Hello,

I was wondering if we could implement Microsoft Endpoint Protection (the server version of Windows Defender) with Xeams rather then using ClamAV.

The idea is to protect the entire server including email flow coming into Xeams.

Is there any specific requirements or any specific setup to allow this? is it a workable solution or do we need to exclude Xeams folders?

I'm under the impression it should work fine as Xeams processes emails as flat files?

Thanks for your help :)

James,

Although we have not done this in our labs, theoretically speaking, you should be able to do this. Check http://www.xeams.com/external-tool.htm for details. I also recommend checking https://social.technet.microsoft.com/Forums/Azure/en-US/992cf5d5-514b-4930-b7ac-55e35470665f/command-line-scan-entire-directory?forum=FCSNext for some tips on how to use its command line version.

Perfect, thank you. 

The question is, does scanning need to be a spawned process?

Can it not be left as default values with Endpoint checking emails as they are written to disk rather then as they are received to spawn?

Thanks, James

Just a bump on the above question.

[Perfect, thank you. 

The question is, does scanning need to be a spawned process?

Can it not be left as default values with Endpoint checking emails as they are written to disk rather then as they are received to spawn?]

Thanks Synametrics.

James,

Yes, it has to spawn a process. It will only spawn if:

1. There is an attachment
2. The attached file is smaller than the bypass threshold.

When a new message arrives, the entire message stays in Xeams memory until it is completely processed. When an attachment is encountered, Xeams will save the attached file to a temp folder, spawn the configured program and capture the results.

There is a very good chance that 90% of the emails do not have anything attached and therefore, no spawning is required.

Perfect, thank you. 

The question is, does scanning need to be a spawned process?

Can it not be left as default values with Endpoint checking emails as they are written to disk rather then as they are received to spawn?

Thanks, James