FortiGate Version 3.0 MR4 Administration Guide
342 01-30004-0203-20070102
Quarantine AntiVirus
Viewing the AutoSubmit list
Configure the FortiGate unit to upload suspicious files automatically to Fortinet for
analysis. Add file patterns to the AutoSubmit list using wildcard characters (* or ?).
File patterns are applied for AutoSubmit regardless of file blocking settings.
Upload files to Fortinet based on status (blocked or heuristics), or submit
individual files directly from the quarantined files list. The FortiGate unit uses
encrypted email to autosubmit files to an SMTP server through port 25.
This option is only available on FortiGate units with a local disk.
To view the AutoSubmit list, go to AntiVirus > Quarantine > AutoSubmit.
Figure 223:Sample AutoSubmit list
AutoSubmit list has the following icons and features:
Service The service from which the file was quarantined (HTTP, FTP, IMAP,
POP3, SMTP, IM).
Status The reason the file was quarantined: infected, heuristics, or blocked.
Status
Description
Specific information related to the status, for example, “File is infected
with “W32/Klez.h”” or “File was stopped by file block pattern.”
DC Duplicate count. A count of how many duplicates of the same file were
quarantined. A rapidly increasing number can indicate a virus outbreak.
TTL Time to live in the format hh:mm. When the TTL elapses, the FortiGate
unit labels the file as EXP under the TTL heading. In the case of
duplicate files, each duplicate found refreshes the TTL.
The TTL information is not available if the files are quarantined on a
FortiAnalyzer unit.
Upload status Y indicates the file has been uploaded to Fortinet for analysis, N
indicates the file has not been uploaded.
Delete icon Select to remove the file from the list.
Download icon Select to download the corresponding file in its original format.
Submit icon Select to upload a suspicious file to Fortinet for analysis.
Note: Duplicates of files (based on the checksum) are not stored, only counted. The TTL
value and the duplicate count are updated each time a duplicate of a file is found.
Create New Select to add a new file pattern to the AutoSubmit list.
File Pattern The current list of file patterns that will be automatically uploaded.
Create a pattern by using ? or * wildcard characters. Enable the
check box to enable all file patterns in the list.
Delete icon Select to remove the entry from the list.
Edit icon Select to edit the following information: File Patter and Enable.
To Next Page
Loading...
Need help?
General