FortiClient

FortiClient 5.4 and earlier versions can silently connect to FortiSandbox without the need to be authorized. You can de-authorize a FortiClient host manually. If a FortiClient endpoint is managed by EMS, it follows the authorization status and file submission speed setting of EMS. You can manually change these settings.

For information on how to configure FortiClient to send files to FortiSandbox, see the FortiClient Administration Guide in the Fortinet Document Library.

To view connected FortiClient endpoints in FortiSandbox, go to Security Fabric > FortiClient.

The following options are available:

Refresh	Refresh display after applying search filters.
Device Filter	Filter devices by serial number, host name, authorization status, IP or EMS.
Clear all removable filters	Click the trash can icon to remove all filters.

This page displays the following:

FCT Serial	The FortiClient serial number.
Hostname	FortiClient host name.
User	Current user logged into the FortiClient host, if available.
IP	Host IP Address.
Malicious, High, Medium, Low	The number of malicious, high risk, medium risk, or low risk files submitted by FortiClient to FortiSandbox in the last seven days. Malicious files are not executed in the FortiSandbox VM module as the antivirus scanner has already determined the file rating.
Clean	Number of clean files submitted by the device to FortiSandbox in the last seven days.
Others	Number of other files submitted by the device to FortiSandbox in the last seven days.
Mal Pkg	Malware package version currently on the device.
Auth	If the FortiClient is authorized, you can click the FortiClient serial number and modify its authorization status.
Limit	Shows if this device has a submission limit.
Status	Status of the FortiClient host. An icon shows that the device is connected (up) or down.
Last Seen	Date and time that FortiClient last connected to FortiSandbox.
Delete	Click to delete the FortiClient. If the device connects to FortiSandbox again, it appears as a new device.

To edit FortiClient settings in FortiSandbox:

1. On your FortiSandbox device, go to Security Fabric > FortiClient.
2. Click the device name to open the Edit FortiClient Settings page.
3. Edit the following settings and then click OK.

   FortiClient Status
   Serial Number	Device serial number.
   Hostname	FortiClient host name.
   IP	IP address of the FortiClient.
   Status	Status of the device.
   Files Transmitted	Number of files transmitted to FortiSandbox in the last seven days.
   Last Seen	Date and time that FortiClient last connected to FortiSandbox.
   Permissions & Policy
   Authorized	Enable to authorize the device.
   Submission Limitation	Limit the submission speed. Select Unlimited or specify the number of submissions per Hour or Day. When the limit is reached, FortiSandbox sends a signal to FortiClient to stop file submission to save resources on both devices.