Fortinet Document Library

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

XML Reference Guide

On-Demand scans

The <on_demand_scanning> element defines how the antivirus scanner handles scanning of files manually requested by the end user.

<forticlient_configuration>

<antivirus>

<on_demand_scanning>

<use_extreme_db>1</use_extreme_db>

<on_virus_found>4</on_virus_found>

<pause_on_battery_power>1</pause_on_battery_power>

<signature_load_memory_threshold>8</signature_load_memory_threshold>

<automatic_virus_submission>

<enabled>0</enabled>

<smtp_server>fortinetvirussubmit.com</smtp_server>

<username />

<password>Encrypted/NonEncrypted_PasswordString</password>

</automatic_virus_submission>

<compressed_files>

<scan>1</scan>

<maxsize>0</maxsize>

</compressed_files>

<riskware>

<enabled>1</enabled>

</riskware>

<adware>

<enabled>1</enabled>

</adware>

<heuristic_scanning>

<level>3</level>

<action>2</action>

</heuristic_scanning>

<scan_file_types>

<all_files>1</all_files>

<file_types>

<extensions>.386,.ACE,.ACM,.ACV,.ACX,.ADT,.APP,.ASD,.ASP,.ASX,.AVB,.AX,.AX2,.BAT,.BIN,.BTM,.CDR,.CFM,.CHM,.CLA,.CLASS,.CMD,.CNN,.COM,.CPL,.CPT,.CPY,.CSC,.CSH,.CSS,.DEV,.DLL,.DOC,.DOT,.DRV,.DVB,.DWG,.EML,.EXE,.FON,.GMS,.GVB,.HLP,.HTA,.HTM,.HTML,.HTT,.HTW,.HTX,.HXS,.INF,.INI,.JPG,.JS,.JTD,.KSE,.LGP,.LIB,.LNK,.MDB,.MHT,.MHTM,.MHTML,.MOD,.MPD,.MPP,.MPT,.MRC,.OCX,.PIF,.PL,.PLG,.PM,.PNF,.PNP,.POT,.PPA,.PPS,.PPT,.PRC,.PWZ,.QLB,.QPW,.REG,.RTF,.SBF,.SCR,.SCT,.SH,.SHB,.SHS,.SHT,.SHTML,.SHW,.SIS,.SMM,.SWF,.SYS,.TD0,.TLB,.TSK,.TSP,.TT6,.VBA,.VBE,.VBS,.VBX,.VOM,.VSD,.VSS,.VST,.VWP,.VXD,.VXE,.WBK,.WBT,.WIZ,.WK,.WML,.WPC,.WPD,.WSC,.WSF,.WSH,.XLS,.XML,.XTP</extensions>

<include_files_with_no_extension>0</include_files_with_no_extension>

</file_types>

</scan_file_types>

<exclusions>

<file></file>

<folder></folder>

<file_types>

<extensions></extensions>

</file_types>

</exclusions>

</on_demand_scanning>

</antivirus>

</forticlient_configuration>

The following table provides the XML tags for on-demand scans, as well as the descriptions and default values where applicable.

XML Tag

Description

Default Value

<use_extreme_db>

Use the extreme database.

Boolean value: [0 | 1]

1

<on_virus_found>

The action FortiClient performs if a virus is found. Select one of the following:

  • 4: quarantine
  • 5: deny access

4

<pause_on_battery_power>

Suspend scanning when system is on battery.

Boolean value: [0 | 1]

1

<signature_load_memory_threshold>

Configure the threshold used to control memory allocation mechanism for signature loading. When the physical machine has more memory than the threshold, it uses the static memory mechanism to load signatures one time, which ensures that the scan is efficient. When the physical machine has less memory than the threshold, it uses the dynamic memory mechanism to load the signatures, which ensures that the scan process does not use too much memory.

<heuristic_scanning> elements

<level>

Level is from 0 to 4. Applied to both real-time and on-demand scans. Select one of the following:

  • 0: normal
  • 1: advanced heuristics on highly infected systems
  • 2: Minos engine heuristics on highly infected systems
  • 3: both advanced heuristics on highly infected systems and engine heuristics
  • 4: both, without waiting to determine if system is highly infected

<action>

The action FortiClient performs if a virus is found. Select one of the following:

  • 0: warning
  • 1: deny access
  • 2: quarantine
  • 3: submit only

<automatic_virus_submission> elements

<enabled>

Send virus files found to FortiGuard servers.

Boolean value: [0 | 1]

0

<smtp_server>

SMTP server IP address or FQDN.

fortinetvirussubmit.com

<username>

<password>

Either encrypted or non-encrypted password.

<compressed_files> elements

<scan>

Enable or disable scanning of compressed files.

Boolean value: [0 | 1]

1

<maxsize>

Maximum compressed file size to scan in MB. A number up to 65535. 0 means no limit.

0

<riskware> elements

<enabled>

Enable or disable scanning of riskware files.

Boolean value: [0 | 1]

1

<adware> element

<enabled>

Enable or disable scanning of adware files.

Boolean value: [0 | 1]

1

<scan_file_types> element

<all_files>

Enabled or disable scanning of all file types. If enabled, ignore the <file_types> element.

Boolean value: [0 | 1]

1

<scan_file_types> <file_types> elements

<extensions>

Comma separated list of extensions to scan.

<include_files_with_no_extension>

Determines whether to scan files with no extension.

Boolean value: [0 | 1]

0

<exclusions> elements

<file>

Full path to a file to exclude from on-demand scanning. Wildcards are not accepted. Element may be repeated to list more files.

<folder>

Full path to a directory to exclude from on-demand scanning. Element may be repeated to list more directories. Shadow Copy format is supported, for example, <folder>\Device\HarddiskVolumeShadowCopy*</folder>. Shadow Copy is also known as Volume Snapshot Service, Volume Shadow Copy Service, or VSS. Wildcards are not accepted.

<exclusions> <file_types> element

<extensions>

Comma separated list of extensions to exclude from on-demand scanning.

On-Demand scans

The <on_demand_scanning> element defines how the antivirus scanner handles scanning of files manually requested by the end user.

<forticlient_configuration>

<antivirus>

<on_demand_scanning>

<use_extreme_db>1</use_extreme_db>

<on_virus_found>4</on_virus_found>

<pause_on_battery_power>1</pause_on_battery_power>

<signature_load_memory_threshold>8</signature_load_memory_threshold>

<automatic_virus_submission>

<enabled>0</enabled>

<smtp_server>fortinetvirussubmit.com</smtp_server>

<username />

<password>Encrypted/NonEncrypted_PasswordString</password>

</automatic_virus_submission>

<compressed_files>

<scan>1</scan>

<maxsize>0</maxsize>

</compressed_files>

<riskware>

<enabled>1</enabled>

</riskware>

<adware>

<enabled>1</enabled>

</adware>

<heuristic_scanning>

<level>3</level>

<action>2</action>

</heuristic_scanning>

<scan_file_types>

<all_files>1</all_files>

<file_types>

<extensions>.386,.ACE,.ACM,.ACV,.ACX,.ADT,.APP,.ASD,.ASP,.ASX,.AVB,.AX,.AX2,.BAT,.BIN,.BTM,.CDR,.CFM,.CHM,.CLA,.CLASS,.CMD,.CNN,.COM,.CPL,.CPT,.CPY,.CSC,.CSH,.CSS,.DEV,.DLL,.DOC,.DOT,.DRV,.DVB,.DWG,.EML,.EXE,.FON,.GMS,.GVB,.HLP,.HTA,.HTM,.HTML,.HTT,.HTW,.HTX,.HXS,.INF,.INI,.JPG,.JS,.JTD,.KSE,.LGP,.LIB,.LNK,.MDB,.MHT,.MHTM,.MHTML,.MOD,.MPD,.MPP,.MPT,.MRC,.OCX,.PIF,.PL,.PLG,.PM,.PNF,.PNP,.POT,.PPA,.PPS,.PPT,.PRC,.PWZ,.QLB,.QPW,.REG,.RTF,.SBF,.SCR,.SCT,.SH,.SHB,.SHS,.SHT,.SHTML,.SHW,.SIS,.SMM,.SWF,.SYS,.TD0,.TLB,.TSK,.TSP,.TT6,.VBA,.VBE,.VBS,.VBX,.VOM,.VSD,.VSS,.VST,.VWP,.VXD,.VXE,.WBK,.WBT,.WIZ,.WK,.WML,.WPC,.WPD,.WSC,.WSF,.WSH,.XLS,.XML,.XTP</extensions>

<include_files_with_no_extension>0</include_files_with_no_extension>

</file_types>

</scan_file_types>

<exclusions>

<file></file>

<folder></folder>

<file_types>

<extensions></extensions>

</file_types>

</exclusions>

</on_demand_scanning>

</antivirus>

</forticlient_configuration>

The following table provides the XML tags for on-demand scans, as well as the descriptions and default values where applicable.

XML Tag

Description

Default Value

<use_extreme_db>

Use the extreme database.

Boolean value: [0 | 1]

1

<on_virus_found>

The action FortiClient performs if a virus is found. Select one of the following:

  • 4: quarantine
  • 5: deny access

4

<pause_on_battery_power>

Suspend scanning when system is on battery.

Boolean value: [0 | 1]

1

<signature_load_memory_threshold>

Configure the threshold used to control memory allocation mechanism for signature loading. When the physical machine has more memory than the threshold, it uses the static memory mechanism to load signatures one time, which ensures that the scan is efficient. When the physical machine has less memory than the threshold, it uses the dynamic memory mechanism to load the signatures, which ensures that the scan process does not use too much memory.

<heuristic_scanning> elements

<level>

Level is from 0 to 4. Applied to both real-time and on-demand scans. Select one of the following:

  • 0: normal
  • 1: advanced heuristics on highly infected systems
  • 2: Minos engine heuristics on highly infected systems
  • 3: both advanced heuristics on highly infected systems and engine heuristics
  • 4: both, without waiting to determine if system is highly infected

<action>

The action FortiClient performs if a virus is found. Select one of the following:

  • 0: warning
  • 1: deny access
  • 2: quarantine
  • 3: submit only

<automatic_virus_submission> elements

<enabled>

Send virus files found to FortiGuard servers.

Boolean value: [0 | 1]

0

<smtp_server>

SMTP server IP address or FQDN.

fortinetvirussubmit.com

<username>

<password>

Either encrypted or non-encrypted password.

<compressed_files> elements

<scan>

Enable or disable scanning of compressed files.

Boolean value: [0 | 1]

1

<maxsize>

Maximum compressed file size to scan in MB. A number up to 65535. 0 means no limit.

0

<riskware> elements

<enabled>

Enable or disable scanning of riskware files.

Boolean value: [0 | 1]

1

<adware> element

<enabled>

Enable or disable scanning of adware files.

Boolean value: [0 | 1]

1

<scan_file_types> element

<all_files>

Enabled or disable scanning of all file types. If enabled, ignore the <file_types> element.

Boolean value: [0 | 1]

1

<scan_file_types> <file_types> elements

<extensions>

Comma separated list of extensions to scan.

<include_files_with_no_extension>

Determines whether to scan files with no extension.

Boolean value: [0 | 1]

0

<exclusions> elements

<file>

Full path to a file to exclude from on-demand scanning. Wildcards are not accepted. Element may be repeated to list more files.

<folder>

Full path to a directory to exclude from on-demand scanning. Element may be repeated to list more directories. Shadow Copy format is supported, for example, <folder>\Device\HarddiskVolumeShadowCopy*</folder>. Shadow Copy is also known as Volume Snapshot Service, Volume Shadow Copy Service, or VSS. Wildcards are not accepted.

<exclusions> <file_types> element

<extensions>

Comma separated list of extensions to exclude from on-demand scanning.