Linux: the ClamAV engine, auto-install, and isolation

Protected Linux devices get a managed ClamAV engine — installed for you by default.

1. 1When you protect a Linux device in Active mode, the agent installs ClamAV from your distribution's own repositories (apt or dnf) if it isn't present, and keeps signatures fresh with freshclam.
2. 2Prefer to install it yourself? Turn off 'auto-install engine' on Policies — the device then reports 'engine missing' with the exact command to run.
3. 3On-access scanning uses clamonacc where the kernel supports it; otherwise a scheduled scan runs and results flow into Detections.
4. 4Beyond file malware, Cybermatic adds behavioral monitoring on Linux via auditd — it flags shells spawned by network services, execution from world-writable temp paths, changes to accounts and sudoers, cron/systemd persistence, and audit-log tampering. auditd is installed and configured automatically when engine auto-install is on; the engine then reports as clamav+auditd.
5. 5Isolation uses nftables (iptables fallback) with the same allow-list as Windows: Cybermatic endpoints, DNS, DHCP.
6. 6Kill and quarantine work exactly as on Windows.