Managing malicious attachments

What's my plan?

Malware scanning is a security feature that scans all file attachments to tickets and blocks any that are flagged as potentially malicious. When an attachment is flagged as malware, agents are prevented from downloading the file unless an admin overrides the malware identification.

This article includes the following topics:

• About malware scanning
• Reviewing potential malware attachments

About malware scanning

Zendesk scans attachments to tickets in Support and Zendesk Suite after they are uploaded. When malware is suspected, agents can't access the attachment, and end users won't see the attachment. Attachments are also scanned in the Zendesk Support mobile app on both iOS and Android in the new agent experience.

Attachments to tickets received from the following channels are scanned:

• Email
• Help center Submit a request form
• Attachments API
• Support Mobile SDK ticket form
• Classic Web Widget ticket form

Attachments to tickets originating from stand-alone Chat subscriptions and social messaging channels aren't scanned. However, files attached by agents in the Agent Workspace to tickets originating from the following channels are scanned:

• Web Widget for Messaging
• Messaging
• Zendesk Mobile SDK for Messaging

Whether agents see a notification about a blocked attachment and whether admins can override the malware designation depends on the Zendesk product, the agent interface in use, and the channel from which the attachment originated. Specifically, warning labels are only displayed on potentially malicious attachments if email attachments are enabled for the account and agents are working in Support on the desktop or mobile app.

In Support on the desktop:

In the Support mobile app:

If malware is detected in attachments to tickets created with the Submit a request link in the help center, the attachments are hidden from end users.

Reviewing potential malware attachments

Malicious attachments to tickets and conversations in Support and Zendesk Suite are inaccessible to agents, but admins can download the flagged attachments and decide whether to allow agents to access them or keep them restricted. Consult your company's security policy before downloading or taking action on malicious attachments.

To view a potential malware attachment

• In a ticket, click the download icon () on the potentially malicious attachment and then click Proceed in the confirmation dialog to download the attachment.

To permit agents to access a flagged attachment

• After reviewing the potentially malicious attachment, under the attachment in the ticket click Allow access.

To restrict agent access to a flagged attachment

• If you want to re-enable agent restrictions to a potentially malicious attachment, under the attachment in the ticket click Restrict access.