prescan-config
Large files are typically archive files that contain multiple embedded files. Configure the maximum file size supported by FortiSandbox using the filesize-limit command.
In a cluster environment, use this command only in the primary node and the setting is synchronized to other nodes.
We recommend to only specifying one option each time.
Syntax
prescan-config [-h|-l|-c|-n|-b|-y|-z|-a|-u]
|
Option |
Description |
|---|---|
|
-a |
Set size limit (<100M) of the archive file that will be scanned with the executable file in VM (default 5M) When scanning executable child files within a ZIP archive, the parent archive may also be required because the executable files can reference other files inside the archive. FortiSandbox can send the parent ZIP file to the VM together with the executable child file during dynamic analysis. For performance reasons, the default maximum size of the parent archive that can be sent to the VM is 5 MB. This value can be increased up to 100 MB if required.
|
|
-b |
Set big file (>512MB) unpack timeout in seconds (default = 600, max = 86400). |
|
-c |
Set maximum number of child files to extract from archive file (default = 1000). |
|
-h |
Help information. |
|
-l |
Show prescan configuration settings. |
|
-n |
Set regular file (<=512MB) unpack timeout in seconds (default = 15, max = 3600). |
|
-u |
Unset all prescan settings, that is, set to default. |
|
-y |
Set regular file (<=512M) yara scan timeout in seconds (default = 30, max 3600) |
|
-z |
Set big file (>512M) yara scan timeout in seconds (default = 60, max = 3600) |
The unpack timeout and number of child files can be increased to improve threat detection. For more information, see Enhancing Threat Detection in the FortiSandbox Best Practices Guide.