ICAP stands for internet content adaption protocol is an open standard being adopted to connect devices to enterprise-level virus scan engine . same way with the nutanix files is to enable communication with external servers hosting third-party anti-virus software to scan inbound data (files) in transit via Secure Proxy before sending it to the backend destination server.
ICAP WORKFLOW
The ICAP service runs on each Nutanix Files file server and can interact with more than one ICAP server in parallel to support horizontal scale-out of the antivirus server. The scale-out nature of Files and one-click optimization greatly mitigate any antivirus scanning performance overhead. If the scanning affects Nutanix Files FSVM performance, one-click optimization recommends either increasing the virtual CPU resources or scaling out the FSVMs. This feature also helps both the ICAP server and Files scale out, ensuring fast responses from the customer’s antivirus vendor
WHY Nutanix files integration with AV server is important
Ransomware is a persistent concern that requires multiple security controls and software layers to mitigate integration is important to protect users from malware and viruses,
WHAT all third-party vendor are support with Nutanix files
- Trand Micro
- McAfee
- BitDefender
- Symantec
- sentinelone
HOW to configure integration
- In the Files Console, go to Configuration > Antivirus.
- Connect the ICAP server.
- Click + Connect ICAP Server.A new row appears for new ICAP server details.
- Enter the following information in the corresponding fields:
- IP address or hostname
- Port (the default port number is 1344)
- Description
- To save the configuration, click the check mark icon.For a detected antivirus server, the software tests the validity of the configured server and updates the status to OK.
- Ensure the connection status automatically updates to OK.
- Click Next.
- (https://portal.nutanix.com/page/documents/details?targetId=Files-v4_2:fil-file-server-anti-virus-enable-t.html) for more details