New Add-On: Delete infected files

Deleting infected files as soon as they are detected is the most popular way to mitigate malware threats with bucketAV. So far, this behavior was built into the core of bucketAV and controlled by the DeleteInfectedFiles configuration parameter. With the latest release, deleting infected files moves into an add-on — like the quarantine and move actions — which unlocks capabilities the built-in implementation could not offer.

The new Delete infected files add-on

The Delete infected files Add-On subscribes to bucketAV’s Findings Topic and deletes every file reported as infected. It is available for Amazon S3 and Cloudflare R2. Compared to the built-in delete behavior, the add-on comes with the following improvements:

• Exclude findings: Use the IgnoreFindings configuration parameter to keep files with certain findings — for example, findings for potentially unwanted applications (PUA). The * wildcard matches any sequence of characters (e.g., Win.Test.*,*EICAR*).
• Exclude objects: Use the IgnoreObjectsExpression configuration parameter to keep objects whose keys match a regular expression.
• Limit to specific buckets: Use the SourceBucketNames configuration parameter to delete files from specific source buckets only.

If the infected S3 object is versioned, the add-on deletes the object version, not the object. In other words, no delete marker is added.

Follow the setup instructions to deploy the add-on.

Ignore findings when quarantining files

The IgnoreFindings configuration parameter is also available in the Quarantine infected files Add-On. For example, if you scan with the Sophos engine and do not want to quarantine potentially unwanted applications, exclude those findings from the quarantine action while still receiving them in your reports and notifications.

Deprecation of the DeleteInfectedFiles configuration parameter

With core version v3.5.0, the DeleteInfectedFiles configuration parameter is deprecated:

• Existing installations keep their configured value when updating. If the parameter is set to true, bucketAV continues to delete infected files as before. We recommend migrating: deploy the Delete infected files Add-On first, and set DeleteInfectedFiles to false afterwards.
• New installations no longer delete infected files by default. Deploy the Delete infected files Add-On to delete infected files.

Check out the update guide for details.