Managing malicious attachments

Malware scanning is a security feature that scans all file attachments to tickets and blocks any that are flagged as potentially malicious. When an attachment is flagged as malware, agents are prevented from downloading the file unless an admin overrides the malware identification.

This article includes the following topics:

• About malware scanning
• Reviewing potential malware attachments

About malware scanning

Zendesk scans attachments to tickets in Support and Zendesk Suite after they are uploaded. File attachments added to tickets in the help center Customer Portal are also scanned. When malware is suspected, agents are unable to access the attachment and end users won't even see the attachment. Attachments to tickets that are received via the following channels are scanned:

• Email
• Help center Submit a request form
• Attachments API
• Support Mobile SDK ticket form
• Web Widget Classic ticket form
• Agent workspace
  • Web Widget for Messaging
  • Messaging
  • Zendesk Mobile SDK for Messaging
  • All files attached by agents via the Agent Workspace, regardless of the channel of communication with end users

Whether agents see a notification about a blocked attachment and whether admins can override the malware designation depends on the Zendesk product, the agent interface in use, and the channel from which the attachment originated. Specifically, warning labels are only displayed on potentially malicious attachments if email attachments are enabled for the account and agents are working in Support on desktop.

Linked attachments are scanned, but warning labels aren't displayed. Instead, agents just won't be able to open the link.

Attachments to tickets originating from Messaging, stand-alone Chat subscriptions, and social messaging channels aren't scanned.

Reviewing potential malware attachments

Malicious attachments to tickets and conversations in Support and Zendesk Suite are inaccessible to agents, but admins have the option to download the flagged attachments and decide whether to allow agents to access them or keep them restricted.

To view a potential malware attachment

• In a ticket, click the download icon () on the potentially malicious attachment and then click Proceed in the confirmation dialog to download the attachment.

To permit agents to access a flagged attachment

• After reviewing the potentially malicious attachment, under the attachment in the ticket click Allow access.

To restrict agent access to a flagged attachment

• If you want to re-enable agent restrictions to a potentially malicious attachment, under the attachment in the ticket click Restrict access.