Technical Tip: How to configure antivirus profile to upload files to FortiSandbox for virus scanning

[Rajan_kohli]

Description	This article describes how to configure an antivirus profile to upload files to FortiSandbox for virus scanning
Scope	FortiOS 6.0, FortiOS 6.2, FortiOS 6.4, FortiOS 7.0, FortiOS7.2, FortProxy 7.0, FortiProxy 7.2, FortiProxy7.4.
Solution	For the firmware version of FortiOS 6.0, FortiOS 6.2, FortiOS 6.4, FortiOS 7.0 FortiProxy 7.0,FortiProxy 7.2: config antivirus profile edit "Test" <- Antivirus profile name. set ftgd-analytics everything <- This option can be set to 'suspicious' or 'everything'. set analytics-max-upload <- Maximum file size that can be uploaded to FortiSandbox. end Note: suspicious: Submit files supported by FortiSandbox if heuristics or other methods determine they are suspicious. everything: Submit files supported by FortiSandbox and known infected files. The 'analytics-max-upload' option is only available via the CLI after 'ftgd-analytics' has been set to 'everything' or 'suspicious'. 'analytics-max-upload' -> Integer values are (1 - 26214 MB), default value is 10 MB. On FortiOS, the option is available on the GUI after the Security Fabric Connector of 'FortiSandbox' has been created. On FortiProxy version 7.0.x this can be configured only via the CLI. On FortiProxy version 7.2.x, the 'Send files to FortiSandbox for inspection' option is available on the GUI as well. For the firmware version of  FortiOS 7.2 FortiOS 7.4, and  FortiProxy 7.4: config antivirus profile edit "Test" <- Antivirus profile name. set fortisandbox-mode analytics-everything <- This option can be set to 'analytics-suspicious' or 'analytics-everything'. set fortisandbox-max-upload <- Maximum file size that can be uploaded to FortiSandbox. end Note: analytics-suspicious: FortiSandbox post-transfer scan: submit supported files if heuristics or other methods determine they are suspicious. analytics-everything: FortiSandbox post-transfer scan: submit supported files and known infected files. The 'analytics-max-upload' option is only available in the CLI after 'ftgd-analytics' has been set to 'everything' or 'suspicious'. analytics-max-upload -> Integer values are (1 -  26214 MB), default value is 10. On FortiOS 7.4 and FortiProxy 7.4, the option is available on GUI after the Security Fabric Connector of 'FortiSandbox' has been created. FortiOS GUI: FortiProxy GUI: