Fortigate DLP file filtering and more examples

config dlp filepattern
    edit 4
        set name "blockMP3"
        config entries
            edit "MP3"
                set filter-type type
                set file-type mp3
            next
        end
    next
end

config dlp sensor
    edit "MP3block"
        config filter
            edit 1
                set proto http-get http-post ftp
                set filter-by file-type
                set file-type 4
                set action block
            next
        end
    next
end

config firewall policy
    edit 138
        set srcintf "Dialup3"
        set dstintf "VDOM_EXT"
        set action accept
        set srcaddr "all"
        set dstaddr "all"
        set schedule "always"
        set service "ALL"
        set utm-status enable
        set ssl-ssh-profile "deep-inspection"
        set dlp-sensor "MP3block"
        set logtraffic all
        set nat enable
    next
end

config file-filter profile
    edit "MP3block"
        config rules
            edit "MP3typeblock"
                set protocol http ftp smtp
                set action block
                set file-type "mp3"
            next
        end
    next
end

config firewall policy
    edit 9
        set uuid 6d0debbe-1755-51ef-ca7d-d938a76591a0
        set srcintf "Peer1P1"
        set dstintf "NV5000-EXT"
        set action accept
        set srcaddr "Peer1pool"
        set dstaddr "all"
        set schedule "always"
        set service "ALL"
        set utm-status enable
        set inspection-mode proxy
        set ssl-ssh-profile "deep-inspection"
        set dlp-profile "BlockSSNCCprofile"
        set file-filter-profile "MP3block"
        set logtraffic all
        set nat enable
        set users "yurisk1"
    next
end

config dlp data-type
    edit "g-credit-card"
        set pattern "\\b([2-6]{1}\\d{3})[- ]?(\\d{4})[- ]?(\\d{2})[- ]?(\\d{2})[- ]?(\\d{2,4})\\b"
        set verify "built-in"
        set look-back 20
        set transform "\\b\\1[- ]?\\2[- ]?\\3[- ]?\\4[- ]?\\5\\b"
    next
    edit "g-hex"
        set pattern "built-in"
    next
    edit "g-keyword"
        set pattern "built-in"
    next
    edit "g-mip-label"
        set pattern "^[[:xdigit:]]{8}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{12}$"
        set transform "built-in"
    next
    edit "g-regex"
        set pattern "built-in"
    next
    edit "g-ssn-us"
        set pattern "\\b(\\d{3})-(\\d{2})-(\\d{4})\\b"
        set verify "(?<!-)\\b(?!666|000|9\\d{2})\\d{3}-(?!00)\\d{2}-(?!0{4})\\d{4}\\b(?!-)"
        set look-back 12
        set transform "\\b\\1-\\2-\\3\\b"
    next
end

config dlp dictionary
    edit "SSNCCdict"
        config entries
            edit 1
                set type "g-credit-card" <-- BUILT-INs SEE ABOVE
            next
            edit 2
                set type "g-ssn-us"
            next
        end
    next
end

config dlp sensor
    edit "blockSSNCC"
    set match-type match-any  <-- THIS DEFAULT SO WILL NOT APPEAR
        config entries
            edit 1
                set dictionary "SSNCCdict"
                set count 1    <-- DEFAULT SO WILL NOT APPEAR
            next
        end
    next
end

config dlp profile
(profile) $ edit BlockSSNCCprofile
new entry 'BlockSSNCCprofile' added

(BlockSSNCCprofile) $ set
comment               Comment.
feature-set           Flow/proxy feature set.
replacemsg-group      Replacement message group used by this DLP profile.
dlp-log               Enable/disable DLP logging.
extended-log          Enable/disable extended logging for data leak prevention.
nac-quar-log          Enable/disable NAC quarantine logging.
full-archive-proto    Protocols to always content archive.
summary-proto         Protocols to always log summary.


(BlockSSNCCprofile) $ config rule

(rule) $ edit 0
new entry '0' added

(0) $ set
name         Filter name.
severity     Select the severity or threat level that matches this filter.
type         Select whether to check the content of messages (an email message)
 or files (downloaded files or email attachments).
proto        Check messages or files over one or more of these protocols.
filter-by    Select the type of content to match.
file-size    Match files this size or larger (0 - 4294967295 kbytes).
file-type    Select the number of a DLP file pattern table to match.
action       Action to take with content that this DLP profile matches.

 (0) $ set action
allow            Allow the content to pass through the FortiGate and do
not create a log message.
log-only         Allow the content to pass through the FortiGate, but write
a log message.
block            Block the content and write a log message.
quarantine-ip    Quarantine all traffic from the IP address and write a log message.

(0) $ set action block
(0) $ set type file   // OR message FOR EMAILS


(0) $ set filter-by
sensor       Use DLP sensors to match content.
encrypted    Look for encrypted files.
none         No content scan.

(0) $ set filter-by sensor
(0) $ set sensor "blockSSNCC"

config dlp profile
    edit "BlockSSNCCprofile"
        config rule
            edit 1
                set proto http-get http-post ftp
                set filter-by sensor
                set sensor "blockSSNCC"
                set action block
            next
        end
    next
end

config firewall policy
    edit 9
        set srcintf "Peer1P1"
        set dstintf "VMVDOM-EXT"
        set action accept
        set srcaddr "Peer1pool"
        set dstaddr "all"
        set schedule "always"
        set service "ALL"
        set utm-status enable
        set ssl-ssh-profile "deep-inspection"
        set dlp-profile "BlockSSNCCprofile"
        set logtraffic all
        set nat enable
        set users "yurisk1"
    next
end