file content-disarm-reconstruct
Use this command to configure content disarm and reconstruction (CDR) file attachment options.
Syntax
config file content-disarm-reconstruct
set component-type-options {...}
set continue-sandbox-on-cdr {enable | disable}
set deferred-scan-notification-option {disarm | remove}
set deferred-scan-notification-status {enable | disable}
set deferred-scan-verdict-option {clean | high | low | malicious | medium}
set deferred-scan-verdict-status {enable | disable}
set modification-notice-option {enable | disable}
end
|
component-type-options {...}
|
Select which attachment content types will receive CDR:
-
office-action
-
office-dde
-
office-embedded-object
-
office-hyperlink
-
office-linked-object
-
office-macro
-
pdf-action-form
-
pdf-action-gotor
-
pdf-action-hyperlink
-
pdf-action-javascript
-
pdf-action-launch
-
pdf-action-movie
-
pdf-action-sound
-
pdf-action-url
|
|
|
continue-sandbox-on-cdr {enable | disable}
|
By default, when CDR succeeds in disarming the attachment, the FortiSandbox scan is bypassed. Enable this option if you want to still perform the FortiSandbox scan, regardless of CDR result.
|
disable
|
|
deferred-scan-notification-option {disarm | remove}
|
Select whether to send notification email with a disarmed attachment, or with no attachment.
|
disarm
|
|
deferred-scan-notification-status {enable | disable}
|
Enable or disable sending the notification email on deferred scan.
|
disable
|
|
deferred-scan-verdict-option {clean | high | low | malicious | medium}
|
Determine the verdict threshold option to disarm on delivery.
|
clean
|
|
deferred-scan-verdict-status {enable | disable}
|
Enable or disable disarming the attachment of deferred email by verdict threshold.
|
enable
|
|
modification-notice-option {enable | disable}
|
Enable or disable appending the CDR disclaimer "Attachment has been reconstructed" for cleaned attachments.
|
disable
|
Related topics
profile content
system fortiguard url-protection
system fortisandbox
