Malware and URL Package Options
The malware package options and URL package options allow you to configure how many days worth of data the malware and URL packages save and the malware ratings that are included in the packages.
In a cluster environment, only the primary node generates malware packages and URL packages.
You can also select to include files or URLs to packages during an On-Demand scan if their results meet package settings.
Because of size limitations, the following limits are in effect:
- Malware packages can have a maximum of 100K entries.
- URL package can have a maximum of 1000 entries.
The URL package contains downloaded URLs of detected malware.
|
Local Malware Package Options |
||
|
Include past __ day(s) of data. (1-365 days) |
Enter the number of days. If the user changes the current days to a longer value, the unit will not go back to include historical data older than current days. |
|
|
Include the job data of the following ratings |
|
|
|
|
Malicious |
Include malware with malicious ratings. By default, only data with Malicious or High Risk rating will be included in the Malware Package. |
|
|
High Risk |
Include malware with high risk ratings and URLs sent by FortiMail devices of high risk ratings and whose scan depth is 0. |
|
|
Medium Risk |
Include malware with medium risk ratings and URLs sent by FortiMail devices of medium risk ratings and whose scan depth is 0. |
|
Local URL Package Option |
||
|
Include past __ day(s) of data. (1-365 days) |
Enter the number of days. If the user changes current days to a longer value, the unit will not go back to include historical data older than current days. |
|
|
Include the job data of the following ratings |
|
|
|
|
Malicious |
Include downloaded URLs of malware with malicious ratings. By default, only downloaded URLs of malware with a Malicious or High Risk rating will be included in the URL Package. |
|
|
High Risk |
Include downloaded URLs of malware with high risk ratings. |
|
|
Medium Risk |
Include downloaded URLs of malware with medium risk ratings. |
|
Enable STIX IOC |
Enable to generate STIX IOC packages. |
|
|
STIX Malware Package Options |
||
|
Include past __ day(s) of data. (1-365 days) |
Enter the number of days. |
|
|
Include the job data of the following ratings |
|
|
|
|
Malicious |
Include malware with malicious ratings. |
|
|
High Risk |
Include malware with high risk ratings. |
|
|
Medium Risk |
Include malware with medium risk ratings. |
|
|
Generate STIX file with behavior |
Include behavior information of each malware or suspicious URL. |
|
|
Download STIX |
Download most recently generated Malware STIX IOC package. |
|
STIX URL Package Options |
||
|
Include past __ day(s) of data. (1-365 days) |
Enter the number of days. |
|
|
Include the job data of the following ratings |
|
|
|
|
Malicious |
Include malware with malicious ratings. |
|
|
High Risk |
Include downloaded URLs of malware with high risk ratings and URLs sent by FortiMail devices of high risk ratings and whose scan depth is 0. |
|
|
Medium Risk |
Include downloaded URLs of malware with medium risk ratings and URLs sent by FortiMail devices of medium risk ratings and whose scan depth is 0. |
|
|
Download STIX |
Download most recently generated URL STIX IOC package. |
|
STIX/TAXII Integration |
|
|
|
|
API Root URL |
Enter the root URL for STIX/TAXII server. |
|
|
TAXII Username |
The username to access STIX/TAXII server |
|
|
TAXII Password |
The password for the user. |
|
|
Collection ID |
The collection setup on STIX/TAXII server. |
|
Include job data of the following ratings |
|
|
|
|
Malicious |
Include malware with malicious ratings. |
|
|
High Risk |
Include high risk ratings job. |
|
|
Medium Risk |
Include medium risk job. |
|
Malicious files directly rated by AV are not sent to external threat server since they do not have STIX format. |