Technical Tip: Preventing Unintended Meeting Responses from FortiSandbox

Description

This article describes a scenario where FortiSandbox may unintentionally trigger meeting responses when analyzing calendar invitation emails. The article provides a solution to prevent this issue by excluding specific URLs from sandbox analysis.

Scope

FortiSandbox, FortiMail.

Solution

To prevent unintended meeting responses from FortiSandbox, follow these steps:

Identify the type of calendar invitation email that is causing the issue. 

Common examples include Google Calendar, Apple Calendar, and Microsoft Teams.Determine the URL pattern that is triggering the meeting response. For example, Google Calendar URLs may contain the parameters action=RESPOND and rst=1/2/3.

Create a URL regex exclusion rule in FortiSandbox to exclude the identified URL pattern from sandbox analysis. For example, the following regex pattern can be used for Google Calendar: https:\/\/calendar\.google\.com\/calendar\/event\?.*action=RESPOND.*rst=[123].*

Test the regex exclusion rule to ensure that it is correctly excluding the identified URL pattern from sandbox analysis.

Additionally, the following regex patterns can be used for other types of calendar invitation emails:

1. Apple Calendar: ^https://www.icloud.com/calendar/event/.*reply=(accept|decline|tentative).*

2. Microsoft Teams: No regex exclusion is required, as Teams meeting URLs do not contain RSVP or response parameters.

3. Yahoo Calendar: No regex exclusion is required, as Yahoo calendar invitations are sent as .ics attachments and do not contain URLs that can trigger meeting responses.