Cloud Storage

Go to Security Fabric > Cloud Storage to scan remote cloud storage platforms.

Create a Cloud Storage profile to configure a Cloud Storage location for inspection. After the profile is configured, FortiNDR will scan the registered cloud storage’s contents.

Name	The cloud storage profile name.
Scan Scheduled	Indicates scheduled scan is enabled/disabled.
Type	The cloud storage platform.
Storage Path	The URL of the cloud storage.
Enabled	Indicates the cloud storage profile is enabled/disabled.
Status	The cloud storage configuration status. See Testing connectivity.

Creating a Cloud Storage profile

To create a Cloud Storage profile, go to Security Fabric > Cloud Storage. Register a new Cloud Storage by providing access information. You can also use the profile to schedule a scan cycle of the cloud storage.

To create a Cloud Storage profile:

1. Go to Security Fabric > Cloud Storage.
2. In the toolbar, click Create New. The New Cloud Storage page opens.
3. Enter the Cloud Storage access information.

   Status	Enable or Disable. Enable is the default.
   Cloud Type	Select a cloud storage platform from the list. The following platforms are supported: Amazon Web Service S3 Bucket
   Cloud Storage Name	Enter a name for the Cloud Storage.
   Bucket Name	(AWS S3 Only) Enter the name of the Cloud Storage container.
   S3 Prefix	(AWS S3 Only) Enter the common prefix of the keys to scan. Leave empty to scan the entire bucket.
   Access Key	Enter the access key for the cloud storage.
   Secret Key	Enter the secret key for the cloud storage.
   Enable Force Rescan	When enabled, FortiNDR will not use cache detection even if the files are previously scanned.

4. Click OK.

Testing connectivity

To validate the Cloud Storage configuration

1. Go to Security Fabric > Cloud Storage and select a profile.
2. In the toolbar, click Test Connection to validate the Cloud Storage configuration.

A green check mark appears in the Status column next to a valid connection.

Scanning a cloud storage

To trigger a scan:

1. Go to Security Fabric > Cloud Storage and select a profile.
2. In the toolbar, click Scan Now.

The Scan Now button will not create a new task when the Cloud Storage is:

• Currently mounting
• Scanning another task
• Disabled
• Not connected (Status is Down)

You can use a REST API call to start a scan.

Scheduling a scan

You can schedule routine scanning for a cloud storage on an hourly, daily, or monthly basis. The minimum time interval for each scan is 15 minutes.

To schedule a scan:

1. Go to Security Fabric > Cloud Storage and select a profile.
2. In the toolbar, click Edit. The New Cloud Storage window opens.
3. Select Enable Scheduled Scan.
4. Configure the Schedule Type and the corresponding time interval.
5. Click OK.

Viewing scan results

View the scan history of the Cloud Storage directories.

To view the scan results:

1. Go to Security Fabric > Cloud Storage and select a profile.
2. In the toolbar, click Scan Details. The scan history is displayed.

Total	The total number of files scanned.
Start Time	The date and time the scan started.
End Time	The date and time the scan completed.
Scan Finished	The scan progress as a percentage.
Critical Risk	The number of detected critical risk files.
High Risk	The number of detected critical high files.
Medium Risk	The number of detected medium risk files.
Low Risk	The number of detected critical low files.
Clean	The number of clean files.
Others	The number of detected other files.
Scan Status	The scan status as a string.

• Click the numbers to view the detection information for the samples that belong to the category.
• Click the link in the column to view the detected and quarantined files.
  • Select a sample in the list then click View Sample Detail.
  • Click Back to return to the Scan Details.
• Click Back to return to the Cloud Storage pane.

Scanning Zip files

FortiNDR can extract and process Zip files up to 10 levels. When any of the files inside the Zip file is detected, the whole zip file will be marked as malicious.

FortiNDR does not process password-protected zip files.