> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safesquid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Malware Scanning

# Multi-layer malware detection for web traffic

## Problem

Malware reaches endpoints through downloads and web content. Encrypted traffic hides payloads from passive inspection. Organizations need one or more scanning layers on the proxy with a clear integration path for external engines.

## Benefits

SafeSquid offers SqScan (built-in), ClamAV integration, ICAP to third-party scanners, and an Adaptable External Parser for custom logic. Administrators pick layers that match operational maturity and vendor standards. **Confirmed:** HTTPS payloads require [SSL Inspection](/SSL_Inspection) for scanning to apply to encrypted web traffic.

## Advantages

**Confirmed:** Multiple scanner integrations (SqScan, ClamAV, ICAP, external parser) ship in the documented module set; administrators can stack engines rather than rely on a single signature source.

**Draft (CTO confirmation):** Detection rates versus cloud-only SWG sandboxes vary by threat type and update cadence—avoid numeric superiority claims without lab evidence in the source register.

## Call to action

Enable [SSL Inspection](/SSL_Inspection). Configure at least one scanner using the guides below. Validate with known-safe and test-malware samples per organizational policy, then monitor logs and alerts.

## Malware scanner configuration and reference guides

### [SqScan](/SqScan)

Built-in scanning alone may not cover all threat signatures or formats. SqScan is SafeSquid's built-in module for scanning HTTP and HTTPS traffic for viruses, Trojans, and malware. It provides a first layer of protection without external daemons. Configure and use SqScan for HTTP and HTTPS scanning using this document.

### [ClamAV Malware Scanning](/ClamAV_Malware_Scanning)

Enterprises need an extra layer of detection using a widely updated signature engine. ClamAV integration allows SafeSquid to send content to a ClamAV daemon for scanning. Multiple file formats and archives are supported. Integrate a dedicated ClamAV server with SafeSquid using this document.

### [ICAP](/ICAP)

Organizations use third-party ICAP antivirus or content adaptation services for policy. ICAP integration lets SafeSquid send HTTP/HTTPS content to ICAP servers for virus scanning and content modification. Dr. Web, Kaspersky, Symantec, and Trend Micro are examples of ICAP-based solutions. Configure ICAP server connections using this document.

### [Adaptable External Parser](/Adaptable_External_Parser)

Custom or proprietary scanners may require a flexible integration pattern. The Adaptable External Parser allows SafeSquid to invoke external scanning or parsing logic for content. This supports integration with non-ICAP or custom antivirus and DLP tools. Use this document to configure and integrate external parsers.

## Next steps

Enable [SSL Inspection](/SSL_Inspection) so HTTPS traffic is scanned; combine with [Data Leakage Prevention](/Data_Leakage_Prevention) for upload/download inspection.


## Related topics

- [Malware Scanners](/use_cases/malware_scanning/malware_scanners.md)
- [SqScan](/use_cases/malware_scanning/sqscan.md)
- [Policy Enforcement](/getting_started/configure_web_security_policies.md)
- [Threat Intelligence Feeds](/use_cases/malware_scanning/threat_intelligence_feeds.md)
- [Policy Management Console](/safesquid_swg/interface/configuration_portal.md)