File Scan
The File Scan page shows file-based job scans grouped by their security ratings. Files submitted through On-Demand are not included. Use this page to view job details and apply search filters. You can also create a PDF or CSV format snapshot report for files based on search filters.
Suspicious jobs are displayed by default. To view Malicious and Clean jobs, click the icons at the top of the page.
The following options are available:
|
File Scan Options |
|
|
|
|
Suspicious Jobs |
Click the Suspicious Jobs |
|
|
Clean or Unknown Jobs |
Click the Clean icon |
|
|
Malicious Jobs |
Click the Malicious |
|
Show Rescan Job Only |
Whenever a new AV signature is downloaded, all jobs from last 48 hours will be done in one AV Scan. Detected viruses will receive a Malicious rating. Users can display them in Log & Report > File Scan > Malicious and enable Show Rescan Job Only. |
|
|
Refresh |
Click the Refresh |
|
|
Search |
Show or hide the search filter field. |
|
|
Add Search Filter |
Click the search filter field to add search filters. Click the close icon in the search filter field to clear all search filters. The search filter will be displayed below the search filter field. Click the close icon beside the search filter to remove the filter. Search filters can be used to filter the information displayed in the GUI. |
|
|
Export to report |
Click the Export to report |
|
|
Customize |
Click the Customize |
|
|
Action |
|
|
|
|
View Job Detail |
Click the View Details icon to view the file description and analysis details. The information displayed is dependent on the file selected. |
|
|
Customized Rating |
Indicates the job was rated by a customized rating. |
|
|
Perform Rescan |
For malicious jobs, you can also select Rescan to manually rescan the file. This way, you can find out the behavior of a known virus. You can select to force the file to do a Sandboxing scan even if it was detected in previous steps of a Static Scan, AV Scan, Cloud Query, or if it was stopped from entering the VM by a Sandboxing-prefilter setting. You can find the job in Scan Job > File On-Demand. |
|
|
Archived File |
An icon will appear if the file is an Archived File. |
|
|
FortiGuard Static Scan |
The icon displays that the file is rated by the user's overridden verdict or FortiGuard advanced static scan. |
|
|
File Inside Archive |
The icon displays that the file is a file extracted from an archive file. |
|
|
Rescan Job |
The icon displays that the job is Malicious from an AV Rescan or a rescan job of a Malicious file. |
|
|
AV Scan |
An icon will appear if this job is from an AV Rescan. |
|
Pagination |
|
Use the pagination options to browse entries displayed. |
icon to view the suspicious jobs.
to view the clean or unknown jobs.
icon to view the malicious jobs.
button to refresh the entries displayed.
button to create a PDF or CSV snapshot report. The time to generate the report is dependent on the number of events selected. You can wait till the report is ready to view, or navigate away and find the report later on the Log & Report > Report Center page.
button to customize the Job View Settings. The change will be applied to all file based scan result pages.FortiSandbox has an Anti Virus rescan feature. When a new antivirus signature is available, FortiSandbox will perform a second antivirus scan of all the jobs from the last 48 hours whose ratings are Clean or Suspicious using the new signatures. Detected viruses will be displayed as Malicious jobs with the Rescan icon beside the View Details icon. The original job can still be viewed in the job detail page of the rescanned file by clicking the original job ID.
|
Virus behavior information is not collected as viruses are detected by the AV scanner. The rescan feature allows you to see how a virus behaves while it is being executed inside a VM. |
The displayed columns are determined by settings defined in System > Job View Settings > File Detection Columns page. For more information, see Job View Settings.
To view file details:
- Select a file.
- Click View Job Detail. A new tab opens.
For information on the View Details page, see Appendix A: Job Details page reference.
To rescan a file:
- Select a file with a Suspicious Rating that is not rated by VM or any malicious rating file.
- Click Perform Rescan.
- You can force the file to do Sandboxing scan even if was detected in former steps of Static Scan, AV Scan, Cloud Query, or stopped from entering VM by Sandboxing-prefilter setting.
- Click OK to start the rescan.
Rescan results are in Scan Job > File Job Search and Scan Job > File On-Demand.
In this version, the maximum number of events you can export to a PDF report is 1000. The maximum number of events you can export to a CSV report is 15000. Jobs over the maximum are not included in the report.