Configuring file signatures

If you have the SHA-1or SHA-256 (Secure Hash Algorithm) hash values of some known virus-infected files, then you can add these values as file signatures and select the action to apply in the antivirus profile (see Configuring antivirus profiles).

Some file types do not contain viruses, so FortiMail file signature check only supports these attachment file types:

.7z .bat .cab .dll .doc .docm .docx .dotm .exe .gz .hta .inf .jar .js .jse .msi .msp .pdf .pif .potm .ppam

.ppsm .ppt .pptm .pptx .reg .scr .sldm .swf .tar .vbe .ws .wsc .wsf .wsh .xlam .xls .xlsm .xlsx .xltm .z .zip

File signatures can be added either individually, or batch imported via a threat feed, a list of checksums in CSV (comma-separated values), or a plain text file. File signatures also can be exported as a CSV file.

To add a new file signature manually or via threat feed

1. Go to Profile > AntiVirus > File Signature.

2. Click New.

3. Configure the following:

   GUI item	Description
   Status	Enable or disable the profile.
   Name	Enter a unique name for the profile.
   Comment	Enter a comment or description.
   Source	Select where the file signatures are stored, either: Local — On the FortiMail unit. Remote — A threat feed on an external server.

4. If Source is Local, then configure the following:

   GUI item	Description
   Type	Select either: SHA-1 SHA-256
   File Signature List	Click New. Enter the checksum value for a file, and then click OK. Repeat this step until you have entered all of the checksums.

   Else if Source is Remote, then configure the following:

   GUI item	Description
   Threat feed	Select a threat feed that contains file signatures. (Its Resource type is Malware Hash.) See also Configuring a threat feed.

5. Click Create.

To import a signature list in CSV format

1. Go to Profile > AntiVirus > File Signature.

2. Click to select a profile.

3. Click Import.

4. Browse to the CSV file and click OK.

   The CSV file must contain SHA-1 or SHA-256 hash values, one per line.

To export file signatures in CSV format

1. Go to Profile > AntiVirus > File Signature.

2. Click to select a profile.

3. Click Export.

   Depending on your browser settings, your browser may prompt you for a file name and location before downloading the CSV file.