Technical Tip: FortiGate sends logs to FortiSandbox despite "Send files to FortiSandbox for inspection" being disabled

The expected behavior is that FortiGate should not send any logs to Sandbox when "Send files to FortiSandbox for inspection" is disabled.

The first trigger condition is that the sandbox must be enabled in the FortiGate configuration.

config system fortisandbox

    set status enable

    set inline-scan enable

    set server "x.x.x.x"

end

On the FortiGate, even if the feature 'Send files to FortiSandbox for inspection' is disabled in the AV profile as below, logs are still observed with the message field 'File submitted to Sandbox'.

date=2024-12-11 time=14:35:42 logid="0201009233" type="utm" subtype="virus" eventtype="analytics" level="information" policytype="policy" msg="File submitted to Sandbox." action="analytics" service="HTTPS" dstport=443 proto=6 direction="incoming" filetype="unknown" url="https://xxxxxxxxxxx" ClientAsync" httpmethod="POST" analyticscksum="xxxxxxxxxxxx" analyticssubmit="true"

The issue arises when FortiGate has deep inspection with AV scanning enabled in the firewall policy, and the sandbox feature is active, but 'Send Files to FortiSandbox for Inspection' is disabled.

The behavior contradicts expected functionality, where disabling this setting should prevent any logs from being sent to FortiSandbox.

Fix:

Upgrade the FortiGate firmware above 7.2.9 or above, 7.4.2 or above.