Questions regarding antivirus profile ?

[usmansa1]

Hi, 

I was reading the FortiGate antivirus topic from Fortinet website. Also I tested them in my test environment by downloading the file from ecior.org. What I found, until or unless you don't use SSL/SSH decryption profile, this antivirus profile is  helpless which means that unless or until we don't do the SSL decryption the encrypted files cant be scanned. Is this correct assumption ? Moreover, can any one please help me to point in right direction that where can I find more information about CPRL ?

[akileshc]

Hello, 

Yes, your understanding is correct. In order for the FortiGate antivirus profile to scan encrypted files, SSL/SSH decryption must be enabled to decrypt the traffic for inspection. Without decryption, the antivirus profile cannot scan encrypted files for viruses and malware.

You can access the FortiOS documents to understand the requirement and test cases:

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/315155/testing-an-antivirus-... 

 https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/122078/deep-inspection

[usmansa1]

hey mate, what about CPRL ?

[akileshc]

Hi Usman,

The FortiGuard Antivirus Service uses Content Pattern Recognition Language (CPRL) to boost both the accuracy and speed of threat detection, going beyond what traditional signature-based methods can offer, especially for more sophisticated threats. Deep inspection is necessary for CPRL to thoroughly analyze encrypted and application-layer traffic.

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/610527/antivirus-techniques