Viewing Sandbox event details

You can view a detailed report about a Sandbox event. EMS retrieves the report from FortiSandbox.

To view Sandbox event details:

1. Go to Endpoints, and select All Domains, a domain, or workgroup. The list of endpoints for the selected domain or workgroup displays.
2. Click an endpoint to display details about it in the content pane. Details about the endpoint display in the content pane.
3. On the Sandbox Events tab, click the magnifying glass icon beside the desired Sandbox event. EMS displays a detailed report about the Sandbox event.

   

4. Click Process Tree. For some events, you can see a graphical representation of the processes that the malware created on FortiSandbox.