反病毒模块设置代码

2024年12月12日

ID 287276

如果在事件日志设置中启用了审核事件和修改设置的日志记录,则当“反病毒”模块的设置在规则中被编辑时,有关更改的详细信息会记录在审核日志事件中。

下表显示了“反病毒”模块的设置在审核日志记录中如何被编码。

审核事件记录中“反病毒 → 受感染的文件”部分的设置代码

“反病毒 模块→受感染的文件”的设置

审核事件记录中的代码

示例

左侧窗格中的“反病毒”开关

scanSettings.avScanSettings.
engineSettings.
enableScan

可能的值:

  • true,如果切换开关为
  • false,如果切换开关为

创建的规则:

scanSettings.avScanSettings.engineSettings.
enableScan[][false]

scanSettings.avScanSettings.infectedFirstAction
[][Skip]

scanSettings.avScanSettings.infectedSecondAction
[][Reject]

scanSettings.avScanSettings.backupInfected
[][false]

scanSettings.avScanSettings.infectedMark[]
[%5BInfected%5D]

scanSettings.avScanSettings.disinfectedMark[]
[%5BCured%5D]

修改的规则:

scanSettings.avScanSettings.engineSettings.
enableScan[false]
[true]

scanSettings.avScanSettings.infectedFirstAction
[Skip][Cure]

scanSettings.avScanSettings.infectedSecondAction
[Reject]
[DeleteAttachment]

scanSettings.avScanSettings.backupInfected[false]
[true]

scanSettings.avScanSettings.infectedMark
[%5BInfected%5D][%5BAV DETECT%5D]

scanSettings.avScanSettings.disinfectedMark
[%5BCured%5D][%5BDisinfected%5D]

删除的规则:

scanSettings.avScanSettings.engineSettings.
enableScan[true][]

scanSettings.avScanSettings.infectedFirstAction
[Cure][]

scanSettings.avScanSettings.infectedSecondAction
[DeleteAttachment][]

scanSettings.avScanSettings.backupInfected[true][]

scanSettings.avScanSettings.infectedMark
[%5BAV DETECT%5D][]

scanSettings.avScanSettings.disinfectedMark
[%5BDisinfected%5D]

[]

操作

scanSettings.avScanSettings.
infectedFirstAction

可能的值:

  • Skip,如果选择了“跳过”操作。
  • Cure,如果选择了“清除”操作。
  • DeleteAttachment,如果选择了“删除附件”操作。
  • Reject,如果选择了“拒绝”操作。
  • DeleteMessage,如果选择了“删除邮件”操作。

如果清除失败

scanSettings.avScanSettings.
infectedSecondAction

可能的值:

  • DeleteAttachment,如果选择了“删除附件”操作。
  • Reject,如果选择了“拒绝”操作。
  • DeleteMessage,如果选择了“删除邮件”操作。

将原始邮件放入备份

scanSettings.avScanSettings.
backupInfected

可能的值:

  • true,如果切换开关为
  • false,如果切换开关为

要添加到受感染邮件主题的文本

scanSettings.avScanSettings.
infectedMark

要添加到已清除邮件主题的文本

scanSettings.avScanSettings.
disinfectedMark

审核事件记录中“反病毒 → 扫描出错”部分的设置代码

“反病毒 模块→扫描出错”的设置

审核事件记录中的代码

示例

操作

scanSettings.avScanSettings.
errorAction

可能的值:

  • Skip,如果选择了“跳过”操作。
  • DeleteAttachment,如果选择了“删除附件”操作。
  • Reject,如果选择了“拒绝”操作。
  • DeleteMessage,如果选择了“删除邮件”操作。

创建的规则:

scanSettings.avScanSettings.errorAction[][Skip]

scanSettings.avScanSettings.backupError[][true]

scanSettings.avScanSettings.errorMark[]
[%5BERROR%5D]

修改的规则:

scanSettings.avScanSettings.errorAction[Skip]
[DeleteAttachment]

scanSettings.avScanSettings.backupError[true][
false]

scanSettings.avScanSettings.errorMark[%5BERROR%5D]
[%5BAV ERROR%5D]

删除的规则:

scanSettings.avScanSettings.errorAction
[DeleteAttachment][]

scanSettings.avScanSettings.backupError

[false][]

scanSettings.avScanSettings.errorMark
[%5BAV ERROR%5D][]

将原始邮件放入备份

scanSettings.avScanSettings.
backupError

可能的值:

  • true,如果切换开关为
  • false,如果切换开关为

要添加到邮件主题的文本

scanSettings.avScanSettings.
errorMark

审核事件记录中“反病毒 → 加密对象”部分的设置代码

“反病毒 模块→加密对象”的设置

审核事件记录中的代码

示例

操作

scanSettings.avScanSettings.
encryptedAction

可能的值:

  • Skip,如果选择了“跳过”操作。
  • DeleteAttachment,如果选择了“删除附件”操作。
  • Reject,如果选择了“拒绝”操作。
  • DeleteMessage,如果选择了“删除邮件”操作。

创建的规则:

scanSettings.avScanSettings.encryptedAction
[][Skip]

scanSettings.avScanSettings.backupEncrypted
[][true]

scanSettings.avScanSettings.encryptedMark[]
[%5BEncrypted%5D]

修改的规则:

scanSettings.avScanSettings.encryptedAction
[Skip][DeleteAttachment]

scanSettings.avScanSettings.backupEncrypted
[true][false]

scanSettings.avScanSettings.encryptedMark
[%5BEncrypted%5D][%5BAV Encrypted%5D]

删除的规则:

scanSettings.avScanSettings.encryptedAction
[DeleteAttachment]
[]

scanSettings.avScanSettings.backupEncrypted
[false][]

scanSettings.avScanSettings.encryptedMark
[%5BAV Encrypted%5D][]

将原始邮件放入备份

scanSettings.avScanSettings.
backupEncrypted

可能的值:

  • true,如果切换开关为
  • false,如果切换开关为

要添加到邮件主题的文本

scanSettings.avScanSettings.
encryptedMark

审核事件记录中“反病毒 → 宏”部分的设置代码

“反病毒 模块→宏”的设置

审核事件记录中的代码

示例

处理包含宏的附件

scanSettings.avScanSettings.
engineSettings.detectDocWithMacro

可能的值:

  • true,如果切换开关为
  • false,如果切换开关为

创建的规则:

scanSettings.avScanSettings.engineSettings.
detectDocWithMacro
[][false]

scanSettings.avScanSettings.docWithMacroAction
[][Skip]

scanSettings.avScanSettings.backupDocWithMacro
[][true]

scanSettings.avScanSettings.docWithMacroMark
[][%5BMacro%5D]

修改的规则:

scanSettings.avScanSettings.engineSettings.
detectDocWithMacro[false][true]

scanSettings.avScanSettings.docWithMacroAction
[Skip][DeleteAttachment]

scanSettings.avScanSettings.backupDocWithMacro
[true][false]

scanSettings.avScanSettings.docWithMacroMark
[%5BMacro%5D]%5BDocument with macro%5D]

删除的规则:

scanSettings.avScanSettings.engineSettings.
detectDocWithMacro
[true][]

scanSettings.avScanSettings.docWithMacroAction
[DeleteAttachment][]

scanSettings.avScanSettings.backupDocWithMacro
[false][]

scanSettings.avScanSettings.docWithMacroMark
[%5BDocument with macro%5D][]

操作

scanSettings.avScanSettings.
docWithMacroAction

可能的值:

  • Skip,如果选择了“跳过”操作。
  • DeleteAttachment,如果选择了“删除附件”操作。
  • Reject,如果选择了“拒绝”操作。
  • DeleteMessage,如果选择了“删除邮件”操作。

将原始邮件放入备份

scanSettings.avScanSettings.
backupDocWithMacro

可能的值:

  • true,如果切换开关为
  • false,如果切换开关为

要添加到邮件主题的文本

scanSettings.avScanSettings.
docWithMacroMark

审核事件记录中“反病毒 → 排除项”部分的设置代码

“反病毒 模块→排除项”的设置

审核事件记录中的代码

示例

不扫描压缩文件

scanSettings.avScanSettings.engineSettings.
scanArchived

可能的值:

  • true,如果切换开关为
  • false,如果切换开关为

创建的规则:

scanSettings.avScanSettings.engineSettings.
scanArchived[][true]

scanSettings.avScanSettings.engineSettings.
excludedNames.Added[%2Adoc, %2Apdf]

修改的规则:

scanSettings.avScanSettings.engineSettings.
scanArchived[true][false]

scanSettings.avScanSettings.engineSettings.
excludedNames.Added[%2Axls]

scanSettings.avScanSettings.engineSettings.
excludedNames.Removed[%2Adoc]

删除的规则:

scanSettings.avScanSettings.engineSettings.
scanArchived[false][]

scanSettings.avScanSettings.engineSettings.
excludedNames.Removed[%2Axls %2Apdf]

不扫描以下名称掩码的附件

scanSettings.avScanSettings.engineSettings.
excludedNames

您觉得这篇文章有帮助吗?
我们可以做什么更好?
感谢您的反馈!你正在帮助我们进步。
感谢您的反馈!你正在帮助我们进步。