FortiSandbox scan results display on the Malware Protection tab and in a popup.
When a virus is detected, FortiClient creates a notification alert. See Viewing notifications.
When EMS manages FortiClient, FortiClient sends quarantined file information to EMS. If the EMS administrator whitelists the file (in the case of a false positive), EMS sends the whitelist information to FortiClient. After FortiClient receives the whitelist information, it releases the file from quarantine. See the FortiClient EMS Administration Guide for details.