---
title: "Set up the antivirus scan"
slug: "set-up-the-antivirus-scan"
abstract: "Enable the antivirus scan feature in Content Hub so that your can use an antivirus package with it."
---
# Set up the antivirus scan

> [!note]
> To configure Content Hub, you must either be a superuser or have the necessary permissions granted to you through [user group policies](https://doc.sitecore.com/ch/en/users/content-hub/user-group-policies.html "User group policies").

Sitecore Content Hub has an antivirus scan feature that activates when users upload assets through the [**Creation** component](https://doc.sitecore.com/ch/en/users/content-hub/creation.html "Creation") or an [Excel import](https://doc.sitecore.com/ch/en/users/content-hub/import-excel-data.html "Import Excel data"). As part of an antivirus package, this feature scans files for viruses and harmful items.

> [!important]
> Our antivirus scan feature is not a standalone tool, but a component of an antivirus package. To use it, you must provision your own antivirus tool and integrate it with the antivirus scan in Content Hub.

When the antivirus feature is enabled and you upload an asset, the uploaded file is assigned a virus scan result value. This value is displayed on the **System** tab of the asset details page and can be any of the following:

- *Ok* - the scan passed or the antivirus is disabled. Files can be downloaded.
- *Unknown* - the antivirus feature is enabled but there is no external task configured. Files can be downloaded.
- *Pending* - the antivirus scan is not yet completed. Depending on how the antivirus scan is configured, the rendition status for the related asset and the `M.File` entity definition might also be marked as *Pending*. Files cannot be downloaded.

    > [!note]
    > If an external processing task is improperly formatted, the request made by the external task is not successful, or the antivirus scan does not return a valid response to Content Hub, the virus scan result and the associated [background processing job](https://doc.sitecore.com/ch/en/users/content-hub/job-state.html "Job state") will remain in the *Pending* state, even if all the other tasks in the job have completed.

- *Malicious* - a virus was detected. Files cannot be downloaded.
- *Error* - the antivirus scan failed. Files cannot be downloaded.

This walkthrough describes how to:

1. Enable the antivirus scan
2. Create a media processing set
3. Set up an external web task
4. Configure the `M.MediaMatrix` entity
5. Complete the antivirus scan
6. Test the malicious file alert trigger

## Enable the antivirus scan

To enable the antivirus scan:

1. On the menu bar, click **Manage** :mdiCogOutline:.
2. On the **Manage** page, click **Settings**.
3. On the **Settings** page, find and click **AntivirusSetting**.
4. In the **AntivirusSetting** section, change the Editor mode to `true` and then set the `antivirusEnabled` flag to `true`.

    ```csharp
    {
      "antivirusEnabled": true,
      "renditionBagsToClear": [
        "Renditions",
        "ExtraRenditions"
      ],
      "renditionsToMarkMalicious": {
        "Renditions": [
          "thumbnail",
          "thumbnail_cropped",
          "preview"
        ],
        "ExtraRenditions": []
      },
      "flowOnly": false
    }
    ```

5. Click **Save**.

## Create a media processing set

To create a media processing set:

1. On the menu bar, click **Manage** :mdiCogOutline:.
2. On the **Manage** page, click **Media processing**.
3. On the **Media processing** page, click **New set**.
4. In the **New set** dialog, enter an appropriate name, for example, *Antivirus*.
5. Optionally, if you want to automatically apply this set to all new assets, turn on the **Auto-run** switch.
6. Click **Create**.

## Set up an external web task

Because the antivirus scan functionality makes a call to an external service API, it requires a **RunExternalWebTask** processing task configured in the *M.MediaMatrix* entity for the related media flow.

> [!note]
> An external web task is a webhook that Content Hub uses in file processing to create predefined conversions known as [renditions](https://doc.sitecore.com/ch/en/users/content-hub/default-renditions.html "Default renditions").

To set up an external web task:

1. On the menu bar, click **Manage** :mdiCogOutline:.
2. On the **Manage** page, click **Media processing**.
3. On the **Media processing** page, click the set you created (for example, *Antivirus*) and then click **Add flow**.
4. In the **Flow settings** dialog, enter a name in the **Name** field, for example, *Antivirus*.
5. If you want the flow to only scan specific types of files, enter those types in the **File types** field, such as *zip*, *7z*, *tar*, or *gz*.
6. Click **Save**.
7. On the media processing set details page, click the new flow.
8. On the details page of the new flow, click the :mdiPlusCircle: sign and, in the right-hand pane, click **Run external web task**.
9. On the **Parameters** tab, fill in the fields as follows:
    - **Name** - enter *Antivirus*.
    - **Content type** - leave blank.
    - **Content disposition** - from the list, click **Attachment**.
    - **URL** - enter a URL that points to the external antivirus scan service of your choice.
10. On the **Outputs** tab, to enable outputs, turn on the **Store output** switch and then fill in the fields as follows:
    - **Output type** - click *Property* in the drop-down list.
    - **Property** - click *Virusscan result* in the drop-down list.
11. Click **Save task**, then **Save** and **Close**.
12. Click **Publish**.

## Configure the M.MediaMatrix entity

Before configuring the `M.MediaMatrix` entity, you must first retrieve the media set ID, which is displayed in the URL.

To retrieve the media set ID:

1. On the menu bar, click **Manage** :mdiCogOutline:.
2. On the **Manage** page, click **Media processing**.
3. On the **Media processing** page, click one of the media sets in the list.
4. Copy the ID that displays at the end of the URL. In the following example, for the **Content** media set, the ID is `1014`.

    ```http
    `https://<HOSTNAME>/en-us/admin/media-processing-mgmt?mediaMatrixManagementSelectedMatrix=1014`
    ```

To configure the `M.MediaMatrix` entity:

1. On the **Manage** page, click **Entities**.
2. To the **Entities** page URL, append **/entity/** followed by the media set ID, and press Enter.

    ```http
    https://<HOSTNAME>/en-us/admin/entitymgmt/entity/1014
    ```

3. On the **Entity detail page**, on the **System** tab, click **Edit** :mdiPencilOutline:.
4. To change the [conversion matrix JSON](https://doc.sitecore.com/ch/en/users/content-hub/conversion-matrix-structure.html "Conversion matrix structure"), in the **Matrix** section, from the drop-down list, click *Text*.
5. To set up antivirus for archives, for example, search for the **Archives** node and make sure that the following JSON code comes first under **tasks**:

    ```json
    "antivirus": {
        "type": "RunExternalWebTask",
        "do update": true,
        "input": "source",
        "output": "antivirus",
        "outputfileprovider": "local",
        "contentdisposition": "attachment",
        "url": "http://beeceptor.com/console/testsitecore-antivirus",
        "parameters": {},
        "headers": {}
      }
    ```

    The same process applies to any other category for which you want to set up antivirus.

6. Add an antivirus dependency in the **metadata** entry of the **Archives** node as follows:

    ```json
    "deps": [
      "antivirus"
    ]
    ```

7. Store the scan output in the antivirus property of the file as follows:

    ```json
    "properties": {
      "VirusScanResult": "antivirus"
    }
    ```

8. Click **Save**.

## Complete the antivirus scan

To be complete, the antivirus scan needs to return a valid response to Content Hub. You can verify if this is the case by sending a **POST** request.

To complete the antivirus scan:

1. Upload an asset. This triggers the external web task, which sends a request with the following format in the body:

    ```csharp
    {
        "callback": "https://callback-url",
        "sources": [ "https://blob-sas-url" ],
        "parameters": {}
    }
    ```

2. Send a **POST** request containing the following request body to the callback URL:

    ```json
    {
        "value": "Malicious"
      }
    ```

The value in the request body can be any of the following:

- `Malicious` - an issue was detected.
- `Ok` - no issues were found.
- `Error` - the antivirus scan failed.

If the **POST** request is successful, the antivirus is working as expected. If Content Hub doesn't receive a response to the **POST** request, the `VirusScanResult` and the associated processing job remain in the *Pending* state.

> [!note]
> When you upload an asset in the Content Hub interface through the [**Creation** component](https://doc.sitecore.com/ch/en/users/content-hub/creation.html "Creation") or through an [Excel import](https://doc.sitecore.com/ch/en/users/content-hub/export-excel-data.html "Export Excel data"), if the file is considered malicious by the chosen antivirus service, the file details page displays a warning that downloads of the file are now disabled. When this happens, the file thumbnail and associated renditions are replaced by placeholders.

## Test the malicious file alert trigger

Using an API call, you can test what happens when a file is flagged as malicious.

To test the malicious file alert trigger:

1. Set the URL to an API endpoint, such as `http://beeceptor.com/console/testsitecore-antivirus`.
2. Upload an asset to trigger the external web task. The request body has the following format:

    ```csharp
    {
        "callback": "https://callback-url",
        "sources": [ "https://blob-sas-url" ],
        "parameters": {}
    }
    ```

3. Copy the callback URL from the endpoint.
4. Send a POST request containing the following code to the callback URL:

    ```json
    {
        "value": "Malicious"
      }
    ```