Cloud-based malware detection

Enable cloud-based malware outbreak detection. The cloud-based malware protection feature helps protect endpoints from high risk file types from external sources such as the Internet or network drives by querying FortiGuard to determine whether files are malicious. The following describes the process for cloud-based malware protection:

A high risk file is downloaded or executed on the endpoint.
FortiClient generates a SHA1 checksum for the file.
FortiClient sends the checksum to FortiGuard to determine if it is malicious against the FortiGuard checksum library.
If the checksum is found in the library, FortiGuard communicates to FortiClient that the file is deemed malware. By default, FortiClient quarantines the file.

This feature only submits high risk file types such as .exe, .doc, .pdf, and .dll to FortiGuard. The list of high risk file types is the same as the list of file types that FortiClient submits to Sandbox by default.

Options		Description
Server
Wait for Cloudscan Results before Allowing File Access		Have the endpoint user wait for cloud scanning results before being allowed access to files. Set the timeout in seconds.
Deny Access to File When There is No Cloudscan Result		Deny access to downloaded files if there is no cloud scan result. This may happen if FortiClient EMS cannot reach FortiGuard.
File Submission Options
All Files Executed from Removable Media		Submit all files executed on removable media, such as USB drives, to FortiSandbox for analysis.
All Files Executed from Mapped Network Drives		Submit all files executed from mapped network drives.
All Web Downloads		Submit all web downloads.
All Email Downloads		Submit all email downloads.
Exclude Files from Trusted Sources		Exclude files signed by trusted sources from cloud-based malware protection submission.
Remediation Actions
Action		Choose Quarantine or Alert & Notify for malicious files. The user can access the file depending on Wait for Cloudscan Results before Allowing File Access and Deny Access to File When There Is No Cloudscan Result configuration. Whether FortiClient quarantines the file depends on if FortiGuard reports the file as malicious.

Cloud-based malware detection

A high risk file is downloaded or executed on the endpoint.
FortiClient generates a SHA1 checksum for the file.
FortiClient sends the checksum to FortiGuard to determine if it is malicious against the FortiGuard checksum library.
If the checksum is found in the library, FortiGuard communicates to FortiClient that the file is deemed malware. By default, FortiClient quarantines the file.

Options		Description
Server
Wait for Cloudscan Results before Allowing File Access		Have the endpoint user wait for cloud scanning results before being allowed access to files. Set the timeout in seconds.
Deny Access to File When There is No Cloudscan Result		Deny access to downloaded files if there is no cloud scan result. This may happen if FortiClient EMS cannot reach FortiGuard.
File Submission Options
All Files Executed from Removable Media		Submit all files executed on removable media, such as USB drives, to FortiSandbox for analysis.
All Files Executed from Mapped Network Drives		Submit all files executed from mapped network drives.
All Web Downloads		Submit all web downloads.
All Email Downloads		Submit all email downloads.
Exclude Files from Trusted Sources		Exclude files signed by trusted sources from cloud-based malware protection submission.
Remediation Actions
Action		Choose Quarantine or Alert & Notify for malicious files. The user can access the file depending on Wait for Cloudscan Results before Allowing File Access and Deny Access to File When There Is No Cloudscan Result configuration. Whether FortiClient quarantines the file depends on if FortiGuard reports the file as malicious.