Enable Sandbox Detection.

Enable or disable the eye icon to show or hide this feature from the end user in FortiClient.

Server

Select Appliance to configure connection to an on-premise FortiSandbox appliance or Cloud to configure connection to FortiSandbox Cloud. FortiSandbox Cloud offers a more affordable alternative to a FortiSandbox appliance, since it is a cloud service that does not need to be hosted on-site. However, FortiSandbox Cloud does not offer the full range of features that a FortiSandbox appliance offers. See Appendix F - FortiCloud Sandbox.

Enter the FortiSandbox's IP address or hostname. Click Test Connection to ensure that EMS can communicate with FortiSandbox. This option is only available for a FortiSandbox appliance.

Optional. Enter the FortiSandbox username. This option is only available for a FortiSandbox appliance. The username is necessary to view detailed FortiSandbox reports on the Sandbox Events tab. See Viewing Sandbox event details.

Optional. Enter the FortiSandbox password. This option is only available for a FortiSandbox appliance. The password is necessary to view detailed FortiSandbox reports on the Sandbox Events tab. See Viewing Sandbox event details.

Select the desired region. This option is only available for FortiSandbox Cloud.

Displays the Sandbox Cloud license status. Using FortiSandbox Cloud requires an additional license. See FortiClient EMS.

Select one of the following:

• None: FortiClient does not send any files to FortiSandbox for inspection.
• All High-Risk Exts: FortiClient inspects all supported high-risk file extensions and sends to FortiSandbox as appropriate.
• All Supported Extensions: FortiClient inspects all supported file extensions and sends to FortiSandbox as appropriate.

Select a file extension to exclude from FortiSandbox scanning. You can select multiple file extensions.

Have the endpoint user wait for FortiSandbox scanning results before being allowed access to files. Set the timeout in seconds.

Deny access to downloaded files if there is no FortiSandbox result. This may happen if FortiSandbox is offline.

File Submission Options

Submit all files executed on removable media, such as USB drives, to FortiSandbox for analysis.

Submit all files executed from mapped network drives.

Submit all web downloads.

Submit all email downloads.

Remediation Actions

Choose Quarantine or Alert & Notify for infected files. The user can access the file after FortiClient submits the file to FortiSandbox for analysis. FortiClient quarantines the file only if FortiSandbox reports the file as malicious.

Exceptions

Exclude files signed by trusted sources from FortiSandbox submission.