ONTAP Vscan provides on-access antivirus scanning for SMB files. It offloads scans to external servers running supported third-party antivirus software and can suspend file operations until the external server returns the file’s scan status. Vscan interfaces directly with offloaded, external scanning servers running certified antivirus software using the NetApp Antivirus Connector (AV Connector).

When an SMB client attempts to open, read, or close/write a file, ONTAP intercepts the request at the protocol layer. If configured under an active Vscan on-access policy, the storage system pauses the client file operation and offloads the file payload across the network to an available server within the designated scanner pool. The external antivirus engine scans the object for malware or malicious signatures and transmits an allow, deny, or quarantine disposition back to ONTAP. FPolicy monitors and filters file access events, whereas Autonomous Ransomware Protection uses internal machine learning heuristics to spot abnormal entropy. WAFL scan is an internal filesystem consistency and scanning utility.