Malicious vs Suspicious on FortiSandbox

I recently had a client get emailed a file that contained a downloader virus which then infected them with botnet.  The FortiSandbox detected the file as suspicious. 

My questions I pose to the forums are:

1.  Is there any way to reclassify a file as malicious if it is known to be so?  The sandbox only things it is suspicious.

2.  If the sandbox finds a malicious file, does it then communicate back to the fortigate to block that file in the future?

I'm interested to see who is using the sandbox and what value they are obtaining from it!