FortiClient XML Tweaking!

[Alex_l]

Hello all! Few days ago I decided to look in FortiClient-5.4.1-XML-Reference.pdf and found there some option that help to make AV virus scans and detection more complex and fast. I testet that options in autonomous mode only. So, what must you do: go to the FortiClient system setting, export configuration, open it in Notepad, modify some setting and put it back via Restore option. Here we will reconfigure <antivirus> option. *** - I place the comments at those options, what need to replace. Other options are in default state, but recheck them too for shure. Configuration takes from FC 5.4.1 version. <antivirus>         <enabled>1</enabled>         <signature_expired_notification>1</signature_expired_notification>***Place to 1***         <scan_on_insertion>1</scan_on_insertion>***Place to 1***         <shell_integration>1</shell_integration>         <antirootkit>4294967295</antirootkit>         <fortiguard_analytics>1</fortiguard_analytics>***Place to 1***         <multi_process_limit>0</multi_process_limit>***Place to 0. That make AV engine to run multiple processes at multi core CPU. Rise global scan speed very high at fast SSD disks.***         <scheduled_scans>             <ignore_3rd_party_av_conflicts>0</ignore_3rd_party_av_conflicts>             <!--zero, one or more of the following child nodes-->             <full>                 <enabled>1</enabled>                 <repeat>1</repeat>                 <days>4</days>                 <time>03:00</time>                 <removable_media>1</removable_media>***Place to 1***                 <network_drives>0</network_drives>                 <priority>2</priority>***Place to 2 for rise scan priority***             </full>         </scheduled_scans>         <on_demand_scanning>             <use_extreme_db>1</use_extreme_db>***Place to 1***             <on_virus_found>4</on_virus_found>***Place to 4***             <pause_on_battery_power>0</pause_on_battery_power>***Place to 1 for notebooks***             <signature_load_memory_threshold>80</signature_load_memory_threshold>***Default is 8. I do not really understand what that option do, but that something signature cache. As modern PC have 4gb and more RAM, cache could to make more high. Hope someone of DEV comment that option and what need to do with it at modern PC – rise or fall??? ***             <automatic_virus_submission>                 <enabled>1</enabled>***Place to 1 for auto send viruses examples to FortiGuard. At tested PC that option not worked – seed to send manual. DEV, help!***                 <smtp_server>fortinetvirussubmit.com</smtp_server>                 <username>Enc 483904fb145248364061793dad3ebf438325f29a7b4cef5c</username>                 <password>Enc 5f80dbf5aeffe8f2c11db3d31b601f4d153c0c61053fc749</password>             </automatic_virus_submission>             <compressed_files>                 <scan>1</scan>                 <maxsize>0</maxsize>***Place to 0***             </compressed_files>             <riskware>                 <enabled>1</enabled>             </riskware>             <adware>                 <enabled>1</enabled>             </adware>             <heuristic_scanning>                 <level>4</level>***Place to 4***                 <action>2</action>***Place to 2***             </heuristic_scanning>             <scan_file_types>                 <all_files>1</all_files>                 <file_types>                     <extensions>.386,.ACE,.ACM,.ACV,.ACX,.ADT,.APP,.ASD,.ASP,.ASX,.AVB,.AX,.AX2,.BAT,.BIN,.BTM,.CDR,.CFM,.CHM,.CLA,.CLASS,.CMD,.CNN,.COM,.CPL,.CPT,.CPY,.CSC,.CSH,.CSS,.DEV,.DLL,.DOC,.DOT,.DRV,.DVB,.DWG,.EML,.EXE,.FON,.GMS,.GVB,.HLP,.HTA,.HTM,.HTML,.HTT,.HTW,.HTX,.HXS,.INF,.INI,.JPG,.JS,.JTD,.KSE,.LGP,.LIB,.LNK,.MDB,.MHT,.MHTM,.MHTML,.MOD,.MPD,.MPP,.MPT,.MRC,.OCX,.PIF,.PL,.PLG,.PM,.PNF,.PNP,.POT,.PPA,.PPS,.PPT,.PRC,.PWZ,.QLB,.QPW,.REG,.RTF,.SBF,.SCR,.SCT,.SH,.SHB,.SHS,.SHT,.SHTML,.SHW,.SIS,.SMM,.SWF,.SYS,.TD0,.TLB,.TSK,.TSP,.TT6,.VBA,.VBE,.VBS,.VBX,.VOM,.VSD,.VSS,.VST,.VWP,.VXD,.VXE,.WBK,.WBT,.WIZ,.WK,.WML,.WPC,.WPD,.WSC,.WSF,.WSH,.XLS,.XML,.XTP</extensions>                     <include_files_with_no_extension>1</include_files_with_no_extension>***Place to 1. Default is not scan files without extensions – very strange!***                 </file_types>             </scan_file_types>             <exclusions>                 <!--the element below can exist 0-n times-->                 <file />                 <!--the element below can exist 0-n times-->                 <folder />                 <file_types>                     <extensions />                 </file_types>             </exclusions>         </on_demand_scanning>         <real_time_protection>             <enabled>1</enabled>             <use_extreme_db>1</use_extreme_db>>***Place to 1 for use extreme virus database for real-time scans. Default that option is off.***             <when>0</when>***Place 0 for test files at open and close procedure***             <ignore_system_when>0</ignore_system_when>***Place 0 for test files at open and close procedure***             <on_virus_found>4</on_virus_found>***Place 4 for quarantine virus***             <popup_alerts>1</popup_alerts>             <popup_registry_alerts>1</popup_registry_alerts>***Place 1 for show startup options modification***             <bypass_java>0</bypass_java>             <cloud_based_detection>                 <on_virus_found>4</on_virus_found>             </cloud_based_detection>             <compressed_files>                 <scan>1</scan>                 <maxsize>0</maxsize>***Place 0***             </compressed_files>             <riskware>                 <enabled>1</enabled>             </riskware>             <adware>                 <enabled>1</enabled>             </adware>             <heuristic_scanning>                 <level>4</level>***Place 4***                 <action>1</action>***Place 1***             </heuristic_scanning>             <scan_file_types>                 <all_files>0</all_files>                 <file_types>                     <extensions>.386,.ACE,.ACM,.ACV,.ACX,.ADT,.APP,.ASD,.ASP,.ASX,.AVB,.AX,.AX2,.BAT,.BIN,.BTM,.CDR,.CFM,.CHM,.CLA,.CLASS,.CMD,.CNN,.COM,.CPL,.CPT,.CPY,.CSC,.CSH,.CSS,.DEV,.DLL,.DOC,.DOT,.DRV,.DVB,.DWG,.EML,.EXE,.FON,.GMS,.GVB,.HLP,.HTA,.HTM,.HTML,.HTT,.HTW,.HTX,.HXS,.INF,.INI,.JPG,.JS,.JTD,.KSE,.LGP,.LIB,.LNK,.MDB,.MHT,.MHTM,.MHTML,.MOD,.MPD,.MPP,.MPT,.MRC,.OCX,.PIF,.PL,.PLG,.PM,.PNF,.PNP,.POT,.PPA,.PPS,.PPT,.PRC,.PWZ,.QLB,.QPW,.REG,.RTF,.SBF,.SCR,.SCT,.SH,.SHB,.SHS,.SHT,.SHTML,.SHW,.SIS,.SMM,.SWF,.SYS,.TD0,.TLB,.TSK,.TSP,.TT6,.VBA,.VBE,.VBS,.VBX,.VOM,.VSD,.VSS,.VST,.VWP,.VXD,.VXE,.WBK,.WBT,.WIZ,.WK,.WML,.WPC,.WPD,.WSC,.WSF,.WSH,.XLS,.XML,.XTP</extensions>                     <include_files_with_no_extension>1</include_files_with_no_extension>***Place to 1. Default is not scan files without extensions – very strange!***                 </file_types>             </scan_file_types>             <exclusions>                 <!--the element below can exist 0-n times-->                 <file />                 <!--the element below can exist 0-n times-->                 <folder />                 <file_types>                     <extensions>.zip,.gzip,.msc,.rar,.tar,.tgz,.lzh,.CAB,.BZIP2,.7Z,.BZIP,.ARJ</extensions>                 </file_types>             </exclusions>             <sandboxing>***I have no sandbox, so here all a defaults***                 <enabled>0</enabled>                 <sandbox_address />                 <timeout>0</timeout>                 <use_sandbox_signatures>0</use_sandbox_signatures>                 <check_for_signatures_every>5</check_for_signatures_every>                 <action_on_error>0</action_on_error>                 <scan_usb>0</scan_usb>                 <scan_mapped_drives>0</scan_mapped_drives>             </sandboxing>         </real_time_protection>         <email>***That parameters scan emails and post protocols. Place 1 everywhere to make AV on state.***             <smtp>1</smtp>             <pop3>1</pop3>             <outlook>1</outlook>             <wormdetection>                 <enabled>1</enabled>                 <action>1</action>             </wormdetection>             <heuristic_scanning>                 <enabled>1</enabled>                 <action>1</action>             </heuristic_scanning>             <mime_scanning>                 <enabled>1</enabled>             </mime_scanning>         </email>         <quarantine>             <cullage>365</cullage>***Place to 356 if you want to save quarantine samples whole year***         </quarantine> <server>***If you use Exchange or SQL servers at MS Windows, you can modify that option. As I have not – all default***             <exchange>                 <integrate>0</integrate>                 <action>0</action>                 <excludefilesystemfromscanning>0</excludefilesystemfromscanning>                 <excludefileextensionsfromscanning>0</excludefileextensionsfromscanning>             </exchange>             <sqlserver>                 <excludefilesystemfromscanning>0</excludefilesystemfromscanning>                 <excludefileextensionsfromscanning>0</excludefileextensionsfromscanning>             </sqlserver>         </server>

[Alex_l]

And some about Updates policy:

 <update>             <use_custom_server>0</use_custom_server>             <server />             <port>80</port>             <timeout>60</timeout>             <failoverport />             <fail_over_to_fdn>1</fail_over_to_fdn>             <auto_patch>1</auto_patch>***Place 1 for auto update FC version***             <!-- update_action applies to software updates only and can be one of: notify_only, download_and_install, download_only, disable -->             <update_action>download_and_install</update_action>               <scheduled_update>                 <enabled>1</enabled>                 <type>interval</type>                 <daily_at>01:00</daily_at>                 <update_interval_in_hours>2</update_interval_in_hours>***AV updates checking period in hours. Minimum 1 hour***               </scheduled_update>   </update>

[Alex_l]

Very interesting information for all! FortiClient became just wonderful decision beginning from 5.4.1. Vendor integrated there it's IPS system with the whole bundle of IPS signatures, tuned to application basis!!! That is just great! It information unfortunately not comes to release notes. I know it from TAC directly!

[Alex_l]

If you need ready config, use my exported and tested configuration. Only it localized at Russian.

!

[link]http://f.usht.ru/Forti/Tuned-configuration.conf[/link]

[Alby23]

Alexey_L wrote:

Very interesting information for all! FortiClient became just wonderful decision beginning from 5.4.1. Vendor integrated there it's IPS system with the whole bundle of IPS signatures, tuned to application basis!!! That is just great! It information unfortunately not comes to release notes. I know it from TAC directly!

Uhm... I'm looking at my signatures but I don't see reference related to IPS.

[Alex_l]

They are higgen and taken from FortiGuard. Forit have a lot of undocumented feature and add-on.

[Alex_l]

Add ready conf file. Rename in .conf