Content disarm and reconstruction

In this example, a Microsoft Office document with an embedded hyperlink (that redirects to an external website) is sent to the receiver. When the user receives the file, the hyperlink in the document is deactivated. See Content disarm and reconstruction for more information.

To configure CDR:

1. Go to Security Profiles > AntiVirus.
2. Edit an antivirus profile, or create a new one.
3. Under APT Protection Options, enable Content Disarm and Reconstruction.

   

4. Select a quarantine location from the available options:

   FortiSandbox	Saves the original document file to a connected FortiSandbox.
   File Quarantine	Saves the original document file to disk (if possible) or a connected FortiAnalyzer based on the FortiGate log settings (config log fortianalyzer setting).
   Discard	The default setting, which discards the original document file.

5. Click OK.

To edit the CDR detection parameters:

By default, stripping of all active Microsoft Office and PDF content types are enabled. In this example, stripping macros in Microsoft Office documents will be disabled.

config antivirus profile 
    edit av
        config content-disarm
            set office-macro disable
            set detect-only {enable | disable}
            set cover-page {enable | disable}
        end
    next
end

Where:

detect-only	Only detect disarmable files, do not alter content. Disabled by default.
cover-page	Attach a cover page to the file's content when the file has been processed by CDR. Enabled by default.