file signature

If you have hash values of some known virus-infected files, you can use this command to configure custom file signatures and then, in the antivirus profile, enable the actions against these files.

Syntax

config file signature

edit <signature_name>

[set comments "<comment_str>"]

set source {local | remote}

set threat-feed <feed_name>

set type {sha1 | sha256}

config item

edit <hash_str>

next

set status {enable | disable}

next

end

Variable	Description	Default
<signature_name>	Enter the file signature ID.
comments "<comment_str>"	Enter a comment or description.
<hash_str>	Enter the file signature hash. Use hexadecimal characters only. Valid length varies by type {sha1 | sha256}. This setting is available only if source {local | remote} is local.
source {local | remote}	Select where the file signatures are defined, either: local: On the FortiMail unit. Also configure type {sha1 | sha256}. remote: In a threat feed on a web server. Also configure threat-feed <feed_name>.	local
status {enable | disable}	Enable or disable the custom file signature.	enable
threat-feed <feed_name>	Enter the name of a threat feed that contains a list of hash values. This setting is available only if source {local | remote} is remote.
type {sha1 | sha256}	Select the type of hash to use as the file signature. This setting is available only if source {local | remote} is local.	sha1

Related topics

profile antivirus

system threat-feed