Malware Defense — Who Is Actually Pushing Malware at You, and Who Merely Downloaded It
A firewall antivirus event has two sides, and scoring the wrong one blackholes your own visitors. RoutePulse reads the FortiGate AV verdicts through the SIEM and applies an attribution matrix on the session direction: an external initiator uploading a flagged file is a pusher; an external host serving one is a malware host; a visitor who downloaded something flagged from your own vhost is never scored — that is a hygiene finding on your content, listed separately.
Pushers over the threshold (three blocked pushes in 15 minutes or five in a day) are blackholed on the core routers with a strike-escalated TTL; a false-positive storm breaker suspends the automation when one signature suddenly matches hundreds of unrelated sources, and a verified-crawler guard keeps search-engine bots out of the diary. Overview, attackers, signatures, your own content and the mitigation ledger each have their tab.