Managing malicious attachments

Malware scanning is a security feature that scans all file attachments to tickets and blocks any that are flagged as potentially malicious. When an attachment is flagged as malware, agents are prevented from downloading the file unless an admin overrides the malware identification.

This article includes the following topics:

• About malware scanning
• Reviewing potential malware attachments

About malware scanning

Zendesk scans attachments to tickets in Support and Zendesk Suite after they are uploaded. When malware is suspected, agents are unable to access the attachment and end users won't see the attachment.

Attachments to tickets received from the following channels are scanned:

• Email
• Help center Submit a request form
• Attachments API
• Support Mobile SDK ticket form
• Classic Web Widget ticket form

Attachments to tickets originating from stand-alone Chat subscriptions and social messaging channels aren't scanned. However, files attached by agents in the Agent Workspace to tickets originating from the following channels are scanned:

• Web Widget for Messaging
• Messaging
• Zendesk Mobile SDK for Messaging

Whether agents see a notification about a blocked attachment and whether admins can override the malware designation depends on the Zendesk product, the agent interface in use, and the channel from which the attachment originated. Specifically, warning labels are only displayed on potentially malicious attachments if email attachments are enabled for the account and agents are working in Support on desktop.

Though linked attachments are scanned, warning labels aren't displayed. Instead, agents just won't be able to open the link.

If malware is detected in attachments to tickets created with the Submit a request link in the help center, the attachments are hidden from end users.

Reviewing potential malware attachments

Malicious attachments to tickets and conversations in Support and Zendesk Suite are inaccessible to agents, but admins have the option to download the flagged attachments and decide whether to allow agents to access them or keep them restricted.

To view a potential malware attachment

• In a ticket, click the download icon () on the potentially malicious attachment and then click Proceed in the confirmation dialog to download the attachment.

To permit agents to access a flagged attachment

• After reviewing the potentially malicious attachment, under the attachment in the ticket click Allow access.

To restrict agent access to a flagged attachment

• If you want to re-enable agent restrictions to a potentially malicious attachment, under the attachment in the ticket click Restrict access.