The url field is in FortiMail log messages where type=virus and subtype=fortisandbox.
url
type=virus
subtype=fortisandbox
The field indicates the URL that was submitted to FortiSandbox for scanning.