system fortisandbox

Use this command to configure FortiWeb to submit all files that match your upload restriction rules to FortiSandbox.

FortiSandbox evaluates whether the file poses a threat and returns the result to FortiWeb. If FortiSandbox determines that the file is malicious, FortiWeb performs the following tasks:

• Generates an attack log message that contains the result.
• For 10 minutes after it receives the FortiSandbox results, takes the action specified by the file security policy. During this time, it does not re-submit the file to FortiSandbox.

To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For details, see Permissions.

Syntax

config system fortisandbox

set type {fsa | cloud}

set server "<server_ipv4>"

set cache-timeout <timeout_int>

set email "<email_str>"

set interval <interval_int>

set elog {enable | disable}

set region {Europe | Global | US | Japan}

end

Variable	Description	Default
type {fsa | cloud}	Specify whether FortiWeb submits files that match the upload restriction rules to a FortiSandbox physical appliance (or FortiSandbox-VM) or to FortiWeb Cloud Sandbox. The FortiWeb Cloud Sandbox option requires you to register your FortiWeb and a FortiWeb FortiGuard Sandbox Cloud Service subscription.	fsa
server "<server_ipv4>"	Enter the IP address of the FortiSandbox to send files to. Available only when type is fsa.	No default.
cache-timeout <timeout_int>	Enter how long FortiWeb waits before it clears the hash table entry for an uploaded file that was evaluated by FortiSandbox, in hours. The valid range is 1–168. FortiWeb stores file evaluation results from FortiSandbox in a hash table. Whenever a client uploads a file, FortiWeb looks for a table entry that matches it. If there is a matching entry, FortiWeb takes action based on the stored result. If there is no matching entry, FortiWeb sends the file to FortiSandbox for evaluation.	72
email "<email_str>"	Enter the email address that FortiSandbox sends weekly reports and notifications to.	No default.
interval <interval_int>	Enter a number that specifies how often FortiWeb retrieves statistics from FortiSandbox, in minutes.	5
elog {enable | disable}	Enter so that FortiWeb will report event logs when it successfully submits files to FortiSandbox.	disable
region {Europe | Global | US | Japan}	Available only when the type is cloud (FortiWeb Cloud Sandbox). Datacenters are located in Canada, Germany, the United States, and Japan to ensure better performance. The default region is Global. Select a country or region from the list. FortiWeb will retrieve and establish a connection to the appropriate FortiSandbox Cloud server IP based on the selected region.	Global

Example

This example creates a connection to a FortiSandbox at 192.0.2.2 that retrieves statistics at the default interval (5 minutes) and sends a weekly report to admin@example.com.

config system fortisandbox

set server "192.0.2.2"

set email "admin@example.com"

end

Related topics

• waf file-upload-restriction-policy
• log reports
• system fortisandbox-statistics

• forticloud-sandbox