Technical Tip: How to deliver disarmed copy by CDR to Original host and unmodified copy to system quarantine for analysis

mattia1 · ‎07-05-2023

Description

This article describes how to configure Fortimail to deliver a disarmed copy by CDR to the Original host and an unmodified copy to system quarantine for analysis.

Scope

FortiMail.

Solution

From the GUI, Navigate to Profile -> Content -> Action -> Create new Content Action Profile.

2. Navigate to System -> Mail Setting -> Preference -> Edit the values.

3. Navigate to Profile -> Content -> Create New -> Content Disarm and Reconstruction.

Content Disarm and Reconstruction.PNG

4. Navigate to Policy > Recipient Policy > Create New.

Recipinet Policy.PNG

5. Navigate to Security -> Disarm & Reconstruction -> Attachment.

Disarm & Reconstruction.PNG

Result:

FortiMail will send a Modified copy (Disarmed) to the original host and an unmodified copy to system quarantine.

Result 2.PNG