Fortinet Document Library

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

Administration Guide

Adapter

FortiSandbox uses adapters to connect to third party products. Carbon Black/Bit9 server, ICAP and Mail gateway clients are supported.

With an Adapter, FortiSandbox can analyze files downloaded from the Carbon Black server to send notifications of file verdict back to the server, or receive HTTP message from an ICAP client and return a response to it.

FortiSandbox supports the BCC adapter to receive forwarded emails from an upstream email gateway and scan them. FortiSandbox will extract email attachments and URLs in an email body and send them to the Job Queue.

note icon

The BCC adapter feature is for information only, it will not block any email.

The following options are available:

Create New

Create a new adapter.

ICAP and BCC adapters are automatically created by the system.

Edit

Edit an adapter.

Delete

Delete an adapter.
ICAP and BCC adapters cannot be deleted.

This page displays the following information:

Adapter Name

The Adapter's name.
When the adapter type is ICAP, the value is ICAP.

When the adapter type is BCC, the value is BCC.

Vendor Name

Vendor name.
When the adapter type is ICAP, the value is ICAP.

When the adapter type is BCC, the value is BCC.

Serial

Serial number.
When the adapter type is ICAP, the value is ICAP.

When the adapter type is BCC, the value is BCC.

FQDN/IP

FQDN/IP address.
When the adapter type is ICAP, the value is empty.

When the adapter type is BCC, the value is empty.

Malicious

File and URL count of Malicious rating from this Adapter in the last seven days. Separated by |.

High

File and URL count of Highly Suspicious rating from this Adapter in the last seven days. Separated by |.

Medium

File and URL count of Medium rating from this Adapter in the last seven days. Separated by |.

Low

File and URL count of Low rating from this Adapter in the last seven days. Separated by |.

Clean

File and URL count of Clean rating from this Adapter in the last seven days. Separated by |.

Other

File and URL count of Other rating from this Adapter in the last seven days. Separated by |.

To create a new adapter:
  1. Go to Scan Input > Adapter.
  2. Click the + Create New button from the toolbar.
  3. Configure the following:

    Vendor Name

    Select Carbon Blaclk/Bit9 as the vendor name.

    Adapter Name

    Enter the adapter name.

    Server FQDN/IP

    Enter the FQDN/IP address of the Carbon Black server.

    Token

    Enter the token string. Authentication token is assigned by the Carbon Black or ICAP server.

    Timeout (seconds)

    Enter the timeout value.

    Serial

    Auto-generated serial number for this adapter. It works as a device serial number to denote file's input device.

  4. Click OK to save the entry.
To edit an adapter:
  1. Go to Scan Input > Adapter.
  2. Select an adapter.
  3. Click the Edit button from the toolbar.
  4. Make edits as necessary.

    When the adapter type is ICAP, the user can:

    • Enable or disable FortiSandbox to work as an ICAP server.
    • Define the port for encrypted and non-encrypted communication ports with the client.
    • Extract URLs or files from HTTP messages from the client and put them into the Job Queue.
    • Define which ratings are treated as bad to return a block code.
    • Enable a Real Time AV Scan for a faster response of a known virus before a file is put into the job queue.

    When the adapter type is BCC, the user can:

    • Enable or disable FortiSandbox to work as an email server.
    • Enable Parse URL to allow FortiSandbox to extract the first three URLs in an email.
    • Input the SMTP port number that FortiSandbox listens on to receive emails. The default port number is 25.

  5. Click Apply to save the entry.
To delete an adapter
  1. Go to Scan Input > Adapter.
  2. Select an adapter.

    ICAP and BCC adapters cannot be selected.

  3. Click the Delete button from the toolbar.
  4. Click Yes I'm sure button from the Are you sure confirmation box.

After a Carbon Black adapter is created, FortiSandbox will try to communicate with Carbon Black server. If the connection and authentication is successful, the status column will show a green icon, otherwise a red icon is displayed.

CLI command: diagnose-debug adapter can be used to troubleshoot communciations with the adapter clients.

Adapter

FortiSandbox uses adapters to connect to third party products. Carbon Black/Bit9 server, ICAP and Mail gateway clients are supported.

With an Adapter, FortiSandbox can analyze files downloaded from the Carbon Black server to send notifications of file verdict back to the server, or receive HTTP message from an ICAP client and return a response to it.

FortiSandbox supports the BCC adapter to receive forwarded emails from an upstream email gateway and scan them. FortiSandbox will extract email attachments and URLs in an email body and send them to the Job Queue.

note icon

The BCC adapter feature is for information only, it will not block any email.

The following options are available:

Create New

Create a new adapter.

ICAP and BCC adapters are automatically created by the system.

Edit

Edit an adapter.

Delete

Delete an adapter.
ICAP and BCC adapters cannot be deleted.

This page displays the following information:

Adapter Name

The Adapter's name.
When the adapter type is ICAP, the value is ICAP.

When the adapter type is BCC, the value is BCC.

Vendor Name

Vendor name.
When the adapter type is ICAP, the value is ICAP.

When the adapter type is BCC, the value is BCC.

Serial

Serial number.
When the adapter type is ICAP, the value is ICAP.

When the adapter type is BCC, the value is BCC.

FQDN/IP

FQDN/IP address.
When the adapter type is ICAP, the value is empty.

When the adapter type is BCC, the value is empty.

Malicious

File and URL count of Malicious rating from this Adapter in the last seven days. Separated by |.

High

File and URL count of Highly Suspicious rating from this Adapter in the last seven days. Separated by |.

Medium

File and URL count of Medium rating from this Adapter in the last seven days. Separated by |.

Low

File and URL count of Low rating from this Adapter in the last seven days. Separated by |.

Clean

File and URL count of Clean rating from this Adapter in the last seven days. Separated by |.

Other

File and URL count of Other rating from this Adapter in the last seven days. Separated by |.

To create a new adapter:
  1. Go to Scan Input > Adapter.
  2. Click the + Create New button from the toolbar.
  3. Configure the following:

    Vendor Name

    Select Carbon Blaclk/Bit9 as the vendor name.

    Adapter Name

    Enter the adapter name.

    Server FQDN/IP

    Enter the FQDN/IP address of the Carbon Black server.

    Token

    Enter the token string. Authentication token is assigned by the Carbon Black or ICAP server.

    Timeout (seconds)

    Enter the timeout value.

    Serial

    Auto-generated serial number for this adapter. It works as a device serial number to denote file's input device.

  4. Click OK to save the entry.
To edit an adapter:
  1. Go to Scan Input > Adapter.
  2. Select an adapter.
  3. Click the Edit button from the toolbar.
  4. Make edits as necessary.

    When the adapter type is ICAP, the user can:

    • Enable or disable FortiSandbox to work as an ICAP server.
    • Define the port for encrypted and non-encrypted communication ports with the client.
    • Extract URLs or files from HTTP messages from the client and put them into the Job Queue.
    • Define which ratings are treated as bad to return a block code.
    • Enable a Real Time AV Scan for a faster response of a known virus before a file is put into the job queue.

    When the adapter type is BCC, the user can:

    • Enable or disable FortiSandbox to work as an email server.
    • Enable Parse URL to allow FortiSandbox to extract the first three URLs in an email.
    • Input the SMTP port number that FortiSandbox listens on to receive emails. The default port number is 25.

  5. Click Apply to save the entry.
To delete an adapter
  1. Go to Scan Input > Adapter.
  2. Select an adapter.

    ICAP and BCC adapters cannot be selected.

  3. Click the Delete button from the toolbar.
  4. Click Yes I'm sure button from the Are you sure confirmation box.

After a Carbon Black adapter is created, FortiSandbox will try to communicate with Carbon Black server. If the connection and authentication is successful, the status column will show a green icon, otherwise a red icon is displayed.

CLI command: diagnose-debug adapter can be used to troubleshoot communciations with the adapter clients.