstöße hin.

Notifications

Notification macros for content scanning, if enabled, can report the scan results for both anti-virus (AV) and data loss prevention (DLP) scans.

AV and/or DLP information may be included in the following notifications:

  • New File Upload Notification
  • File Upload Confirmation
  • New Package
  • New Package Secure Attach
  • New Temp User Package (with password)
  • New Temp User Package (with password) Secure Attach
  • New Temp User Package (with password link)
  • New Temp User Package (with password link) Secure Attach
  • New Guest Package
  • New Guest Package Secure Attach
  • File Non-Delivery Receipt
  • File Upload List Notification
  • File Upload List Confirmation
  • File Not Downloaded List
  • File Delivery Receipt
  • Package Delivery Receipt
  • Package Download Receipt
  • Package Deleted By User
  • Package User Was Deleted

The standard templates for these notifications do not include the content scanning results. You can add the macros that report the scan results by creating custom notification templates. Custom notifications are set in an organization via Settings | Appearance | Notification | Custom.

Reports

Diese Berichte enthalten unterschiedliche Arten von Content-Scanning-Aktivitäten. Zwei Berichte zeigen spezielle Informationen zu den Scanergebnissen: Violations Blocked (Blockierte Verstöße) und DLP Violations (Allowed and Blocked) (DLP-Verstöße (zugelassen und blockiert)). Die restlichen Berichte sind Wartungsberichte mit aggregierten Anzahlen.

Wenn Sie als Administrator einer Organisation angemeldet sind, werden im Bericht Scanergebnisse für Ihre Organisation angezeigt. Wenn Sie als Systemadministrator angemeldet sind, kann der Bericht Angaben zu mehreren Organisationen enthalten.

Anmerkung: Typically, reports may contain up to 30 days of online audit records and 30 days of online performance statistics, depending on how you run the scheduled cleanup tasks that archive the older data.