Jason Haar wrote: > I don't know of any commercial AV product that offers training courses. > I thought AV is marketed as "set and forget"? Certainly no company I've > ever worked for has sent people on "AV training courses". And if they > did, it would be for Windows-based Enterprise solutions - central > consoles with auto-push of "always on" client scanners - a role ClamAV > does not cover (today). > > ClamAV offers some advantages over commercial products (namely the > ability to write your own sigs), but that isn't enough cause to create a > course for. Good documentation should cover that. > > Just my 2cents worth... > > There are some circumstances that would benefit from best practices coaching if not out right training. Among them: Local db mirror(s), centralized and clustered av farms, integration with various mailers and milters, user space scanning of file servers (Windows/Linux/Unix), integration with proxy cache servers and ftp/http drop boxes, pattern overrides (whitelisting), custom db files, scoring, libclamav coding, reporting, compiling and packaging.
There are some good and some bad ways of writing patterns. Unanchored patterns, for example, need to be handled with some care. I haven't dug deep enough into it, but some patterns need go no further than the subject line, for example, and I wonder if patterns can be anchored to headers and envelop elements. Do I wonder enough to sign up for a class? Probably not, but if it were still my responsibility to deal with this at the enterprise level I'd more likely to be interested. But... I think enterprises more and more are going to turn to postini/messagelabs and appliances rather than pay somebody to duplicate effort that is commercially available. This in fact is why I'm no longer doing enterprise mail. It was outsourced (and I really don't miss it). dp _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
