Sandbox Detection
FortiClient supports integration with FortiSandbox. When configured, FortiSandbox automatically scans files downloaded on the endpoint or from removable media attached to the endpoint or mapped network drives. FortiSandbox can also automatically scan files downloaded from the Internet or emailed to the endpoint. Endpoint users can also manually submit files to FortiSandbox for scanning.
Access to files can be blocked until the FortiSandbox scanning result is returned.
When scanning is complete, FortiSandbox can quarantine infected files or alert and notify the endpoint user of infected files without quarantining the files.
As FortiSandbox receives files for scanning from various sources, it collects and generates AV signatures for such samples. FortiClient periodically downloads the latest AV signatures from FortiSandbox, and applies them locally to all realtime and on-demand AntiVirus scanning.