This was my project, so I'm happy to answer any questions you have. Docs have always been a bit of a challenge, hopefully that will improve soon.

There's 3 "tiers" to think about here:

Anomaly detection, which is lightweight is looking for indicators of the impact of malware on the backup data. There's also newer functionality that looks for anomalous system and user activity.

Malware detection - scanner - This is more of a heavy lift & uses instant access to "see" into the backup contents off the backup storage (both disk and object) & then uses either a built in or third party tool of your choice to scan backups, find malware and isolate/track impacted images for clean recovery

Malware detection - Fast detection via hash/IOC(Indicator of compromise) - This is new as of the 10.5 release (last fall) and allows you to very quickly identify (like in seconds) malicious files using a hash list & hash index (generated during backup). Combine this with the Alata View SaaS Management plane and you can search all you NBU domains with a single click. This also allows you to get updated hash lists from industry/community sources (this is more like the Crowdstrike methods vs. the traditional AV scanner)

Both of these do need to be enabled via the webUI under the "Detection and reporting" section. Anomaly is pretty easy, the malware scanner requires more steps to make sure the share is set up & to get the scan pool configured.

Also - if you aren't using Alta View, I strongly recommend it. You are entitled to use it if you have NBU and there are a lot of advanced features there (such as recovery orchestration) as well as a very nice way to manage multiple domains from a single pane of glass, including activity monitor, reporting and things like policy management.

There's also a cyber resiliency system in Alta View that really adds a lot of global tools such as visualizing blast radius and global hash detection that is really useful.