Fortigate Antivirus Signature Supplement from Fortisandbox

[meantime]

Hopefully this is an appropriate forum to initiate this discussion on.

I have read documentation stating that FortiGate can retrieve scan results and details from FortiSandbox, and also receive antivirus and web filtering signatures to supplement the current signature database.

I have seen the scan results but am curious how the signature databsae is supplemented. Could anyone provide more detail on how that is handled and how I might be able to tell which updates to the signature database came from Fortisandbox?

Thank you,

John

[jwhite_FTNT · Accepted solution]

John,

Today, the FSA will (if configured) share data with FortiGuard, to create updated AV package that will be consumed by every FGT device, but the FGT does not use the local generated FSA AV signatures or URL filters.

The supplemental DB signature will be used by FGT in FOS 5.4 release.  After that release, FGT will check the FSA for the local AV and URL package updates and use them for protection against the targeted APT types of attacks indentified by FSA.  This new approach greatly reduces that total response time before FGT can block malicious URL and malware files - response time for FGT to start blocking will be minutes instead of hours.

Jim White
207-251-2155

[meantime]

Exactly what I was looking for. Thanks Jim.

[Tommy]

And what if you have a FortiSandbox subsciption in the cloud? Will you also get the supplemental DB updates or is this a FSA only feature? If not what is the ETA of an updated AV signature in Fortiguard?

What happens when a users downloads a file that after sandboxing in the cloud appears to be malicious. So this will show up in the logs of the Fortigate? Secondly when another users downloads the same file will this be blocked because the file was allready sandboxed and been found to be malicious? Is this done via an MD5 hash query to the cloud?