Chapter 3. Manage the malware detection service

Malware detection administrators run the malware detection collector scan on-demand or through automation such as playbooks. Your security team sets how often to scan; long runs are common, so plan schedules accordingly.

Malware detection administrators must start the Red Hat Lightspeed malware detection service collector scan on-demand. Alternatively, administrators can run the collector command as a playbook or by using another automation method.

Use the Signatures page of the malware detection service to see matched and unmatched IBM X-Force and CrowdStrike signatures for scans on your Red Hat Enterprise Linux systems.

You can use the Signatures page of the malware detection service to see the signatures used to scan your Red Hat Enterprise Linux systems. All matched and unmatched signatures for IBM X-Force appear by default. If you have installed CrowdStrike signatures and completed the prerequisites, you can see all matched and unmatched signatures as well.

Matched signatures indicate the YARA software detected a file on a system that corresponds to a known threat. Unmatched signatures indicate the service is actively monitoring for those threats, but no corresponding files were detected during the most recent scan.

To filter by provider, click the cards with the IBM and CrowdStrike logos at the top of the Signatures page. The IBM card is enabled by default, while the CrowdStrike card is active only if you installed CrowdStrike signatures.

Set up the malware detection collector to scan on a schedule by using cron, systemd timers, or automation. Run insights-client --collector malware-detection on a schedule that matches your security policy.

For more information about scheduling, see the additional resources.

Disable malware signatures that are not relevant to your organization or cause false positives. This helps reduce noise from intentional configurations, test scans, or matches that do not align with your security priorities.

For example, the signatures XFTI_EICAR_AV_Test and XFTI_WICAR_Javascript_Test are used to detect the EICAR Anti Malware test file and WICAR Javascript Crypto Miner test malware. They are intentional test signatures but do not represent actual malware threats. Signatures such as these can be disabled so that matches against them are not reported in the Red Hat Hybrid Cloud Console.

After a signature is disabled, the malware detection service removes any existing matches against that signature from the Hybrid Cloud Console and ignores the signature in future scans. If the signature is re-enabled, the malware detection service again looks for the signature in future malware-detection scans and shows resulting matches.

Users with access to the malware detection signatures view can see how many signatures are disabled and filter the list to show only disabled signatures.

All users who can open the signatures page can view disabled malware signatures.

In most cases, malware detection scans result in no signature matches, meaning YARA found no matching strings or boolean expressions in the scanned files. You can view scan details and match results in the Red Hat Lightspeed malware detection service.

In the case that the malware detection scan with YARA does detect a match, it sends the results of that match to Red Hat Lightspeed. You can see details of the match in the malware detection service UI, including the file and date. System scan and signature match history is displayed for the last 14 days, so you can detect patterns and provide information to your security incident response team. For example, if a signature match was found in one scan, but not found in the next scan of the same system, that can indicate the presence of malware that is detectable only when a certain process is running.

Match status, acknowledgment, and match lists in the console are covered in the topics linked under Additional resources.

You can acknowledge malware signatures at the system and signature levels, set match status, and reduce noise so your team can focus on real risk.

The Status field on the Signatures page enables you to select a status for each system or signature that you review. You can change the status of each signature match while you continue investigating and managing malware matches to help your system users stay informed about the progress of remediations or evaluations of malware matches. You can also decide which matches pose low or no threats to your systems or are irrelevant. If you are a member of a group with at least Malware detection administrator or RHEL administrator permissions, you can delete irrelevant matches from your systems.

The Total Matches column on the Signatures page includes all matches for a signature on a system. You can use the list of matches to track and review the history of malware matches on individual systems in your environment. Red Hat Lightspeed retains malware matches indefinitely unless you delete them. Acknowledging malware matches and setting their status is one method of record-keeping. Note that if you delete a system from the malware service, the match records are discarded.

The New Matches column shows the number of new matches for a signature. A bell icon indicates each new match. A new match has a match date of up to 30 days from when the match was detected and has a Not Reviewed status. Matches older than 30 days, or those that have already been reviewed, become part of Total Matches.

Assign match status values to malware signature matches as you review findings. Your decisions persist with each match, reducing repeat work when you review the same items in the future.

When a match is not relevant to your environment, you can delete it from the list of signatures so that all malware detection administrators and RHEL reviewers see an up-to-date set of open items.

From Security Malware Systems, you can open a system, expand a matched signature, and acknowledge matches so your team’s view stays current.

The malware-detection-config.yml file defines allowlists, denylists, timing, and related scan behavior for the malware detection collector on RHEL systems.

The /etc/insights-client/malware-detection-config.yml file configures the malware detection collector on each host. The file uses YAML keys for scan scope, exclusions, process scanning, and timing. You can set the same keys with environment variables when you run the client; when both are present, environment variables override the file.

The malware detection collector reads /etc/insights-client/malware-detection-config.yml to determine scan settings, exclusions, and process scanning options. Environment variables set before running the collector override the configuration file.

For an example of passing these variables when you run the collector from the command line, see Configure the malware collector with environment variables on the command line.

You can override /etc/insights-client/malware-detection-config.yml settings for a single run by exporting or prefixing environment variables when you run the insights-client collector.

Enable the notifications service to receive alerts when the malware service detects signature matches on your systems. Notifications help you stay informed about possible threats when you cannot continuously monitor the Red Hat Lightspeed dashboard.

In addition to sending email messages, you can configure the notifications service to send event data in other ways:

Notifications will trigger for Red Hat Lightspeed services based on service-specific criteria.

Malware service notifications include the following information:

Enabling the notifications service requires three main steps: