ClamAV antivirus (workstations)

How to install and schedule the ClamAV open-source antivirus on employee workstations. ClamAV complements the Wazuh agent as endpoint malware protection. For the higher-level rationale see the playbook's Endpoint Security page.

Ubuntu workstations

Install ClamAV:

sudo apt install clamav clamav-daemon -y

Start and enable the ClamAV daemon:

sudo systemctl start clamav-daemon
sudo systemctl enable clamav-daemon

Schedule automatic scans:

sudo crontab -e

Add this line to schedule a weekly scan (Mondays at 02:00):

0 2 * * 1 clamscan -r /home >> /var/log/clamav-scan.log

macOS workstations

⚠️ Not fully tested yet — verify before relying on it.

Install Homebrew (if not already installed):

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

Install ClamAV via Homebrew:

brew install clamav

Configure ClamAV — open the config file:

nano /opt/homebrew/etc/clamd.conf

Uncomment and modify the necessary lines (e.g. remove or comment out the Example line), then save and exit.

Schedule automatic scans:

crontab -e

Add this line to schedule a weekly scan (Mondays at 02:00):

0 2 * * 1 clamscan -r /home >> /var/log/clamav-scan.log

ClamAV is now configured to perform weekly scans on macOS.