Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
rami78
New Contributor

FortiGuard Virus Outbreak Protection Service

I saw this "new" license option on Fortimail OS 5.4, however i cannot find any documentation online about how it works exactly and how it differs from regular antivirus which is already licensed

 

Anyone have any idea?

12 REPLIES 12
Carl_Windsor_FTNT

FortiGuard Virus Outbreak Protection Service provides several additional layers of protection in addition to the existing FortiGuard AV:

[ul]
  • Real-time Data Analytics on FortiGuard Network queries to quickly detect and react to new outbreaks
  • Global sandbox intelligence
  • Pre-signature FortiGuard hashes
  • Pre-signature Cyberthreat Alliance hashes[/ul]

    We had previously used this service internally to identify new samples for introduction into the AV engine however, due to the nature of email where the risk of false positive is lower than e.g on a desktop (files can just be quarantined rather than potentially disrupting the OS), we can afford to be more aggressive with our detection and block these suspected threats in real-time before AV signatures are available.    We have seen that this service is providing a valuable additional level of protection above normal AV at times of a new, previously unknown outbreak.

  • Dr. Carl Windsor Field Chief Technology Officer Fortinet

    Hosemacht

    Hi there,

     

    thanks for the explanation but makes this any sense if i have a fortisandbox cloud service already?

     

    Regards

    sudo apt-get-rekt

    sudo apt-get-rekt
    Carl_Windsor_FTNT

    Absolutely.  This check is almost instant like our AV check.  It is better to stop threats quickly without loading the FortiSandbox which may take several minutes to queue and explode and detect in the sandbox.

    Dr. Carl Windsor Field Chief Technology Officer Fortinet

    wafikmaher

    Sounds Good, but if there is any Reference to explain those 4 Benefits in more details, things will be more clear.

    rmoreno_FTNT

    Hi!

     

    I have two questions about this topic:

     

    1. When customers migrate from FortiOS 5.4 to FortiOS 6.0, do they automatically have VOS and CDR activated if they had purchased Enterprise Bundle?

     

    2. How does the VOS service defines which files will be hashed for sending their hash to FortiSandbox cloud? Doest FortiGate sends a hash of all the files to FortiSandbox cloud?

     

    Many thanks

     

    Rodrigo

     

     

    Systems Engineer México
    Carl_Windsor_FTNT

    1.. If the customer purchased the enterprise bundle in Q2 and have been running this since with 5.4, yes when the upgrade they will get VOS and CDR on upgrade.

     

    2.  The VOS scan happens before the FortiSandbox scan and will rate the file as unknow or bad.  This scan does not impact whether the file gets sent to the Sandbox unless it is a known bad sample and is therefore blocked.

     

    Dr. Carl Windsor Field Chief Technology Officer Fortinet

    alejandrol

    Apologies for returning to this topic late. I find hard to get information about activating this service. According to what you explained in your previous post, the service is not included in the BDL for those who purchased or renewed FortiGuard services before Q2'18, right? Why Fortinet provide services outside the BDL? Thanks in advance

    Carl_Windsor_FTNT

    >the service is not included in the BDL for those who purchased or renewed FortiGuard services before Q2'18, right?

     

    Correct.  You can check whether this is included in your license by logging into FortiCare and looking for the FortiGuard Virus Outbreak Protection Service entitlement.

     

    >Why Fortinet provide services outside the BDL?

     

    It was a newly added feature so it wasn't part of the bundle.   In Q2, we created new base and enterprise and included this entitlement in both.

    For pre-Q2 without this entitlement, it can be added a la carte with the 150 SKU e.g. for the FML 200E

     

    FC-10-FE20E-150-02-DDFortiGuard Virus Outbreak Protection Service

     

     

    Dr. Carl Windsor Field Chief Technology Officer Fortinet

    alejandrol

    I understand, but it seems not to be 100% clear for Fortinet TAC. I work as a product manager on a enterprise which is Fortinet Gold Partner. In Q4 price list, the BDL does include the VOS service:

    Hardware plus 24x7 FortiCare and FortiGuard Base Bundle

    Hardware Unit, Advanced Hardware Replacement (NBD), Firmware and General Upgrades, 24x7 FortiCare Support, FortiGuard AS & AV, FortiGuard Virus Outbreak Protection, FortiSandbox Cloud, Click Protect (FECP), Content Disarm & Reconstruction, Business Email Compromise, Identity Based Encryption, Data Loss Prevention, Archiving plus term of contract

     

    Also if you read pag. 8 from this article: https://docs.fortinet.com/uploaded/files/4445/fortimail-v6.0.0-release-notes.pdf it says that the service should be included on basic BDL.

     

    Just to be clear, I'm not trying to convence you, but I'm having different answers from Fortinet, some says it's included, others says it's not.

    Announcements

    Select Forum Responses to become Knowledge Articles!

    Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

    Labels
    Top Kudoed Authors