Some of servers are getting flagged with failing this policy: https://fleetdm.com/queries/antivirus-healthy-linux and I'm wondering if there's any background to why ClamAV specifically is tested for. Reading https://en.wikipedia.org/wiki/Clam_AntiVirus#Effectiveness it seems a broader query could be beneficial. @Guillaume?

Hi @Shawn Maddock! This is one of those queries that is primarily set up as an example/template and you can certainly tweak it to better reflect your environment.

Ohhh

The reason I'd picked Clamd back then was because that was the most common open source AV for Linux that I could find 🙂

This all makes sense. I was thinking maybe ClamAV ticked some standards compliance box that the others didn't for some reason.

I was thinking maybe ClamAV ticked some standards compliance box that the others didn't for some reason.

Mostly the reason Clam is used is because it is free and easy to setup, so most auditors are likely more familiar with it.

I was looking for the daemon version specifically cause in most cases, some kind of "always-on" protection is expected