Technical Tip: How to configure the FortiGuard AI-based Malware Prevention Service in FortiGate

[luisedopicari]

Description	Inline Sandbox has been renamed to the AI-based Inline Malware Prevention Service. This service represents the most advanced sandbox capability. This article describes how to configure this service in FortiGate appliances and VMs.
Scope	FortiGate, FortiSandbox.
Solution	For this service, it is necessary to have: License: Enterprise Protection or FortiGuard AI-based Inline Malware Prevention Service (Add-on). A FortiGate appliance or FortiGate VM. Activate the FortiGate Cloud Sandbox connection. Access FortiGate via the CLI and configure the following next commands: execute forticloud-sandbox region 0 Europe 1 Global 2 Japan 3 US Please select cloud sandbox region[0-3]:3 (Select the region more convenient for the service) To enable FortiSandbox inline scanning: Go to Security Fabric -> Fabric Connectors -> Sandbox: Create security profile (Antivirus).   Define a name for the antivirus security profile. Select to enable the AV engine for detection of known malware files. Select the option 'Proxy-based'. Define the scope of protocols to be inspected. Select the option 'Send files to FortiSandbox for inspection'. Define the scan strategy: Inline: File will be sent to FortiSandbox and will wait for a result before completing the file transfer to the client. Post transfer: The file will be sent to FortiSandbox, but it will not wait for a result to complete the transfer to the client. This will update the FortiSandbox database with any infected files. Define the action if the file is detected as malware. Optional: Select this option to put the file in quarantine and to download it for further analysis. Select the antivirus security profile in the firewall policy: Go to Policy & Objects -> Firewall Policy -> Create new.   Verify Sandbox detection with the 'To verify that infected files are blocked inline' section of this process. On a client, download an infected file. Use this site and try to download the file 'Windows Executable'.   Verify the antivirus log: Go to Log & Report -> Security Events -> AntiVirus. Field 1 shows the file name. Field 2 shows the action. Field 3 shows the detection type Access FortiGate Cloud (https://login.forticloud.com) in order to see the results.  Go to Sandbox -> Scan Results.