Whitelist Macros
When processing a file containing a macro, you can configure the Deep CRD engine to either remove the macro or keep it while sanitizing the other active objects.
Please follow the below steps to whitelist a specific macro.
-
Enable “INCLUDE PROCESSED OBJECTS” in Deep CDR Setting

-
Process the file containing the Macro that you want to whitelist and check the JSON scan result. You should see the object_details and object_sha256 as in the example below:

-
Go back to Deep CDR Setting, under “PROCESS MACRO” select “Skip whitelisted macro” for the file type you sanitized, input the object_sha256 value into the “MACRO HASHES” field.

-
You can process the file again to test that your setup is working correctly. The Macro now should be skipped.

Supported file type: Microsoft Office