Check Point R80.20 - Page 72

ICAP Client
Next Generation Security Gateway Guide R80.20 | 72
HTTP Response X-Header
Description
Examples
X-Infection-Found
Contains the description of the
threat that was found in the
ICAP message body of the
request.
If multiple threats were found,
only the first one is returned.
This header is present only if
the content was scanned, and
some violations were found.
The value is a
semicolon-separated
parameter list with exactly
three parameters in a given
order:
TypeID:
0: Virus infection.
1: Mail policy violation (for
example, illegal file
attachment name).
2: Container violation (for
example, a ZIP file that
takes too lon to
decompress).
ResolutionID:
0: File was not repaired.
1: The returned file in the
RESPMOD response is the
repaired version of the
infected file that was
encapsulated in the
request.
2: The original file should
be blocked or rejected due
to container or mail policy
violations.
ThreadDescription:
Human readable
description of the threat.
For example, the virus
name or the policy violation
description. It may contain
spaces and should not be
quoted. It must not contain
semicolons, because it is
terminated by the final
semicolon of the header
definition.
X-Infection-Found: Type=0;
Resolution=1; Threat=EICAR
Test String;
Explanation: The ICAP request
contained data that is infected by the
EICAR test string. The file was
repaired (for example, the
eicar.com file was removed from
an archive and the remaining archive
is sent back in the response).