2.1.3. Overview of the Gmalcore engine

The Gmalcore detection engine enables:

  • detecting malware by means of a static and heuristic multi-engine analysis of files in real time

  • scanning via 16 anti-virus engines

  • scanning capacity close to 200,000 files per 24 hours

  • obtain the name(s) of the threat and a threat score

  • rapid identification of threats

The 16 anti-virus engines are displayed under the name `engine hash` in the web interface.

Maximum file size

50 MB

Analysis timeout

2 minutes

Type

light

Events generated by Gmalcore are displayed in the `Heuristic` section of the GBox analysis report.

2.1.3.1. Viewing the Gmalcore status

Viewing the current state of the engine is shown in the `Analysers` screen of the Web UI.


2.1.3.2. Gmalcore update

Updates are available for the Gmalcore engine.
These updates can be done manually or scheduled via GUM.

2.1.3.3. Configuring Gmalcore

The Gmalcore configuration shows engine statuses including status, date of last update, etc.
The configuration GUI is described in the `Gmalcore configuration` screen section.
The implementation of the Gmalcore configuration is provided in Procédure to configure the Gmalcore engine.