Fortinet black logo

Administration Guide

Home FortiSandbox 4.2.6 Administration Guide
4.2.6
4.4.5
4.4.4
4.4.3
4.4.2
4.4.1
4.4.0
4.2.7
4.2.6
4.2.5
4.2.4
4.2.3
4.2.2
4.2.1
4.2.0
4.0.5
4.0.4
4.0.3
4.0.2
4.0.1
4.0.0
3.2.4
3.2.3
3.2.2
3.2.1
3.2.0
3.1.5
3.1.4
3.1.3
3.1.2
3.1.1
3.1.0
3.0.7
3.0.6

Simulator VMs

Simulator VMs

Preparing the OT Simulator VM on FortiSandbox

  1. In Dashboard > Status > Licenses widget, check that the Industrial Security Service contract is valid.
  2. Go to the VM Image page and find LinuxOT under the Simulator VMs table.

  3. Click the download icon in the status column of the LinuxOT row.
  4. Click the Install button as below and wait for the installation to complete and the FortiSandbox to reboot.

  5. After rebooting, the LinuxOT VM is installed with clone disabled.
  6. Toggle the switch in the Clone # column to enable it then press Apply to save the changes.

Scanning the files with the Simulator VM enabled

  1. To Scan a file using the Simulator VM, submit a scan job to the Windows VMs. The Simulator VM automatically detects network operations related to the simulated protocols.
  2. After the scan is finished, check the job detail to confirm the following:
    • There should be more than one .pcap file in the PCAP Information section.
    • There should be at least one item containing the Lateral Movement category in the Network Operations section.

Previous
Next

Simulator VMs

Preparing the OT Simulator VM on FortiSandbox

  1. In Dashboard > Status > Licenses widget, check that the Industrial Security Service contract is valid.
  2. Go to the VM Image page and find LinuxOT under the Simulator VMs table.

  3. Click the download icon in the status column of the LinuxOT row.
  4. Click the Install button as below and wait for the installation to complete and the FortiSandbox to reboot.

  5. After rebooting, the LinuxOT VM is installed with clone disabled.
  6. Toggle the switch in the Clone # column to enable it then press Apply to save the changes.

Scanning the files with the Simulator VM enabled

  1. To Scan a file using the Simulator VM, submit a scan job to the Windows VMs. The Simulator VM automatically detects network operations related to the simulated protocols.
  2. After the scan is finished, check the job detail to confirm the following:
    • There should be more than one .pcap file in the PCAP Information section.
    • There should be at least one item containing the Lateral Movement category in the Network Operations section.

Previous
Next