prescan-config
Large files are typically archive files that contain multiple embedded files. Configure the maximum file size supported by FortiSandbox using the filesize-limit command.
In a cluster environment, use this command only in the primary node and the setting is synchronized to other nodes.
We recommend to only specifying one option each time.
Syntax
prescan-config [-h|-l|-c|-a|-b|-z|-n|-y|-e|-f|-u]
|
Option |
Description |
|---|---|
|
-h |
Help information. |
|
-l |
Show prescan configuration settings. |
|
-c |
Set maximum number of child files to extract from archive file. (Default 1000 for VM model) |
|
-a |
Set size limit (<100M) of the archive file that will be scanned with the executable file in VM (default 5M) When scanning executable child files within a ZIP archive, the parent archive may also be required because the executable files can reference other files inside the archive. FortiSandbox can send the parent ZIP file to the VM together with the executable child file during dynamic analysis. For performance reasons, the default maximum size of the parent archive that can be sent to the VM is 5 MB. This value can be increased up to 100 MB if required.
|
|
-b |
Set large file (>512MB) unpack timeout in seconds (default = 600, max = 86400). |
|
-z |
Set large file (>512M) yara scan timeout in seconds (default = 60, max = 3600) |
|
-n |
Set regular file (<=512MB) unpack timeout in seconds (default = 15, max = 3600). |
|
-y |
Set regular file (<=512M) yara scan timeout in seconds (default = 30, max 3600) |
|
-e |
For text files, determine the file type using the file extension; if no extension is present, fall back to content-based detection (default). |
|
-f |
For text files, determine the file type strictly based on content. |
|
-u |
Unset all prescan settings, that is, set to default. |
The unpack timeout and number of child files can be increased to improve threat detection. For more information, see Enhancing Threat Detection in the FortiSandbox Best Practices Guide.