Technical Note: How to reduce the number of email alerts with the msg=File submitted to Sandbox.

[hhashemi]

Description

This article explains how to reduce the number of email alerts regarding the files submitted to the FortiSandbox.

Solution

The number of email alerts can be reduced by running the following command in CLI:

# config antivirus profile
(profile) # edit <AV_profile_name>
(AV_proflie_name) # set ftgd-analytics suspicious
# end

In this case only suspicious files will be logged.

The options available with this command are:

# config antivirus profile
(profile) # edit <AV_Profile_Name>
# set ftgd-analytics {disable | suspicious | everything}
# end

where the values for the FortiGuard Analytics mode are:

• disable: Disable upload to FortiSandbox.
• suspicious: Submit files supported by FortiSandbox if detected as suspicious by the AV engine.
• everything: Submit files supported by FortiSandbox if detected as suspicious or clean by the AV engine.