system fortisandbox
A FortiSandbox unit can be used for automated sample tracking and analysis, also called sandboxing, of files that could contain zero-day exploits. You can send suspicious email attachments to FortiSandbox for inspection by selecting it in antivirus profiles. If the file exhibits risky behavior, or contains a virus, the result will be returned to FortiMail and a new virus signature is created and added to the FortiGuard Antivirus signature database.
Syntax
config system fortisandbox
set service-type {appliance | cloud | cloud-enhanced}
set region {Global | US | Europe | Japan}
set statistics-interval <minutes_int>
set scan-timeout <seconds_int>
set scan-result-retention <minutes_int>
config file-patterns
edit <number_index>
set pattern "<filename_pattern>"
end
end
set max-file-size-status {enable | disable}
set url-scan-category {all | default | phishing | unrated | <url-category-profile_name>}
set url-scan-on-rating-error {enable | disable}
set bypass-one-time-url {enable | disable}
set max-url-per-email <limit_int>
set scan-order {antispam-content-sandbox | antispam-sandbox-content | sandbox-antispam-content}
end
|
Variable |
Description |
Default |
|
Enter the index number of the file pattern. |
|
|
|
Enter a custom file type pattern, such as |
|
|
|
edit {adobe-flash | archive | html | jar | javascript | pdf | msoffice-document | windows-executable} |
Select a predefined attachment type. |
|
|
Enter an administrator’s email address to receive reports and notifications about FortiSandbox submissions. |
|
|
|
Enable to automatically exempt common one-time URLs, such as password reset URLs, that are in the personal or business category and are a predefined or custom filter pattern from FortiSandbox submission. |
enable |
|
|
Enter the FQDN or IP address of the FortiSandbox. This setting is available only if |
|
|
|
Enter the maximum size in kilobytes for files uploaded to FortiSandbox. |
1024 |
|
|
Enable or disable the maximum size for files uploaded to FortiSandbox. |
disable |
|
|
Maximum number of URLs per email to be scanned. If |
3 |
|
|
Select which regional data center to connect to for FortiSandbox Cloud service. This setting is applies only if |
Global |
|
|
scan-order {antispam-content-sandbox | antispam-sandbox-content | sandbox-antispam-content} |
Select the order of scans. Sending files to FortiSandbox usually takes more bandwidth and thus it is better to use is as the last resort. Content scans often take more resources than antispam scans, and are not necessary if an email is spam, and thus usually should be prioritized after antispam. |
antispam-content-sandbox |
|
Select the TTL for the scan result cache in minutes. Valid values are from 0 to 1440 (0 disables retention). |
60 |
|
|
Enter how long FortiMail will wait to get the scan results. If you receive timeouts and want to wait longer for the results, you can increase the timeout. Valid values are from 6 to 360. |
30 |
|
|
Select to use either a FortiSandbox appliance, FortiSandbox Cloud regular service, or FortiSandbox Cloud enhanced service. The enhanced cloud service provides dedicated service for faster performance. |
appliance |
|
|
Enter how frequently in minutes FortiMail will get some basic statistics from FortiSandbox. The statistics include how much malware is detected and how many files are clean. Valid values are from 0 to 30 (0 disables fetching statistics). |
5 |
|
|
Enable or disable the usage of the FortiSandbox unit. |
disable |
|
|
Enable or disable submitting the file type to FortiSandbox. |
enable |
|
|
url-scan-category {all | default | phishing | unrated | <url-category-profile_name>} |
Select which URL rating category (either predefined by FortiGuard or a custom category group that you have configured) to submit to FortiSandbox. |
unrated |
|
Sometimes FortiGuard Web Filtering URL rating queries may fail (for example, ratings errors due to network connection failures). Enable this setting if you want FortiMail to upload those URLs to FortiSandbox as a backup method to get a rating result. |
disable |
Related topics
system fortiguard url-protection