> Source: [sk112240](https://support.checkpoint.com/results/sk/sk112240)

# sk112240 - How to add support for new file types in Threat Extraction

| Property | Value |
|----------|-------|
| Solution ID | sk112240 |
| Date Created | 2016-07-04 |
| Last Modified | 2021-08-11 |
| Technical Level | General |
| OS | Gaia |

## Solution

Introduction

A new feature allows a Security Gateway administrator to add support for new file types in Threat Extraction blade.

**New supported file types include:**

|---------------|---------------------------------------------------|-------------------------|
| File Type     | File Extensions                                   | Notes                   |
| Picture files | `jpeg`, `gif`, `png`, `tiff`, `bmp`               | Can be cleaned          |
| Picture files | `eps`, `psd`, `tga`, `pcx`                        | Can be converted to PDF |
| Text files    | `rtf`, `hwp` (Hancom), `jtd` (Ichitaro), and more | Can be converted to PDF |

**Notes:**

* Some files may be determined by Threat Extraction blade to be corrupted. As a result, they cannot be cleaned. By default, Threat Extraction blade would wait for Threat Emulation blade's verdict for such files. However, some of the files mentioned in this article are not supported by Threat Emulation blade. The administrator should choose whether to allow or block corrupted files.
* Instructions for blocking all corrupted files are provided below in the "*How to block all corrupted files*" section.
* Instructions for blocking only the corrupted files that cannot be emulated are provided below in the [sk115792 - Threat Extraction blade: How to block corrupted files that could not be emulated](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk115792).

### Feature availability

* Support for new file types is included in [Jumbo Hotfix Accumulator for R77.30](http://supportcontent.checkpoint.com/solutions?id=sk106162) - since ***Take_198***.

* Support for new file types is included in [Check Point R80.10](http://supportcontent.checkpoint.com/solutions?id=sk111841).

* For other R77.30 installations, [contact Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) to get the required Hotfix package that adds this feature.  
  A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
  For faster resolution and verification, please collect [CPInfo files](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) from the Security Management Server and Security Gateways involved in the case.

### How to enable support for new file types

> Note: The feature is disabled by default.
>
> 1. Connect to the command line on the Security Gateway.
> 2. Log in to the Expert mode.
> 3. Copy the *$FWDIR/conf/template_scrub_additional_file_types* file to *$FWDIR/conf/scrub_additional_file_types* :  
>    `[Expert@HostName:0]# cp -vp $FWDIR/conf/template_scrub_additional_file_types $FWDIR/conf/scrub_additional_file_types`
> 4. Copy the *$FWDIR/conf/template_scrub_fixed_file_types* file to *$FWDIR/conf/scrub_fixed_file_types* :  
>    `[Expert@HostName:0]# cp -vp $FWDIR/conf/template_scrub_fixed_file_types $FWDIR/conf/scrub_fixed_file_types`
> 5. Copy the */var/log/jail/$FWDIR/conf/template_scrub_supported_file_types* file to */var/log/jail/$FWDIR/conf/scrub_supported_file_types* :  
>    `[Expert@HostName:0]# cp -vp /var/log/jail/$FWDIR/conf/template_scrub_supported_file_types /var/log/jail/$FWDIR/conf/scrub_supported_file_types`
> 6. Install the Threat Prevention policy.
> 7. Kill the *scrub_cp_file_convertd* process:  
>    `[Expert@HostName:0]# kill -9 $(pidof scrub_cp_file_convertd)`

### To disable support for new file types

> Note: The feature is disabled by default.
>
> 1. Connect to the command line on the Security Gateway.
> 2. Log in to the Expert mode.
> 3. Remove the *$FWDIR/conf/scrub_additional_file_types* file:  
>    `[Expert@HostName:0]# rm -i $FWDIR/conf/scrub_additional_file_types`
> 4. Remove the *$FWDIR/conf/scrub_fixed_file_types* file:  
>    `[Expert@HostName:0]# rm -i $FWDIR/conf/scrub_fixed_file_types`
> 5. Remove the */var/log/jail/$FWDIR/conf/scrub_supported_file_types* file:  
>    `[Expert@HostName:0]# rm -i /var/log/jail/$FWDIR/conf/scrub_supported_file_types`
> 6. Install the Threat Prevention policy.
> 7. Kill the *scrub_cp_file_convertd* process:  
>    `[Expert@HostName:0]# kill -9 $(pidof scrub_cp_file_convertd)`

### To block all corrupted files

1. In SmartDashboard, go to the "Threat Prevention" tab and in the left tree, click on the "Policy":

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk112240/Block_Corrupted_Files_11701050131.png)
2. Double-click on the relevant Threat Prevention profile.  
   In the opened window, expand the "Threat Extraction Settings" and click on the "Advanced":

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk112240/Block_Corrupted_Files_21701050133.png)
3. In the "Threat Extraction Exceptions" section, in the "Corrupted files" field, select "Block":

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk112240/Block_Corrupted_Files_31701050135.png)
4. Click on OK to apply the changes.

5. Install the Threat Prevention policy.

### To add a new file type to Threat Extraction blade

1. Add the file extension to *scrub_additional_file_types* .  
   See [*template_scrub_additional_file_types*](https://supportcenter.checkpoint.com/supportcenter/portal/role/supportcenterUser/page/default.psml/media-type/html?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=50924) for example.  
   Note: Delete the line of the file type in the template of scrub_additional_file_types if you need to stop cleaning.
2. Add the file extension and method of extraction to *scrub_fixed_file_types* .  
   The format is:  
   `<extension (lower case)>;<method>`  
   (see [*template_scrub_fixed_file_types*](https://supportcenter.checkpoint.com/supportcenter/portal/role/supportcenterUser/page/default.psml/media-type/html?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=50925) for examples).  
   Note: Modify method "1" for cleaning, or "2" for converting to PDF in the template of template_scrub_fixed_file_types.
3. Add file ID and default extension to *scrub_supported_file_types* .  
   The format is:  
   `<file ID> <extension>`   
   (see [*template_scrub_supported_file_types*](https://supportcenter.checkpoint.com/supportcenter/portal/role/supportcenterUser/page/default.psml/media-type/html?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=50926) for examples).  
   The necessary information for all the files listed above can be found in the attached template files.
4. Connect to the command line on the Security Gateway.
5. Log in to the Expert mode.
6. Kill the *scrub_cp_file_convertd* process:  
   `[Expert@HostName:0]# kill -9 $(pidof scrub_cp_file_convertd)`
7. Install the Threat Prevention policy

**Notes:**

* If you would like to attempt adding a different file type, the procedure for finding the file ID is below. Every file type can only have one default extension!
* **Note that while many files formats will be supported, we do not guarantee support for any file type not listed in this article.**

### How to find file type ID

(First check the *template_scrub_supported_file_types*. The file type ID may already be there.)

1. Connect to the command line on the Security Gateway.
2. Log in to the Expert mode.
3. Start the debug of *scrub_cp_file_convertd* process:  
   `[Expert@HostName:0]# for PROC in $(pgrep cp_file_convert) ; do fw debug $PROC on TDERROR_ALL_ALL=5 ; done`
4. Pass a file of the type you wish to add through the Security Gateway.
5. Stop the debug:  
   `[Expert@HostName:0]# for PROC in $(pgrep cp_file_convert) ; do fw debug $PROC off TDERROR_ALL_ALL=0 ; done`
6. Analyze the */var/log/jail/$FWDIR/log/scrub_cp_file_convertd.elg\** files.  
   Search for:  
   *`scrub_handle_unsupported_files: oem file_type`*   
   The value will be an integer.  
   If the ID value is "1999" or "0", then the file can *not* be converted.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content