20. ICAP Integration

The ICAP module in the Data Gateway application integrates Clam AV virus scanning for files uploaded via: 
  • SFTP, FTP, FTPS for P2H Scenarios
  • Internal uploads through File Operator Upload and File Manager Upload
Key Features:
  • Chunk-wise scanning for optimized performance 
  • Full and preview scan modes based on file size 
  • Logs all scan events in both standard and secure logs 
  • Error display supported for FTP/FTPS and UI uploads; SFTP errors are logged only 
  • Dual-token validation system supports both internal users and external OAuth/ICAP users 
The module ensures that all files entering the Data Gateway are scanned for viruses, preventing malicious uploads from entering internal systems. 

20.1 Configuration 

The ICAP module is configured in the Data Gateway application.yml.  Example:  clamav: scan-enabled: true host: 192.168.0.53 port: 3310 read-timeout: 90000 connection-timeout: 9000 preview-scan: 1024576  Parameter Descriptions
Parameter Description
scan-enabled Enables or disables file scanning. Set false to disable scanning.
host IP address of the ClamAV server.
port Port for ClamAV connection (default: 3310).
read-timeout Maximum wait time for a scan response (milliseconds).
connection-timeout Maximum connection time to ClamAV server (milliseconds).
preview-scan Maximum file size for full scan (in bytes). Files larger than this use preview scan.
Scan Behavior
  • Full Scan: For files ≤ preview-scan size 
  • Preview Scan: For files > preview-scan size 
  • Chunk-wise Scanning: Large files are scanned in smaller chunks for efficiency 

20.2 Endpoint-Level Scan Limit

 

The user can define globally or if needed can provide it at endpoint level.

This functionality will improve scalability, customization, and control over scan behaviour across different endpoints. 

This must be more like optional, if just scan is enabled, it should use

 

20.3 Virus Scan Status Handling 

The ICAP module validates files using the following statuses: 
Status Description
FAILED Upload blocked; logs recorded
PASSED Upload proceeds; logs recorded
Example Logging in Data Gateway: If we enable the Scan and the file contains virus then the following will be the output will get an error like the below. The user can view all the Infected File Alerts in the Infected File Alerts Dashboard along with the Signature of the File Infection

20.4 Supported Upload Methods

Upload Method Error Display Notes
SFTP Server/Proxy logs UI error not displayed due to limitations
FTP WISCP
FTPS WISCP
File Operator Upload Application UI
File Manager Upload Application UI

20.5 Logging

  • Standard Logger: Logs operational information
  • Secure Logger: Logs sensitive information (username, file path) for auditing
All ICAP scan results in the Data Gateway are logged for both internal and external users to maintain security and audit compliance. 
Scroll to Top