Forti Ems Sandbox Profile - Exclude cache from scaning by SB (cloud)

[chaim]

HI all ,

We have a problem setting the correct policy in clients
that are connected to EMS Cloud and upload files for scanning in Cloud Sandbox

We have set in the policy that all downloads from the Web will be scanned (Submit To Sb), but a situation is created where all the cache files during the download are scanned one after the other until the download is complete, we are unable to exclude the cache in any way and WildCard does not seem to work exceptionally.

Any idea is welcome

FortiClient  

[Anthony_E]

Hello chaim,

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Regards,

[Anthony_E]

Hello chaim,

I found theFortiClient EMS guide which could help you:

https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/9cb6d44f-9d73-11eb-b70b-005056...

Could you please tell me if it helped?

Regards,

[chaim]

HI ,

first thanks for your response.

I read the guide and it did not help so much with this specific exception question.

I ended up executing Custom exclusion by editing the XML and then I was able to upload an exception of Crdownload files type to the main policy (I attach a screenshot).

I currently only did this on our EMS-On-Prem server(its working good), on an EMS cloud server it works partially.

I continue testing on my part, but I think these exceptions should be added as Default for selection and not Custom edit.