Malware Scan Configuration

Malware scanning can be configured using either command line arguments, the INI file, or a combination of both.
Command Line Arguments
--read-stdin: Read paths from stdin. If not specified, paths will automatically be read from stdin when input is not from a TTY.
-s, 
--file-list-separator: Separator used when listing files via stdin. Defaults to the null byte.
--output: Write results to stdout. This is the default behavior when --output-path is not specified.
--output-path: Path to which to write results.
--output-columns: An ordered, comma-delimited list of columns to include in the output. Available columns: 
filename, 
signature_id, 
signature_name, 
signature_description, 
matched_text. Compatible formats: csv, tsv, null-delimited, line-delimited, human.
-m, 
--output-format: Output format used for result data.
--output-headers: Include column headers in output. Compatible formats: csv, tsv, null-delimited, line-delimited.
-e, 
--exclude-signatures: Specify rule IDs to exclude from the scan. Can be comma-delimited and/or specified multiple times.
-i, 
--include-signatures: Specify rule IDs to include in the scan. Can be comma-delimited and/or specified multiple times.
--images: Include image files in the scan.
-a, 
--include-all-files: Scan all files. By default, only files matching certain extensions are scanned
-n, 
--include-files: Only scan filenames that are exact matches. Can be used multiple times.
-x, 
--exclude-files: Do not scan filenames that are exact matches. Can be used multiple times. Denials take precedence over allows.
-N, 
--include-files-pattern: Python regex allow pattern. Only matching filenames will be scanned.
-X, 
--exclude-files-pattern: Python regex deny pattern. Matching filenames will not be scanned.
--allow-io-errors: Allow scanning to continue if IO errors are encountered. Files that cannot be read will be skipped and a warning will be logged.
-z, 
--chunk-size: Size of file chunks that will be scanned. Use a whole number followed by one of the following suffixes: b (byte), k (kibibyte), m (mebibyte). Defaults to 3m.
-M, 
--scanned-content-limit: The maximum amount of data to scan in each file. Content beyond this limit will not be scanned. Defaults to 50 mebibytes. Use a whole number followed by one of the following suffixes: b (byte), k (kibibyte), m (mebibyte).
--match-engine: The regex engine to use for malware scanning. Options: 
pcre, 
vectorscan (default: 
pcre)
--match-all: If set, all possible signatures will be checked against each scanned file. Otherwise, only the first matching signature will be reported
--pcre-backtrack-limit: The regex backtracking limit for signature evaluation
--pcre-recursion-limit: The regex recursion limit for signature evaluation
-w, 
--workers: Number of worker processes used to perform scanning. Defaults to 1 worker process.
--progress: Display scan progress in the terminal with a curses interface
INI Options
[MALWARE_SCAN]
# Read file paths to scan from stdin
read_stdin = [on|off]
file_list_separator = <separator string, defaults to null byte>
# Controls whether or not output is written to stdout
output = [on|off]
output_path = <path to which to write results>
# Comma-delimited list of columns to include in output (`filename`, `signature_id`, `signature_name`, `signature_description`, `matched_text`)
output_columns = <columns>
output_format = [human|csv|tsv|null-delimited|line-delimited]
# Whether to include headers in output
output_headers = [on|off]
# Comma-delimited list of signature IDs
exclude_signatures = <signatures>
include_signatures = <signatures>
images = [on|off]
include_all_files = [on|off]
# Comma-delimited list of filenames
include_files = <filenames>
exclude_files = <filenames>
# Comma-delimited list of Python regex patterns
include_files_pattern = <patterns>
exclude_files_pattern = <patterns>
allow_io_errors = [on|off]
# Files are scanned in chunks of this size, may use b, k, or m suffix
chunk_size = <size>
# Maximum amount of data to scan for each file, may use b, k, or m suffix
scanned_content_limit = <size>
match_engine = [pcre|vectorscan]
match_all = [on|off]
# Backtrack limit option for PCRE, should be an integer
pcre_backtrack_limit = <limits>
# Number of workers to use
workers = <number>
# Alternate database path when using vectorscan
pattern_database_path = <path>
# Whether or not to compile the vectorscan database locally
compile_local = [on|off]
# Toggle direct IO (avoids filesystem caching)
direct_io = [on|off]