Verify file scan verdict in Content Analysis (CAS)

Products

• ISG Content Analysis
• CAS-VA
• Content Analysis Software
• ISG Proxy
• ProxySG Software - SGOS

Issue/Introduction

Use Content Analysis (CAS) management interface and Edge SWG (ProxySG) access logs to verify whether a file scan resulted in a block or permit verdict. These steps help administrators investigate alerts and confirm file disposition.

Resolution

Verify the file scan and ICAP response using the following methods:

1. CAS Management GUI

• Navigate to Statistics > Historical Connection. Review the log entries to confirm if the file was scanned.
• Navigate to Statistics > Recent Threats. Review report details for any file flagged as malicious.
• Review processed files via the cas-connection log: Go to Utilities > System Logs > cas-connection.

Example from CAS management GUI >  Statistics >  Historical Connection: 

Example from CAS management GUI >  Statistics >  Recent Threats: 

 

2. Edge SWG (ProxySG) Access Logs For definitive confirmation from the end-client standpoint, configure access logs to include ICAP-specific fields:

• Add the following fields to the access log format:
  • cs-icap-status (REQMOD status)
  • rs-icap-status (RESPMOD status)
  • x-icap-respmod-header(X-Apparent-Data-Types)
• Monitor these logs to observe the downloaded file type and the ICAP response.

Additional Information

 

• Edge SWG (ProxySG) Access Log Fields
• Request and Response status
• If the issue persists or log analysis is inconclusive, contact support for further investigation. See Contact Broadcom support.