Antivirus configuration (Mobile Threat Defense policy for Android)

Select how often malware scans are performed.

If you select Daily while charging, a scan is performed when the device is connected to a power supply for more than 30 minutes.

Scan system apps.

System apps aren’t scanned by default because they are protected by the Android OS and because the user can’t uninstall them.

Scan for Potentially Unwanted Applications (PUAs).

PUAs are apps that, while not malicious, are generally considered unsuitable for business networks. PUAs include adware, dialers, system monitors, remote administration tools, and hacking tools. However, certain apps that can fall into the PUA category might be considered useful by some users.

Use the Mode drop-down list to select the detection behavior for low-reputation apps:

Allow: Turn off scanning for low-reputation apps.

Warn: Display a warning on the device when a low-reputation app is detected. Users can choose how to deal with the app. They can add it to a list of allowed apps so that no further warning is displayed if this app is detected.

Block: The user can’t open low-reputation apps.

When an app is scanned after installation, Sophos Intercept X for Mobile creates a notification.

If the check box is cleared, no notifications are created for clean apps.

Select a group of apps you want to exclude from scanning.

Warning: Because excluding apps from scanning imposes a security risk, we recommend keeping this group as small as possible. For example, add legitimate apps that would raise low-reputation warnings.