Advanced Agent configuration settings
FortiDLP supports the following optional advanced Agent configuration settings. These settings must be enabled through custom configurations, as described in Creating Agent configuration groups. Contact Fortinet Support for guidance.
|
Where an advanced Agent configuration setting is not configured in the FortiDLP Console, the Agent default value applies. The Agent default values below are based on FortiDLP Agent 12.0.2+. |
|
Key name |
Description |
Example value |
Agent default value |
|---|---|---|---|
|
|
For use only under the direction of Fortinet Support: Disables browser upload events and browser upload blocking for specified websites. |
|
All OSs: No default |
|
|
For use only under the direction of Fortinet Support: Disables the majority of FortiDLP Browser Extension functionality for specified websites. |
|
All OSs: No default |
|
|
For use only under the direction of Fortinet Support: Repairs FortiDLP Browser Extension communications for Google Chrome following an extension update that will otherwise halt until a page refresh. |
|
All OSs: |
|
|
The above settings should only be used until browser monitoring issues are resolved. |
|
Key name |
Description |
Example value |
Agent default value |
||
|---|---|---|---|---|---|
|
|
Enables next-generation content inspection. |
|
|
||
|
|
Specifies a comma-separated list of file MIME types to enable legacy content inspection for. |
|
All OSs: No default |
||
|
|
Enables legacy or next-generation content inspection of file metadata for Windows. |
|
|
||
|
|
Enables next-generation content inspection of file metadata for all OSs. |
|
All OSs: |
||
|
|
Enables next-generation content inspection of keywords. |
|
All OSs: |
||
content_inspection_next_
|
Specifies a comma-separated list of file MIME types to exclude from next-generation content inspection.
|
|
All OSs: No default |
||
content_inspection_next_
|
Defines the maximum size of a file in bytes to perform next-generation content inspection on. If a file is larger than this, content inspection will stop when the limit is reached and any matches made before this will be reported. A value of |
|
All OSs: |
||
content_inspection_next_
|
Defines the maximum amount of time for next-generation content inspection to run. A time value is a number followed by a unit suffix. Valid units are "s" (seconds), "m" (minutes), and "h" (hours). |
|
All OSs: |
|
Key name |
Description |
Example value |
Agent default value |
||
|---|---|---|---|---|---|
file_shadow_file_size_max
|
Defines the maximum size of a file for which a shadow copy can be created. A size value is a number followed by a unit suffix, with our without a space between them. Valid units are "B", "KB", "MB", "GB", "TB", "PB", and "EB". You can also use the long format of units, such as "kilobyte" or "kilobytes".
|
|
All OSs: |
||
file_shadow_storage_size_max
|
Defines the maximum size of local storage that can be used to store shadow copies if there is an issue connecting to the storage bucket. A size value is a number followed by a unit suffix, with our without a space between them. Valid units are "B", "KB", "MB", "GB", "TB", "PB", and "EB". You can also use the long format of units, such as "kilobyte" or "kilobytes".
|
|
All OSs: |
|
|
These settings are typically configured at the tenant level in Admin settings > File shadowing. |
|
Key name |
Description |
Example value |
Agent default value |
|---|---|---|---|
mime_enable
|
Enables file MIME type identification. |
|
All OSs: |
mime_cache_size
|
Defines the maximum number of files that can be stored in the in-memory cache to improve MIME type identification performance. |
|
All OSs: |
|
After configuring file MIME type identification settings, the Agent must be restarted for the change to take effect. |
|
Key name |
Description |
Example value |
Agent default value |
|---|---|---|---|
cpu_lite_performance_
|
Defines the CPU percentage that, when exceeded by the Agent, automatically generates a standard performance report. |
|
All OSs: |
cpu_performance_diagnostic_
|
Defines the CPU percentage that, when exceeded by the Agent, automatically generates an advanced performance report. |
|
All OSs: |
memory_lite_performance_
|
Defines the memory usage percentage that, when exceeded by the Agent, automatically generates a standard performance report. |
|
All OSs: |
memory_performance_
|
Defines the memory usage percentage that, when exceeded by the Agent, automatically generates an advanced performance report. |
|
All OSs: |
|
Key name |
Description |
Example value |
Agent default value |
|---|---|---|---|
usb_blocking_file_size_max
|
Defines the maximum size of a file that can be blocked from being transferred to a USB storage device when a policy is violated. Files larger than the specified size will not be blocked even if the transfer is deemed unauthorized. A size value is a number followed by a unit suffix, with our without a space between them. Valid units are "B", "KB", "MB", "GB", "TB", "PB", and "EB". You can also use the long format of units, such as "kilobyte" or "kilobytes". A value of |
|
|
|
Key name |
Description |
Example value |
Agent default value |
|---|---|---|---|
tamper_process_protection_
|
For use only under the direction of Fortinet Support: Prevents tampering of Agent processes. |
|
|
tamper_verbose_logging_
|
For use only under the direction of Fortinet Support: Enables verbose debug logging when tamper protection is turned on. |
|
|
tamper_verbose_logging_all_
|
For use only under the direction of Fortinet Support: Enables an extended version of verbose debug logging when tamper protection is turned on. |
|
|
tamper_verbose_logging_
|
For use only under the direction of Fortinet Support: Specifies a comma-separated list of canonical file paths for executables verbose debug logging should be enabled for. |
|
|