Malware Detection Section and ClamAV

[Max]

Hi Wazuh Team,

I would like to seek clarification regarding the ClamAV integration and Malware Detection dashboard behavior.

1. ClamAV Alerts Visible in Threat Hunting but Not in Malware Detection

I have been testing the ClamAV integration using the EICAR test signature.

The detections are successfully generated and can be seen in Threat Hunting, as shown below. The events are matched against the rule "ClamAV: Virus detected" (Rule ID: 52502) and contain the expected fields such as:

• predecoder.program_name: clamd
• rule.description: ClamAV: Virus detected
• rule.groups: clamd, freshclam, virus

However, these same events do not appear under the Malware Detection dashboard/module.

Based on the Malware Detection view, the dashboard appears to be filtering on:

rule.groups: rootcheck, virustotal, yara

Since the ClamAV events belong to the groups:

clamd, freshclam, virus

they do not seem to be included in the Malware Detection dashboard results.

My questions are:

1. Is it expected behavior that ClamAV detections are visible in Threat Hunting but not in the Malware Detection dashboard?
2. Is there a supported method to modify or extend the Malware Detection dashboard filters so that ClamAV detections are included?
3. If not, is there another recommended dashboard or visualization specifically intended for ClamAV detections?

2. ClamAV Log Collection Documentation vs RHEL 9/10 Behavior

I am also looking for clarification regarding the log source described in the ClamAV integration documentation:

https://documentation.wazuh.com/current/user-manual/capabilities/malware-detection/clam-av-logs-collection.html

The documentation indicates that ClamAV logs are written to:

/var/log/syslog

However, during testing on RHEL 9 and RHEL 10 systems (both Wazuh component hosts and Wazuh agent endpoints), I observed the following:

• No /var/log/syslog file exists by default.
• ClamAV events are successfully collected from either:
  • journald (RHEL 9/10 agent endpoints)
  • /var/log/messages (Linux hosts running Wazuh components)

Example events show:

Agent endpoint:

location: journald predecoder.program_name: clamd rule.description: ClamAV: Virus detected

Component host:

location: /var/log/messages predecoder.program_name: clamd rule.description: ClamAV: Virus detected

My questions are:

1. Is the documentation referring primarily to Debian/Ubuntu-based systems where /var/log/syslog exists by default?
2. For RHEL 9 and RHEL 10, is collecting ClamAV events from journald or /var/log/messages the recommended and supported configuration?
3. Are there any additional configuration steps required on RHEL 9/10 to ensure full compatibility with the Malware Detection module?

Any clarification would be greatly appreciated.

Thank you.

[Olamilekan Abdullateef Ajani]

Hi Max,

Thanks for the detailed information and screenshots. What you are seeing is expected, and your ClamAV integration itself appears to be working correctly.

- ClamAV alerts in threat hunting but not malware detection

Yes, this is the current behavior of the Malware Detection dashboard.

In the current 4.x dashboard, Malware Detection applies a fixed filter for these rule groups: rootcheck, virustotal, and yara.

ClamAV alerts such as rule 52502 Use the groups: clamd, freshclam, virus.

Because of that, the alert is indexed and available in Threat Hunting, but it is filtered out of the Malware Detection view. There is an existing enhancement request for this behavior.

https://github.com/wazuh/wazuh-dashboard-plugins/issues/7797 although, closed as not planned.

So there does not appear to be a problem with your ClamAV collection or rules. Your screenshots confirm that rule 52502 is being generated as it should.

The built-in malware detection filter is not exposed as a normal dashboard setting. I would recommend using threat hunting with a filter such as: rule.groups: clamd

Or you can create a custom dashboard based on wazuh-alerts-* for your ClamAV events. You can use custom dashboards for this purpose.
https://documentation.wazuh.com/current/user-manual/wazuh-dashboard/creating-custom-dashboards.html

- ClamAV logs on RHEL 9/10

The current ClamAV documentation uses /etc/clamav/clamd.conf and /var/log/syslog, which fits Debian/Ubuntu-style systems better. It also states that the built-in ClamAV decoders only decode logs from /var/log/syslog.

However, the actual ClamAV decoder matches the syslog program_name, such as clamd and freshclam; it does not check whether the event came specifically from /var/log/syslog.

That explains why your RHEL events work correctly from both journald and /var/log/messages.

So if your RHEL 9/10 endpoint is already producing:

predecoder.program_name: clamd
rule.id: 52502
rule.description: ClamAV: Virus detected

then the collection, decoding and rule matching are working correctly. There should not be any additional RHEL-specific configuration required just to make the ClamAV rule work.

The part that is preventing it from appearing under Malware Detection is the dashboard filter described above, not whether the event came from journald, /var/log/messages, or /var/log/syslog.

Please let me know if you require further clarification on this.