When processing a file containing a macro, you can configure the Deep CRD engine to either remove the macro or keep it while sanitizing the other active objects.
Please follow the below steps to whitelist a specific macro.
Enable “INCLUDE PROCESSED OBJECTS” in Deep CDR Setting
Process the file containing the Macro that you want to whitelist and check the JSON scan result. You should see the object_details and object_sha256 as in the example below:
Go back to Deep CDR Setting, under “PROCESS MACRO” select “Skip whitelisted macro” for the file type you sanitized, input the object_sha256 value into the “MACRO HASHES” field.
You can process the file again to test that your setup is working correctly. The Macro now should be skipped.
Supported file type: Microsoft Office