Content disarm and reconstruction

In this example, a Microsoft Office document, such as a Microsoft OneNote file, with an embedded hyperlink (that redirects to an external website) is sent to the receiver. When the user receives the file, the hyperlink in the document is deactivated. See Content disarm and reconstruction for more information.

To configure CDR:

1. Go to Security Profiles > AntiVirus.
2. Edit an antivirus profile, or create a new one.
3. Set Feature set to Proxy-based.
4. Under Inspected Protocols, enable one or more protocols to inspect.
5. Enable AntiVirus scan.
6. Under APT Protection Options, enable Content Disarm and Reconstruction.

   

7. Enable Retain original file after CDR, and select a quarantine location from the available options:

   Quarantine locally	Saves the original document file to disk (if possible) or a connected FortiAnalyzer based on the FortiGate log settings (config log fortianalyzer setting).
   Send to FortiSandbox	Saves the original document file to a connected FortiSandbox.

   When Retain original file after CDR is disabled, the original document file is discarded.

8. Click OK.

9. Go to Log & Report > Security Events to view CDR events in Antivirus logs.

   In the following example, an AntiVirus log file includes a CDR event for an embedded hyperlink in an RTF file.

   

To edit the CDR detection parameters:

By default, stripping of all active Microsoft Office and PDF content types are enabled. In this example, stripping macros in Microsoft Office documents will be disabled.

config antivirus profile 
    edit av
        config content-disarm
            set office-macro disable
            set detect-only {enable | disable}
            set cover-page {enable | disable}
        end
    next
end

Where:

detect-only	Only detect disarmable files, do not alter content. Disabled by default.
cover-page	Attach a cover page to the file's content when the file has been processed by CDR. Enabled by default.