ClamAV
Free · OSSHost & Endpoint
Open-source antivirus — catches the boring, signature-known stuff.
ClamAV homepage ↗Free, open-source antivirus. Scans downloaded files, email attachments, and mounted storage against a continuously-updated signature database. Not magic, but it catches the boring stuff so you don't have to.
Production-shippable, newer or thinner field coverage. Watch the changelog before pinning compliance claims.
What it watches
- Malware signature matches on scanned files
- On-access scan hits (downloads, attachments, uploads)
- Scheduled-scan detections across mounted storage
- Signature-database update + scan-error events
MITRE ATT&CK coverage
Tactics this connector gives CyberCLI visibility into.
Every alert this connector surfaces
13 event types
Every matrix-covered event_type on the passthrough lane — pinned by the engine's coverage matrix.
The right column shows the operator-friendly phrase the dashboard renders. High-severity
AI-lane signals are summarized in What it watches above (Warden + Herald
handle those); the rest take the substrate's passthrough lane (no AI tokens burned).
| event_type | dashboard renders |
|---|---|
| clamav_virus_found | Malware found on clamav |
| clamav_scan_summary_clean | AV scan clean on clamav |
| clamav_scan_summary_infected | AV scan found malware on clamav |
| clamav_scan_summary | AV scan summary on clamav |
| clamav_scan_started | AV scan started on clamav |
| clamav_scan_error | AV scan error on clamav |
| clamav_db_reloaded | AV database reloaded on clamav |
| clamav_signatures_updated | AV signatures updated on clamav |
| clamav_update_started | AV update started on clamav |
| clamav_update_warning | AV update warning on clamav |
| clamav_update_failed | AV update failed on clamav |
| clamav_malformed | Malformed ClamAV log on clamav |
| clamav_other | AV activity on clamav |
What it helps you catch
What you'd see in CyberCLI
illustrativeCatches commodity malware + known-bad attachments before a user opens them.
Routed to Warden (triage) → Knight (detection)
⛓ every step hash-chained · replayable
What CyberCLI reads from ClamAV
audit our mathClamAV tails daemon and freshclam textlogs, emitting one event per scan verdict, signature update, or error. The 14 fields we read carry the file that hit, the signature that fired, the infected count, and which database rolled to which version, plus event_type rule_level and action. Clean OKs abort at the VRL edge so fs-wide scans cannot saturate ingest. FOUND lines, errors, and update failures are what reaches CYCON.
Full field index · 14 fields ↓
.action.clamav_database.clamav_database_version.clamav_infected_count.clamav_signature.cybercli_class.cybercli_low_signal.cybercli_parse_status.cybercli_raw_line.cybercli_wire_format.event_id.event_type.file_path.rule_level MITRE techniques typically mapped
- T1059 ↗
Command and Scripting InterpreterExecution
- T1204.002 ↗
User Execution: Malicious FileExecution
- T1547 ↗
Boot or Logon Autostart ExecutionPersistence
- T1027 ↗
Obfuscated Files or InformationDefense Evasion
- T1562.001 ↗
Impair Defenses: Disable or Modify ToolsDefense Evasion
- T1486 ↗
Data Encrypted for ImpactImpact
Trust Ladder ceiling · L0 → L3
- ·L0–L2: digest the FOUND verdict, notify Herald, summarize the infected file plus signature plus host for the case
- ·L3 (Knight verification): hash lookup on file_path, reputation check on clamav_signature, cross-reference with concurrent process and auth events
- ·L4+: file quarantine, host isolation, account disable — ClamAV is detection-only; containment routes through Wazuh/EDR or the host firewall connector
- ·Update-failure remediation stays operator-owned — touches the host package and cron surface
Full ladder semantics · /trust →
Field count + sample event auto-derived from src/cybercli/connectors/clamav/vector.vrl at build time. Numbers update the moment the engine's parser changes — no drift.
Close more of the kill chain
ClamAV covers 3 of 14 ATT&CK tactics. Pair it with these to widen coverage:
How to connect
- 1 Install clamav + clamav-daemon and run freshclam for signatures.
- 2 Enable on-access or scheduled scanning + logging.
- 3 Run `cybercli onboard clamav`.
- 4 Confirm detections in the dashboard's Connectors panel.
sudo apt install clamav clamav-daemon && sudo freshclam
Fully local. ClamAV scans on your hardware; only detections become signals.