FortiSandbox Quota

[SecurityPlus]

We manage FortiGate firewalls like the 60D, 60E, and 100D. Sometimes we see messages about reaching the FortiSandbox quota for the day. Any way to reduce the amount of traffic going through the FortiSandbox? The only thing I can think of is to put items that should not be scanned with the Sandbox prior to the policy that uses the Sandbox.

[ede_pfau · Accepted solution]

Check the command 'sandboxing-prefilter' in the CLI Reference. One can exclude file types (e.g., .dll) which seldom are executable by themselves. Similar, 'sandboxing-embeddedurl' to filter on inside URLs of PDF and Office documents.

[SecurityPlus]

Ede,

Thank you very much. Will look into this.