Whitelist Macros

When processing a file containing a macro, you can configure the Deep CRD engine to either remove the macro or keep it while sanitizing the other active objects.

Please follow the below steps to whitelist a specific macro.

  • Enable “INCLUDE PROCESSED OBJECTS” in Deep CDR Setting

images/download/attachments/8458328/image-20210109-004232.png
  • Process the file containing the Macro that you want to whitelist and check the JSON scan result. You should see the object_details and object_sha256 as in the example below:

images/download/attachments/8458328/image-20210109-004603.png
  • Go back to Deep CDR Setting, under “PROCESS MACRO” select “Skip whitelisted macro” for the file type you sanitized, input the object_sha256 value into the “MACRO HASHES” field.

images/download/attachments/8458328/image-20210109-005207.png
  • You can process the file again to test that your setup is working correctly. The Macro now should be skipped. images/download/attachments/8458328/image-20210109-005442.png

images/download/attachments/8458328/image-20210109-011239.png

Supported file type: Microsoft Office