You can use the IP address of the FortiSandbox you configured to add it to FortiAnalyzer with Device Manager.
If using ADOMs, ensure that you are in the correct ADOM.
- In FortiAnalyzer, go to Device Manager.
- Click Add Device to enter the FortiSandbox information in the dialog box.
IP Address Type the IP address for the FortiSandbox device. SN Type the serial number for the FortiSandbox device. Device Name Type a name for the FortiSandbox device. Device Model Select the model of the FortiSandbox device. Firmware Version Select the firmware version of the FortiSandbox device. Description Type a description of the FortiSandbox device (optional).
- Click Next.
The device is added to the ADOM and, if successful, is ready to begin sending logs to the FortiAnalyzer unit.
- Click Finish.
- In the Device Manager, select the FortiSandbox you added, and click Edit in the toolbar.
- Enter the Admin User and Password to allow FortiAnalyzer to access the FortiSandbox, then click OK.
- Go to SOC > FortiView > Threats > FortiSandbox Detection to view the files scanned by FortiSandbox.
- Click a file to view the Drilldown Panel.
- Click the FortiSandbox Scan link to view the Sandbox Execution Details panel.