Realtime scanning does not pick the EICAR test file when it is located inside .zip container and it skips other compressed files.
SEP Linux agent 14.3 RU5 or newer.
Starting with SEP 14.3 RU5 (14.3.3075.5000), SEP Linux agent will no longer scan compressed files with Realtime scanning. This behavior is by design. Other scans continue to scan inside compressed files unless configured otherwise.