<enabled>

Enable RTP.

Boolean value: [0 | 1]

<use_extreme_db>

Use extreme database.

Boolean value: [0 | 1]

<when>

File I/O activities that result in a scan. Configure one of the following:

• 0: scan files when processes read or write them and enable scanning network files.
• 1: scan files when processes read them and disable scanning network files.
• 2: scan files when processes write them and disable scanning network files.
• 3: scan files when processes read or write them and disable scanning network files.
• 4: scan files when processes read them and enable scanning network files.
• 5: scan files when processes write them and enable scanning network files.

<ignore_system_when>

Configure one of the following:

• 0: scan files when system processes read or write them.
• 1: scan files when system processes read them.
• 2: scan files when system processes write them.
• 3: do not scan files when system processes read or write them.

<on_virus_found>

Configure the action FortiClient performs if it finds a virus:

• 1: ignore infected files.
• 4: quarantine infected files. You can use FortiClient to view, restore, or delete the quarantined file, as well as view the virus name, submit the file to FortiGuard, and view logs.
• 5: deny access to infected files.

<popup_alerts>

If enabled, displays the Virus Alert dialog when a virus is detected while attempting to download a file via a web browser. The dialog allows you to view recently detected viruses, their locations, and statuses.

Boolean value: [0 | 1]

<popup_registry_alerts>

Enable popup registry alerts. This feature displays alerts if a process tries to change registry start items.

Boolean value: [0 | 1]

<bypass_java>

Enable bypassing digitally signed Java processes.

Boolean value: [0 | 1]

<on_virus_found>

The action FortiClient performs when the Cloud Based Behavior Scan (CBBS) detects a virus. Select one of the following:

• 4: quarantine infected files. You can use FortiClient to view, restore, or delete the quarantined file, as well as view the virus name, submit the file to FortiGuard, and view logs.
• 5: deny access

<scan>

Scan archive files, including zip, rar, and tar files, for threats.

Boolean value: [0 | 1]

<maxsize>

Only scan files under the specified size in MB.

A number up to 65535. 0 means no limit.

<enabled>

Scan for riskware. Riskware refers to legitimate programs which, when installed and executed, presents a possible but not definite risk to the computer.

Boolean value: [0 | 1]

<enabled>

Scan for adware. Adware is a form of software that downloads or displays unwanted ads when a user is online.

Boolean value: [0 | 1]

<level>

This setting applies to real-time and on-demand scans. Enter one of the following:

• 0: normal
• 1: advanced heuristics on highly infected systems
• 2: Minos engine heuristics on highly infected systems
• 3: both advanced heuristics on highly infected systems and engine heuristics
• 4: both, without waiting to determine if system is highly infected

<action>

The action FortiClient performs if it finds a virus. Enter one of the following:

• 0: warning
• 1: deny access
• 3: submit only

<all_files>

Enabled scanning of all file types. If enabled, ignore the <file_types> element.

Boolean value: [0 | 1]

<extensions>

Comma separated list of extensions to scan.

<include_files_with_no_extension>

Determines whether to scan files with no extension.

Boolean value: [0 | 1]

<file>

Full path to a file to exclude from RTP scanning. Element may be repeated to list more files.

<folder>

Full path to a directory to exclude from RTP scanning. Element may be repeated to list more directories. Shadow Copy format is supported, for example, <folder>\Device\HarddiskVolumeShadowCopy*</folder>. Shadow Copy is also known as Volume Snapshot Service, Volume Shadow Copy Service, or VSS. Wildcards are not accepted.

<extensions>

Comma separated list of extensions to exclude from RTP scanning.

<enabled>

Enable FortiSandbox configuration.

Boolean value: [0 | 1]

<sandbox_address>

Specify the IP address for FortiSandbox.

<timeout>

Specify how long to wait in seconds for FortiSandbox results before allowing file access. When set to 0 seconds, file access is granted without waiting for FortiSandbox results.

Range: 0-4294967295 in seconds

<use_sandbox_signatures>

Enable using FortiSandbox signatures.

Boolean value: [0 | 1]

<check_for_signatures_every>

Specify how often to check for FortiSandbox signatures when <use_sandbox_signatures> is set to 1.

Boolean value: [0 | 1]

<action_on_error>

Specify whether to block traffic when FortiSandbox finds errors. When this setting is 0, traffic is passed. When this setting is 1, traffic is blocked.

Boolean value: [0 | 1]

<scan_usb>

Enable sending files from USB drives to FortiSandbox for scanning. When this setting is 0, files are not scanned. When this setting is 1, files are scanned.

Boolean value: [0 | 1]