LowCompromise indicatorsBLWK-AV-001

ClamAV is not installed

What this means

No clamscan binary was found. Bulwark deliberately doesn't reimplement signature-based malware detection (see the project's own non-goals) — it expects ClamAV to cover that ground, so without it this whole category goes unchecked.

How to fix it

Install ClamAV (e.g. apt install clamav) and run freshclam to fetch signatures.

Check it yourself

Run a scan and look for BLWK-AV-001 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads clamav_status and reports this check when:

installed == false

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

Related checks

• Shell history recording is suppressed · BLWK-EVASION-001
• File modified since baseline: ‹path› · BLWK-FIM-001
• File deleted since baseline: ‹path› · BLWK-FIM-002
• Not covered by the file-integrity baseline: ‹path› · BLWK-FIM-003
• Credential file modified since baseline: ‹path› · BLWK-FIM-004
• Credential file deleted since baseline: ‹path› · BLWK-FIM-005