The "Scan Using ICAP-Enabled Antivirus" assertion is not sending the HTTP request headers to the backend ICAP antivirus server.
Gateway 10.1 CR04
The current design of this assertion ignores the HTTP request headers.
The service parameters in "Scan Using ICAP-Enabled Antivirus" assertion will help to send the HTTP request headers but this will add the header to the ICAP headers and does not include it in the encapsulated HTTP message for the ICAP assertion.
A fix for this issue expected in gateway release after 11 CR02 and/or after 11.1 release.
There is a hotfix available for the 10.1 CR04 release. Please reach out to the support team if you need this hotfix.