Technical Tip: FortiSandbox Realtime Anti-Phishing Service

In v4.2 and v4.4, Real-Time Anti-Phishing (RTAP) requires a standalone subscription.

RTAP service is included in the Advanced AI Subscription bundle, which is supported only on firmware version 5.0.

It is possible to enable the Realtime Anti-Phishing Service by executing the following command:

anti-phishing -e

Once this is done, it will be possible to see the following option under:
Scan Policy & Object –> Scan Profile –> Advanced –> Enable Cloud URL Classifying System.

Note: With the firmware version 5, the option selection:

Scan Policy and Object -> Scan profile -> Advanced -> Cloud services>Real-time Zero-Day Anti-Phishing Service.

A new option under System -> FortiGuard will appear:

Note:

As of now, this service is available only in 'Global-Burnaby' and 'Global2-Ottawa'.

Lastly, a New Option in the Dashboard will appear to show the Connectivity Status of the Anti-Phishing Service.

The configuration can be set/unset on a standalone or primary unit. In cluster mode, this setting is synchronized to all nodes.

Note:

From firmware v5.0, it shows the license validity period as mentioned below:

When the Realtime Anti-Phishing is enabled:

If a URL job is scanned in any VM, it will also send a request to a phishing server. The phishing server will return a score.

But the final 'Rated By' will depend on the highest score the job got.

Example:

If VM Engine also gets the same score, the job will be rated by VM Engine.

If the URL is rated by the anti-phishing server, in the job detail, the following will be visible: Rated By: Realtime Phishing.

Note:

For more verification of RTAP rating services, run the command diagnose-debug anti-phishing

as mentioned below: