ICAP

ICAP (Internet Content Adaptation Protocol) is a protocol that web proxies can use to modify an HTTP request or response before passing it to the server/user. The MetaDefender NDR ICAP integration is available to MetaDefender NDR Managers only. The ICAP URLs to be passed to the proxy are:

Where <manager-ip> is replaced with the IP address of your MetaDefender NDR Manager Device. The "Reqmod" URL is for HTTP request modification and the "Respmod" URL is for HTTP response modification.

The ICAP integration will scan files within an HTTP request or response body as if it were regular network traffic. Any content which reaches the minimum threat score threshold (Default of 6) will be considered malicious and will be blocked. Blocked content will be replaced with an MetaDefender NDR block page.

Content scanned using the ICAP integration has a configurable timeout setting (Default of 60 seconds). In the event that the file scanning takes longer than the timeout setting, the request or response will be allowed through, but the threat score will continue to be calculated. The next time the same file is seen, it will be blocked if its threat score meets the minimum threat score setting. A number of other ICAP specific settings are also configurable from the Devices page.