Does Jamf Protect scan downloaded files for viruses before allowing them to open?

I had a test  with Case-CS1169047- Can not block Crisis Malware in https://objective-see.org/malware.html "

Here is the feedback from Support Team.

In those cases, where the executable doesn't actually execute then Jamf Protect has nothing to scan, match and prevent because nothing is actually launching / spawning a process.

This is a 32 bit executable which most computers don’t know how to run. Since we scan at runtime, no scan would actually occur since the computer doesn’t know how to run it. Basically, Operating system itself didn't know or allow this to execute correctly, a process wasn't created and no threat is presented and hence no process was created, Protect didn't need to intervene, scan, match and prevent a threat. I would say you might have seen some sort of error or message inside terminal when trying to launch one of those older samples."

Thanks @JL85 , it seems that then Jamf Protect does not scan downloaded files and instead waits to see what happens if they are executed successfully... is that your take away as well?

Yes , that 's the way that jamf protectet can do

@junjishimazaki thank you for that explanation. Do you see this as a weakness since it doesn't individually scan files before execution? I.e., wouldn't it be safer to scan them before they're trying to do something malicious?

Just like any other AV out there, it's never going to be 100% secure. I have yet to encounter any malware/virus that has circumvented the Mac's built-in security. Plus the benefit of Jamf Protect, it uses little system resources since it uses the Mac's built-in security. So, at the end of this, it's going to be what your organization wants . 

Thanks again, I appreciate that perspective!

Just keep in mind, if you do encounter mac that has some sort of malware/virus. You can't force Jamf Protect to scan since it has no scanning feature so you will have to rely on another 3rd party AV software to that.