Issue
No email sent to the antivirus_admin when attachment flagged as a virus but the documentation says that "The system sends an email notification to the user and the antivirus administrator."
Antivirus Scanning: https://docs.servicenow.com/csh?topicname=antivirus-protection.html&version=latest
Steps to Reproduce:
- Enabled Antivirus
- uploaded a fake virus attachment using this below fix script on incident with sys-id: 57af7aec73d423002728660c4cf6a71c -
var grECC = new GlideRecord('ecc_queue');
grECC.initialize();
grECC.agent = 'AttachmentCreator';
grECC.topic = 'AttachmentCreator';
grECC.name = 'file_name.txt:application/test.txt';
grECC.source = 'incident:57af7aec73d423002728660c4cf6a71c';
//Base64 encoded string from EICAR example: X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
grECC.payload = 'WDVPIVAlQEFQWzRcUFpYNTQoUF4pN0NDKTd9JEVJQ0FSLVNUQU5EQVJELUFOVElWSVJVUy1URVNULUZJTEUhJEgrSCo=';
grECC.state = '';
grECC.insert();
gs.info('<a href='+grECC.getLink()+'>ECC Queue</a>'); - Open the Incident, it will display an anti-virus pop up message
- Check the emails, it will trigger a notification only to the User but not to the Anti-Virus Admin.
Release
Madrid
Resolution
In the email script: "notify_when_file_is_infected", the Antivirus Admin is added to BCC:
"email.addAddress("bcc", userRole.user.email, userRole.getDisplayValue("user"));"
Sys ID of the Email Script : 3D7a5302f15300230019eeddeeff7b127b
I have given the user "Abel Tutor" as an Anti-Virus Admin role and I can see "Abel Tutor" in the BCC