Malware scanning is a security feature that scans all file attachments to tickets and blocks any that are flagged as potentially malicious. When an attachment is flagged as malware, agents are prevented from downloading the file unless an admin overrides the malware identification.
About malware scanning
Zendesk scans attachments to tickets in Support and Zendesk Suite after they are uploaded. When malware is suspected, agents are unable to access the attachment, and end users won't see the attachment.
- Help center Submit a request form
- Attachments API
- Support Mobile SDK ticket form
- Classic Web Widget ticket form
Attachments to tickets originating from stand-alone Chat subscriptions and social messaging channels aren't scanned. However, files attached by agents in the Agent Workspace to tickets originating from the following channels are scanned:
- Web Widget for Messaging
- Zendesk Mobile SDK for Messaging
Whether agents see a notification about a blocked attachment and whether admins can override the malware designation depends on the Zendesk product, the agent interface in use, and the channel from which the attachment originated. Specifically, warning labels are only displayed on potentially malicious attachments if email attachments are enabled for the account and agents are working in Support on the desktop.
Though linked attachments are scanned, warning labels aren't displayed. Instead, agents just won't be able to open the link.
If malware is detected in attachments to tickets created with the Submit a request link in the help center, the attachments are hidden from end users.
Reviewing potential malware attachments
Malicious attachments to tickets and conversations in Support and Zendesk Suite are inaccessible to agents, but admins can download the flagged attachments and decide whether to allow agents to access them or keep them restricted. Consult your company's security policy before downloading or taking action on malicious attachments.
- In a ticket, click the download icon () on the potentially malicious attachment and then click Proceed in the confirmation dialog to download the attachment.
- After reviewing the potentially malicious attachment, under the attachment in the ticket click Allow access.
- If you want to re-enable agent restrictions to a potentially malicious attachment, under the attachment in the ticket click Restrict access.
Can you please provide a malicious test file for our QA related to Zenbox API's. Would like to check the E2E flow via the API's as well as from client side
Sadly we already have this feature activated, and it is already impacting our daily business. We as an email security provider get emails/tickets with possible malicious content attached on a daily basis. We can not have admins work through those tickets every hour. Also, it is out of the question to promote every agent to admin just to be able to handle those kinds of tickets. We need a workaround please.
Is it possible to address this issue via API? We could build ourselves a script automatically releasing affected emails. Or can we build some special role which we can give to our agents without granting them full admin? Please advise.
Update on the Malware Scanning feature. We are making headway to have a general availability to all customers at towards the end of June 2022. This feature will automatically be turned on for our customers. A help center announcement will be made once we have this feature turned on.
This release of Malware scanning will not have an API endpoint. Please continue to use the redaction app. Also in the audit logs, there will be events created when an Admin overrides.
Gaurav Garg Thanks for the comment!
We are slated to release Malware scanning to all in June 2022. There will be an announcement as we get closer to the release date.
Hi Chika Chima, do we need any settings to use this feature?
I tried to check the detection working by using EICAR Anti-Virus Test File, but nothing happened.
Can we pls participate in the limited release program with smcglobal.zendesk.com?
Hi Chika Chima, will we have an API endpoint to restrict agent access to attachments?
Something similar to the Redaction endpoint
Additionally, how are these automatic attachment restrictions described in the ticket events? Will we be able to audit when/how those were interacted with?
Chika Chima Now that this is rolled out to all users, I have the same question as Megumi, I seem to be able to attach the eicar test file in Zendesk just fine, but gmail immediately detects and says it's a virus. Is there a setting we need to turn on? I can't seem to get Zendesk to detect anything as a virus that I try. Does malware scanning not check the agent side of attachments? Do I need to send the eicar file as an end-user?
Edit: I also confirmed that I was able to send virus laden files via chat.
This malware scanning functionality is in the background and will scan tickets automatically. At the moment, there is no way yet to check in the zendesk ticket if it was scanned. However, this can be a good feature. You can submit this as product feedback and be included in the ticket events or in the UI. Thank you!
hey Chika Chima when will malware scanning be available to all users? is there a way we can enable this for our account?
Is there a way to check in the Zendesk ticket if the attachments were scanned?
Hi Pat !
I just replied to your ticket.
Chika Chima Could you explain how we can check to see if this active? I can count four other people asking for this in this thread, and I'm still unable to see it and able to upload malicious files. How can we test this to see if it's actually turned on? How can we report to you when it seems to allow malicious attachments?
The Malware scanning feature has officially completed the automatic rollout July 14, 2022 to all Zendesk customers. Meaning, there is no additional settings or controls that needs to happen on your accounts!
As mentioned in the article, warning designations will show on the ticket UI if the scanners deemed the file attachment malicious. As well which channels the scanning is taking place for this first release.
In regards to testing the feature with purposely sending malicious files, we recommend to reach out to your respective security organizations for such requests.
We will appreciate feedback in this forum and we will announce how to signup for feedback calls about this new feature
Hello! As promised this is a calendly link to sign up to hear more about your feedback on this feature!
Thanks for reaching out!
As referenced on the announcement rollout to all 100% customers will end by July 14th. So therefore, you may not have this feature just yet.
Please sign in to leave a comment.