FSA Submission by Email

[burtmianus]

Hiya,

Is there a way of configuring an email address that will submit the attached files to the FSA for analysis? At the moment we don't have a FortiMail, so I'm submitting things manually which seems a bit inefficient.

Thanks

Chris

[neonbit]

There's no way that I'm aware of submitting files via email on the FSA.

The current input methods are

[ul]

Fortinet devices (FortiGate, FortiMail, FortiWeb, FortiClient)

Manual upload

Port Sniffer mode

APIs

Network share[/ul]

You could configure one of the interfaces on the FSA as sniffer mode and depending on your switch create a spanning port where all email traffic going to your mail server gets copied to the FSA sniffer port.

I would honestly look into getting a FortiMail, they are not that expensive and can be deployed as a VM if a physical appliance is not suitable. The ability to hold emails with attachments until the FSA gives the green light is very powerful and will help protect you from 0day malware.