Prepare FortiSandbox for scanning contents

To prepare the FortiSandbox instance for scannning:

1. Upload the license file

   Upload the license file using the GUI. After the file is uploaded, verify the rating and tracer engines were downloaded and installed.

2. Import Azure settings into FortiSandbox

   You can use either the Account Authorization or Service Principal methods to import the settings in FortiSandbox 3.2.0 or later.

3. (Optional) Create an App registration

   Creating an App registration is required if the FortiSandbox instance is using the Service Principal method to communicate with the Azure portal.

4. Configure the VM scan time.

   The VM Scan time covers the actual sample detonation plus some overhead (e.g. the VM and OS boot-up, engine preparation, cleanup). This overhead has been observed to take longer in VM deployment including public cloud. As a result, the sample detonation does not have enough time to collect enough behavior and will affect the rating causing a misdiagnosis.

   To compensate for overhead, we recommend to at least 120 seconds for the VM Scan timeout. To configure the VM scan timeouts, go to Scan Policy and Object >Scan Profile > Advanced tab, under the section Limits and Timeouts.