Endpoint Security Storage Protection RESPMOD sample

[SamDolan]

Hi,

I was attempting to build a monitoring tool for ENSSP doing a synthetic test passing a file to the ICAP service. I was able to get OPTION response as below but unable to get a response to RESPMOD requests. I'd like to be able to send a clean small text file and an eicar test file occasionally on a heartbeat rather then just do an options check.

OPTIONS icap://<IP Address>:<Port>/AVSCAN ICAP/1.0
Host: <IP Address>
User-Agent: CheckMKPowerShell

Partial ICAP response

ICAP/1.0 200 OK
Date: Fri 19 May 2023 16:43:00 GMT
Methods: RESPMOD
Service: McAfee VirusScan Enterprise for Storage 2.2.0

Is their a sample of the format of output requirement and information needed to pass to the ICAP for RESPMOD request? 

[Pravas]

Hi @SamDolan ,

The sample that we normally use for testing is an EICAR file.

You may also refer to the following logs for scan activity.

C:\ProgramData\McAfee\Endpoint Security\Logs\ICAPScan_Activity.log
C:\ProgramData\McAfee\Endpoint Security\Logs\ICAPStats_Activity.log

Thanks

[SamDolan]

Hey, thanks for response, That was my intention to use EICAR string,  I seem to be having issue with what to send to the scanner though as part of transmission. What I was after is the send critieria, working with the RFC I seem to be missing something and was hoping you had a sample output of what is being sent format wise to the scanner around ICAP header and HTTP header/payload.

To get option response I would send below which works:

OPTIONS icap://<IP Address>:<Port>/AVSCAN ICAP/1.0
Host: <IP Address>
User-Agent: CheckMKPowerShell

To get RESPMOD I would send below but do not seem to get any response and eventually timeout:

RESPMOD icap://<IP Address>:<Port>/AVSCAN ICAP/1.0

Host: <IP Address>

User-Agent<string>

Allow: 204

Encapsulated res-hdr=<calculated size of http header>  res-body=<calculated size of raw file>

HTTP/1.1 200 OK

Content-Type: text/html

Content-Length: <calculated size of raw file>

<raw file content>