Commvault Threat Scan Advanced Requirements

The following are Commvault Threat Scan advanced requirements for software-managed deployments and SaaS deployments.

Index Cache and Job Results Disk Space Requirements

Virtual machine Threat Scan operations require disk space on the Backup MediaAgent — which also hosts the Threat Scan index — and on the Threat Scan access nodes where the job results directory resides.

• Minimum disk space requirement for index cache: 1 TB

• Minimum disk space requirement for job results directory: 1 TB

Networking Requirements

• At a minimum, you must open port 8403 both ways on your firewall between the Threat Scan server and the CommServe server and MediaAgent. For all other standard networking requirements, see Port Requirements for Commvault .

• Advanced network settings can be used to isolate the Threat Scan server. Using Commvault network topologies, you can configure different network ports as well as tunnel communication between the Threat Scan server, CommServe server, and MediaAgent, in order to create an isolated scanning server. For more information, see Network Topologies.

File System Support for VM Workloads

• For Windows VMs that use the Resilient File System (ReFS), the access node must run the same or a newer Windows OS version.

• For BTRFS support, an access node running on Oracle Linux 9.x or Ubuntu 24.04 is required.

• For a Windows guest VM using Storage Spaces, ensure that the Windows Threat Scan access node runs the same or a newer version of Windows. For example, for a Windows 2022 guest VM, the access node must run Windows 2022 or a newer version.

Update Avira Signatures

Threat Scan automatically updates malware signature definitions on the Threat Scan server every 24 hours.

• To allow updates, open outbound port 443 from the Threat Scan server to the following URL: https://oem.avira-update.com/update.

• To use a proxy server for signature updates, see Configuring a Proxy Server to Perform Virus Definition Updates.

• For information about updating signature updates in fully isolated (dark-site) environments, see the KB article "Threat Scan — Manual Avira VDF Update for Dark-Site Environments".

Antivirus Exclusions

If an antivirus product is active on the scanning engine/node, it is recommended that you follow general Commvault antivirus exclusion recommendations. For more information, see the following:

• Antivirus Exclusions for Windows

• Antivirus Exclusions for UNIX and Macintosh

At a minimum, the antivirus product must exclude the following processes and directories:

• Processes

  • CvBlkSvc (should be able to access and communicate with the Linux kernel)

  • CvFileScan.exe

  • CvDistributor.exe

  • CLRestore.exe

  • cvods [for both pseudomount in Windows and File Recovery Enabler for Linux (FREL)]

  • ifind

• Directories

  • <CVInstallDir>/iDataAgent/jobResults/CV_JobResults/

    Where:

    • <CVInstallDir> is the actual installation path.

Configuring Auto-Scaling for Amazon Web Services (AWS)

Create a scaling configuration that specifies the AWS credentials, scale manager node, Availability Zones, IAM role, instance type, and maximum number of access nodes.

Note the following for multi-tenant environments:

• Service providers: Use your AWS account credentials where the auto-scaled access nodes will be deployed.

• Tenants configuring your own auto-scaling: Use your own AWS account credentials.

For detailed steps, see Create a scaling configuration for AWS.

Configuring Auto-Scaling for Azure Blob Access Nodes

1. Create a scaling configuration and assign the server group to Azure Blob instances.

   For information about creating a scaling configuration, see Create a scaling configuration for Azure.

   Note the following for multi-tenant environments:

   • Service providers can offer auto-scaling with a scaling configuration as a service.

   • Tenants can either use their service providers' scaling configuration or configure their own scaling configuration.

2. Add a scale configuration client to a server group to define topology and permission settings. These settings are automatically applied to all compute nodes in the group.

   1. From the Command Center navigation pane, go to Manage > Infrastructure > Server groups.

   2. Click Add, enter a name for the server group, and then select Manual association.

   3. In the Members section, associate the scale configuration client to the server group.

   Important

   • The server group must include at least one permanent node with the Cloud Apps package installed.

   • The server group must include at least one permanent node with the File System and Threat Analysis package installed.

3. Associate the group with the plan.

   When you configure the Threat Scan plan, select the above server group as the access node.

   For more information, see Step 3 in the "Compute" section in Creating a New Threat Scan Plan.