FortiGate AV inspection order + detection types clarification

Hello,
 

I am reading the FortiOS admin guide and I saw that the antivirus checking order is:

Antivirus local database → EMS threat feed → external malware blocklist → FortiGuard outbreak prevention database

But I have a few questions.

1. What about the other inspection engines?

Where do the following fit in the inspection flow?

• Content Disarm and Reconstruction (CDR)
• Behavior-based detection
• CIFS/SMB scanning
• AI/ML detection

My question is:

👉 If a file is NOT detected by:

• signature-based AV database
• EMS threat feed
• external malware blocklist
• outbreak prevention / hash reputation

then will FortiGate check the engines above afterwards?

Or do these engines run in parallel / separate pipelines?

What is the actual processing order?

2. Signature-based detection clarification

The guide says:

“Antivirus scan detects viruses that are an exact match for a signature in the antivirus database.”

So I want to confirm:

• Does “signature” here mean a hash value (exact file match)?
• Or is it a pattern-based rule (byte sequences / CPRL / heuristics)?
• Or a combination of both?

Also, is FortiGate AV signature matching only hash-based, or more complex than simple hash comparison?

Because I also see references to:

• hash-based outbreak prevention
• EMS threat feeds
• signature database

So I want to understand how they relate.

If anyone can clarify the full inspection order and how these detection methods interact, I would really appreciate it.