Best to post your comments on the Ideas Page since you want a change to functionality and not a question.  The Patch Project Manager does review those...

Yes, maybe 1) and 3) , but 2) doesn't looks like someone designed it like that, hopefully !

For #2......

Testing using the VIrus test file from this site:

https://www.eicar.org/download-anti-malware-testfile/  (It's not an actual virus, but all AV Vendors will treat it as such for testing reasons.)

It' may be tricky to test....as browsers often block it so it may not even get to your PC for AV to pick up....Just takes a bit of fiddling.

Once ZAM picks flags/quarantines/deletes the file.....Test 3 different things to see if any of them speed up what you want to see in the ZCC.

"ZAC AU","ZAC MRS", or "ZAC STS ROLLUP".

If any of the three help, we may be able to tweak some settings to speed it up depending on which one helps....

But I suspect current behavior is by design where the local recording does not trigger a status rollup to the server.

Presumably, because the Agent will Quarantine/Clean/etc.....so the report is just informational.

Or that is my guess.   Mind you, I've not had infections often enough to pay too much attention.

I don't remember for sure, but I don't think these even show up in  the CEF logs.  I know various other security items don't such as mobile device enroll or un-enrollment events. 

I'd argue CEF logs are even more important than email since CEF logging allows us to integrate with SIEM systems for automation of security events.

Yeah, good catch. THAT would be helpful. There is no Audit Event and should be. Craig Wilson is this best way to go ?

#1 - I'm a former administrator but now work to help other administrators....So that is up to the customers decide....I can give my two cents and help chat through.

#2 - I don't view them as either/or.  

#3 - The key is the info is both timely and with sufficient info it is actionable....What detection...what PC...etc....

How easy or hart that may be today is hard for me to say but it sounds as if you are having difficulty.  It's not really something I've looked deeply into beyond confirming the AV page on the device and and some other areas are working...I just don't use it like an admin may want to use it.

Pls vote community.microfocus.com/.../email-notification-for-when-anti-malware-detects-malware