Chapter 3. Additional malware service concepts The following additional information might be useful in using malware detection service. 3.1. System scan At release, Malware detection administrators must initiate the Insights for Red Hat Enterprise Linux malware detection service collector scan on demand. Alternatively, administrators can run the collector command as a playbook or by using another automation method. Note The recommended frequency of scanning is up to your security team; however, because the scan can take significant time to run, the Insights for Red Hat Enterprise Linux malware detection service team recommends running the malware detection scan weekly. 3.1.1. Initiating a malware detection scan Perform the following procedure to run a malware detection scan. After the scan is complete, data are reported in the Insights for Red Hat Enterprise Linux malware detection service. The scan time depends on a number of factors, including configuration options, number of running processes, etc. Prerequisites Running the Insights client command requires sudo access on the system. Procedure Run USD sudo insights-client --collector malware-detection . View results at Security > Malware . Note You can configure a cron job to run malware detection scans at scheduled intervals. For more information, refer to Setting up recurring scans for Insights services. 3.1.2. Setting up recurring scans for Insights services To get the most accurate recommendations from Red Hat Insights services such as compliance and malware detection, you might need to manually scan and upload data collection reports to the services on a regular schedule. For more information about scheduling see the following: Setting up recurring scans for Insights services 3.2. Disabling malware signatures There might be certain malware signatures that are not of interest to you. This might be due to an intentional configuration, test scan, or a high-noise situation wherein the malware detection service reports matches that are not applicable to your security priorities. For example, the signatures XFTI_EICAR_AV_Test and XFTI_WICAR_Javascript_Test are used to detect the EICAR Anti Malware Testfile and WICAR Javascript Crypto Miner test malware. They are intentional test signatures but do not represent actual malware threats. Signatures such as these can be disabled so that matches against them are not reported in the Red Hat Hybrid Cloud Console. Once a signature is disabled, the malware detection service removes any existing matches against that signature from the Hybrid Cloud Console and ignores the signature in future scans. If the signature is re-enabled, the malware detection service again looks for the signature in future malware-detection scans and shows resulting matches. Note Disabling a signature does not erase the history of matches for that signature. Prerequisites You are a member of a Hybrid Cloud Console User Access group with the Malware detection administrator role. Only users with this role can disable and re-enable signatures. Procedure to disable a signature Navigate to Security > Malware > Signatures . Find the signature to disable. Click the options icon (...) at the end of the signature row and select Disable signature from malware analysis . Alternate procedure to disable a signature You can also disable the signature from the signature information page. Navigate to Security > Malware > Signatures . Find the signature to disable. Click the signature name. On the signature details page, click the Actions dropdown and select Disable signature from malware analysis . Disabling several signatures at the same time You can disable several signatures at the same time by checking the box at the start of each signature row, then clicking the options icon (...) to the filter fields and selecting Disable signatures from malware analysis . Viewing disabled malware signatures All users can view disabled malware signatures. Navigate to Security > Malware > Signatures . View the number of disabled malware signatures in the dashboard at the top of the page. Set filters to show the disabled signatures. Set the primary filter to Signatures included in malware analysis . Set the secondary filter to Disabled signatures . Re-enabling malware signatures Follow the same procedures as before to re-enable previously disabled signatures. 3.3. Interpreting malware detection service results In most cases, running a malware detection scan with YARA results in no signature matches. This means that YARA did not find any matching strings or boolean expressions when comparing a known set of malware signatures to the files included in the scan. The malware detection service will send these results to Red Hat Insights. You can see the details of the system scan and lack of matches in the Insights for Red Hat Enterprise Linux malware detection service UI. In the case that the malware detection scan with YARA does detect a match, it sends the results of that match to Red Hat Insights. You can see details of the match in the malware detection service UI, including the file and date. System scan and signature match history is displayed for the last 14 days, so you can detect patterns and provide information to your security incident response team. For example, if a signature match was found in one scan, but not found in the scan of the same system, that can indicate the presence of malware that is detectable only when a certain process is running. 3.3.1. Acknowledging and managing malware matches You can acknowledge malware signatures at both the system and signature levels. This allows you to remove irrelevant messages and information from your environment and efficiently review the status of malware results. The Status field on the Signatures page allows you to select a status for each system or signature that you review. You can change the status of each signature match as you continue investigating and managing malware matches. This helps your system users to stay informed about the progress of remediations or evaluations of malware matches. You can also decide which matches are irrelevant or which pose low or no threats to your systems. If you have Malware Detection Administrator permissions, you can delete irrelevant matches from your systems. The Total Matches column on the Signatures page includes all matches for a signature on a system. You can use the list of matches to track and review the history of malware matches on individual systems in your environment. Insights retains malware matches indefinitely, unless you delete them. Acknowledging malware matches and setting status also works as a form of historical record-keeping. Note that if you delete a system from the malware service, the match records are discarded. The New Matches column shows the number of new matches for a signature. A bell icon indicates each new match. A new match has a match date of up to 30 days from when the match was detected, and has a Not Reviewed status. Matches older than 30 days, or those that have already been reviewed, become part of Total Matches . 3.3.2. Acknowledging malware signature matches Prerequisites To view and filter malware matches, you need a Malware Read-only role. To edit or delete matches, you must have the Malware Detection Administrator role. Procedure Navigate to Security > Malware > Signatures . The list of signatures appears at the bottom of the page. Click on a signature name. The information page for that signature displays. The page shows the list of systems affected by that malware signature. A bell icon indicates new matches for that signature. Use the filters at the top of the list of affected systems to filter by Status . (The default filter is Name .) Click the drop-down menu to the right of the Status filter and select Not Reviewed . Click the drop-down arrow to the name of an affected system. The list of matches displays, with the most recent matches first. Select the checkbox to the match that you want to review. To change the status of a match, select the new status from the Match status drop-down menu. Select from the following options: Not reviewed In review On-hold Benign Malware detection test No action Resolved Optional . Add a note in the Note field to include more information about the match status. The green checkmark indicates that the note has been saved. Additional resources For more information about disabling malware signatures, see Disabling malware signatures . For more information about the User Access settings required to view, edit, and delete matches, see User Access settings in the Red Hat Hybrid Cloud Console . 3.3.3. Deleting a single match Prerequisites To edit or delete matches, you must have the Malware Administrator role. Procedure Navigate to Security > Malware > Signatures . The list of signatures appears at the bottom of the page. Click the drop-down arrow to the signature you want to manage. A list of matches appears below the system, with the most recent match first. Click the options icon (...) at the far right side of the match you want to delete, and then select Delete match . The list of matches refreshes. 3.3.4. Viewing malware matches on systems Prerequisites To view and filter malware matches, you need a Malware Read-only role. To edit or delete matches, you must have the Malware Administrator status. Procedure Only systems that have malware detection enabled appear in the list of affected systems. For more information about how to enable malware detection, see Get started using the Insights for RHEL malware service . Navigate to Security > Malware > Systems . The list of systems displays. If a system has malware matches, the Matched label appears to the system name. Click on a system name. The system details page displays, with the list of matched malware signatures at the bottom. Click the drop-down to a malware signature. The list of matches for the signature on the system displays. Acknowledge the matches in the list. For more information, see Additional malware service concepts . 3.4. Additional configuration options for the malware detection collector The /etc/insights-client/malware-detection-config.yml file includes several configuration options. Configuration options filesystem_scan_only This is essentially an allowlist option whereby you specify which files/directories to scan. ONLY the items specified will be scanned. It can be a single item, or a list of items (adhering to yaml syntax for specifying lists of items). If this option is empty, it essentially means scan all files/directories (depending on other options). filesystem_scan_exclude This is essentially a denylist option whereby you specify which files/directories NOT to scan. A number of directories are already listed meaning they will be excluded by default. These include virtual filesystem directories, eg /proc, /sys, /cgroup; directories that might have external mounted filesystems, eg /mnt and /media; and some other directories recommended to not be scanned, eg /dev and /var/log/insights-client (to prevent false positives). You are free to modify the list to add (or subtract) files/directories. Note that if the same item is specified both in filesystem_scan_only and filesystem_scan_exclude, eg /home, then filesystem_scan_exclude will 'win'. That is, /home will not be scanned. Another example, it's possible to filesysem_scan_only a parent directory, eg /var and then filesystem_scan_exclude certain directories within that, eg /var/lib and /var/log/insights-client. Then everything in /var except for /var/lib and /var/log/insights-client will be scanned. filesystem_scan_since Only scan files that have been modified 'since', where since can be an integer representing days ago or 'last' meaning since last filesystem scan. For example, filesystem_scan_since: 1 means only scan files that have been created or modified since 1 day ago (within the last day); filesystem_scan_since: 7 means only scan files that have been created/modified since 7 days ago (within the last week); and filesystem_scan_since: last means only scan files that have been created/modified since the last successful filesystem_scan of the malware-client. exclude_network_filesystem_mountpoints and network_filesystem_types Setting exclude_network_filesystem_mountpoints: true means that the malware detection collector will not scan mountpoints of mounted network filesystems. This is the default setting and is to prevent scanning external filesystems, resulting in unnecessary and increased network traffic and slower scanning. The filesystems it considers to be network filesystems are listed in the network_filesystem_types option. So any filesystem types that are in that list and that are mounted will be excluded from scanning. These mountpoints are essentially added to the list of excluded directories from the filesystem_scan_exclude option. If you set exclude_network_filesystem_mountpoints: false you can still exclude mountpoints with the filesystem_scan_exclude option. network_filesystem_types Define network filesystem types. scan_processes Note Scan_process is disabled by default to prevent an impact on system performance when scanning numerous or large processes. When the status is false, no processes are scanned and the processes_scan options that follow are ignored. + Include running processes in the scan. processes_scan_only This is similar to filesystem_scan_only but applies to processes. Processes may be specified as a single PID, eg 123, or a range of PIDs, eg 1000..2000, or by process name, eg Chrome. For example, the following values: 123, 1000..2000, and Chrome, would mean that PID 123, PIDs from 1000 to 2000 inclusive and PIDs for process names containing the string 'chrome' would ONLY be scanned. processes_scan_exclude This is similar to filesystem_scan_exclude but applies to processes. Like processes_scan_only, processes may be specified as a single PID, a range of PIDs, or by process name. If a process appears in both processes_scan_only and processes_scan_exclude, then processes_scan_exclude will 'win' and the process will be excluded. processes_scan_since This is similar to filesystem_scan_since but applies to processes. Only scan processes that have been started 'since', where since can be an integer representing days ago or 'last' meaning since the last successful processes scan of the malware-client. Environment variables All of the options in the /etc/insights-client/malware-detection-config.yml file can also be set using environment variables. Using the environment variable overrides the value of the same option in the configuration file. The environment variable has the same name as the configuration file option, but is uppercase. For example, the configuration file option test_scan is the environment variable TEST_SCAN . For the FILESYSTEM_SCAN_ONLY , FILESYSTEM_SCAN_EXCLUDE , PROCESSES_SCAN_ONLY , PROCESSES_SCAN_EXCLUDE , and NETWORK_FILESYSTEM_TYPES environment variables, use a list of comma separated values. For example, to scan only directories /etc , /tmp and /var/lib , use the following environment variable: To specify this on the command line (along with disabling test scan), use the following: Resources For more information about the Insights client, see Client Configuration Guide for Red Hat Insights with FedRAMP . 3.5. Enabling notifications and integrations for malware events You can enable the notifications service on Red Hat Hybrid Cloud Console to send notifications whenever the malware service detects a signature match on at least one system scan and generates an alert. Using the notifications service frees you from having to continually check the Red Hat Insights for Red Hat Enterprise Linux dashboard for alerts. For example, you can configure the notifications service to automatically send an email message whenever the malware service detects a possible threat to your systems, or to send an email digest of all the alerts that the malware service generates each day. In addition to sending email messages, you can configure the notifications service to send event data in other ways: Using an authenticated client to query Red Hat Insights APIs for event data Using webhooks to send events to third-party applications that accept inbound requests Integrating notifications with applications such as Splunk to route malware events to the application dashboard Malware service notifications include the following information: name of the affected system how many signature matches were found during the system scan a link to view the details on Red Hat Hybrid Cloud Console Enabling the notifications service requires three main steps: First, an Organization administrator creates a User access group with the Notifications administrator role, and then adds account members to the group. , a Notifications administrator sets up behavior groups for events in the notifications service. Behavior groups specify the delivery method for each notification. For example, a behavior group can specify whether email notifications are sent to all users, or just to Organization administrators. Finally, users who receive email notifications from events must set their user preferences so that they receive individual emails for each event. Additional resources For more information about how to set up notifications for malware alerts, see Configuring notifications on the Red Hat Hybrid Cloud Console with FedRAMP .

Commands:
FILESYSTEM_SCAN_ONLY=/etc,/tmp,/var/lib
sudo FILESYSTEM_SCAN_ONLY=/etc,/tmp,/var/lib TEST_SCAN=false insights-client --collector malware-detection