Fortinet FortiGate Series Administration Manual page 598

DLP Rules
598
Scan PDF file whole
Rule
Always
Attachment size
Attachment type
Authenticated User
Binary file pattern
Body
CGI parameters
Cookie
File is/not encrypted
File text
File type
Hostname
HTTP header
Receiver
Sender
Server
Subject
Transfer size
URL
User group
Rule operators:
When selected, PDF files are scanned. All binary and metadata
information is included.
If you are scanning for text in PDF files, use the Scan PDF Text
option. Binary formatting codes and file information may appear within
the text, causing text matches to fail.
Use the Rule settings to configure the content that the DLP rule
matches.
Match any content.
This option is available for all protocols.
Check the attachment file size.
This option is available for Email.
Search email messages for file types or file patterns as specified in the
selected file filter.
This option is available for Email.
Search for traffic from the specified authenticated user.
Search for the specified binary string in network traffic.
Search for the specified string in the message or page body.
This option is available for Email, HTTP, and NNTP.
Search for the specified CGI parameters in any web page with CGI
code.
This option is available for HTTP.
Search the contents of cookies for the specified text.
This option is available for HTTP.
Check whether the file is or is not encrypted. Encrypted files are
archives and MS Word files protected with passwords. Because they
are password protected, the FortiGate unit cannot scan the contents
of encrypted files.
Search for the specified text in transferred text files.
This option is available in FTP, IM, and NNTP.
Search for the specified file patterns and file types. The patterns and
types configured in file filter lists and a list is selected in the DLP rule.
For more information about file filter lists, see
This option is available for FTP, HTTP, IM, and NNTP.
Search for the specified host name when contacting a HTTP server.
Search for the specified string in HTTP headers.
Search for the specified string in the message recipient email address.
This option is available for Email.
Search for the specified string in the message sender user ID or email
address. This option is available for Email and IM.
For email, the sender is determined by the From: address in the email
header. For IM, all members of an IM session are senders and the
senders are determined by finding the IM user IDs in the session.
Search for the server's IP address in a specified address range.
This option is available for FTP, NNTP.
Search for the specified string in the message subject.
This option is available for Email.
Check the total size of the information transfer. In the case of email
traffic for example, the transfer size includes the message header,
body, and any encoded attachment.
Search for the specified URL in HTTP traffic.
Search for traffic from any user in the specified user group.
FortiGate Version 4.0 MR1 Administration Guide
Data Leak Prevention
"File Filter" on page
01-410-89802-20090903
http://docs.fortinet.com/ • Feedback
521.