Network Security & Firewalls

Multi-layer proactive threat mitigation

Today's most sophisticated cybercriminals are increasingly bypassing traditional antimalware solutions and inserting advanced persistent threats deep within networks. These highly targeted attacks evade established signature-based detection by masking their malicious nature in many ways - compression, encryption, polymorphism, the list of techniques goes on. Some have even begun to evade virtual "sandbox" environments using VM detection, "time bombs" and more. Fighting today's attacks requires a comprehensive and integrated approach - more than antimalware. More than a virtual sandbox. More than a separate monitoring system. FortiSandbox offers a robust combination of proactive detection and mitigation, actionable threat insight and integrated and automated deployment. At its foundation is a unique, duallevel sandbox which is complemented by Fortinet's award-winning antimalware and optional integrated FortiGuard threat intelligence. Years of Fortinet threat expertise is now packaged up and available on site or in the cloud via FortiSandbox.

Proactive Detection and Mitigation
Suspicious codes are subjected to multi-layer pre-filters prior to execution in the virtual OS for detailed behavioral analysis. The highly effective pre-filters include a screen by our AV engine, queries to cloud-based threat databases and OS-independent simulation with a code emulator, followed by execution in the full virtual runtime environment. Once a malicious code is detected, granular ratings along with key threat intelligence is available, a signature is dynamically created for distribution to integrated products and full threat information is optionally shared with FortiGuard Labs for the update of global threat databases.

Actionable Insight
All classifications - malicious and high/medium/low risk - are presented within an intuitive dashboard. Full threat information from the virtual execution - including system activity, exploit efforts, web traffic, subsequent downloads, communication attempts and more - is available in rich logs and reports.

Fortinet's top-rated FortiSandbox is at the core of the Advanced Threat Protection (ATP) solution that integrates with Fortinet's Security Fabric to address the rapidly evolving and more targeted threats across a broad digital attack surface. Specifically, it delivers real-time actionable intelligence through the automation of zero-day, advanced malware detection and mitigation.

Broad Coverage of the Attack Surface with Security Fabric

Effective defense against advanced targeted attacks through a cohesive and extensible architecture working to protect networks, emails, web applications and endpoints from campus to the cloud.

Automated Zero-day, Advanced Malware Detection and Mitigation

Native integration and open APIs automate the submission of objects from Fortinet and third-party vendor protection points, and the sharing of threat intelligence in real time for immediate threat response and reduction on the reliance on scarce security resources.

Certified and Top Rated

Constantly undergoes rigorous, real-world independent testing and consistently earns top marks in dealing with known and unknown threats.

FEATURES | Sandbox Malware Analysis

Complement your established defenses with a two-step sandboxing approach. Suspicious and at-risk files are subjected to the first stage of analysis with Fortinet's awardwinning AV engine, FortiGuard global intelligence query, and code emulation. Second stage analysis is done in a contained environment to uncover the full attack lifecycle using system activity and callback detection. Figure 1 depicts new threats discovered in real time.

In addition to supporting FortiGate, FortiMail, FortiWeb, FortiADC, FortiProxy, FortiClient (ATP agent) and FabricReady Partner submission, third-party security vendor offerings are supported through a well-defined open API set.

Reporting and Investigative Tools

Reports with captured packets, original file, tracer log, and screenshot provide rich threat intelligence and actionable insight after files are examined (see Figure 2). This is to speed up remediation.

Threat Mitigation

Fortinet's ability to uniquely integrate various products with FortiSandbox through the Security Fabric offers automatic protection with incredibly simple setup. Once a malicious code is identified, the FortiSandbox will return risk ratings and the local intelligence is shared in real time with Fortinet and third-party vendor-registered devices and clients to remediate and immunize against new advanced threats. The local intelligence can optionally be shared with Fortinet threat research team, FortiGuard Labs, to help protect organizations globally. Figure 3 steps through the flow on the automated mitigation process.

DEPLOYMENT OPTIONS | Easy Deployment

FortiSandbox supports inspection of many protocols in one unified solution, thus simplifies network infrastructure and operations. Further, it integrates within the Security Fabric adding a layer of advanced threat protection to your existing security architecture.

The FortiSandbox is the most flexible threat analysis appliance in the market as it offers various deployment options for customers' unique configurations and requirements. Organizations can choose to combine these deployment options.

Standalone

This FortiSandbox deployment mode accepts inputs as an ICAP server or from spanned switch ports or network taps. It may also include administrators' on-demand file uploads or scanning of file respositories via CIFs or NFS through the GUI. It is the ideal option to enhancing an existing multi-vendor threat protection approach.

Top-Rated AI-Powered Breach Protection

Top-rated AI-powered FortiSandbox is part of Fortinet's breach protection solution that integrates with Fortinet's Security Fabric platform to address the rapidly evolving and more targeted threats including ransomware, crypto-malware, and others across a broad digital attack surface. Specifically, it delivers real-time actionable intelligence through the automation of zero-day advanced malware detection and response.

Attack Surface Broad Coverage with Security Fabric

Effective defense against advanced targeted attacks through a cohesive and extensible architecture working to protect networks, emails, web applications, and endpoints from campus to the public cloud, and Industrial Control System (ICS) devices found in an Operational Technology (OT) environment.

Automated Zero-day Advanced Malware Detection and Response

Native integration and open APIs automate the submission of objects from Fortinet and third-party vendor protection points, and the sharing of threat intelligence in real time for immediate threat response and reduction on the reliance on scarce security resources.

Certified and Top Rated

Constantly undergoes rigorous, real-world independent testing such as NSS Labs Breach Detection Systems (BDS) and Breach Prevention Systems (BPS) and ICSA Labs Advanced Threat Defense (ATD) and consistently earns top marks in dealing with known and unknown threats.

Fortinet's top-rated FortiSandbox is at the core of the Advanced Threat Protection (ATP) solution that integrates with Fortinet's Security Fabric to address the fast moving and more targeted threats across a broad attack surface. Specifically, it delivers real-time actionable intelligence through the automation of zero-day, advanced malware detection and mitigation.

Broad Coverage of the Attack Surface with Security Fabric
Effective defense against advanced targeted attacks through a cohesive and extensible architecture working to protect network, application layers and endpoint devices.

Automated Zero-day, Advanced Malware Detection and Mitigation
Native integration and open APIs automate the submission of objects from Fortinet and third-party vendor protection points, and the sharing of threat intelligence in real time for immediate threat response.

Certified and Top Rated
Constantly undergoes rigorous, real-world independent testing and consistently earns top marks.

Sandbox Malware Analysis
Complement your established defenses with a two-step sandboxing approach. Suspicious and at-risk files are subjected to the first stage of analysis with Fortinet's awardwinning AV engine, FortiGuard global intelligence query, and code emulation. Second stage analysis is done in a contained environment to uncover the full attack lifecycle using system activity and callback detection. Figure 1 depicts new threats discovered in real time.

In addition to supporting FortiGate, FortiMail, FortiWeb, and FortiClient (ATP Agent) file submission, third-party security vendor offerings are supported through a well-defined open API set.

Reporting and Investigative Tools
Reports with captured packets, original file, tracer log, and screenshot provide rich threat intelligence and actionable insight after files are examined (see Figure 2). This is to speed up remediation.

Threat Mitigation
Fortinet's ability to uniquely integrate various products with FortiSandbox offers automatic protection with incredibly simple setup. Once a malicious code is identified, the FortiSandbox will return risk ratings and the local intelligence is shared in real time with Fortinet and third-party vendor-registered devices and clients to remediate and immunize against new advanced threats. The local intelligence can optionally be shared with Fortinet threat research team, FortiGuard Labs, to help protect organizations globally. Figure 3 steps through the flow on the automated mitigation process.

Easy Deployment
FortiSandbox supports inspection of many protocols in one unified solution, thus simplifies network infrastructure and operations. Further, it integrates within the Security Fabric adding a layer of advanced threat protection to your existing security architecture. The FortiSandbox is the most flexible threat analysis appliance in the market as it offers various deployment options for customers' unique configurations and requirements. Organizations can choose to combine these deployment options.

Top-Rated AI-Powered Breach Protection

Top-rated AI-powered FortiSandbox is part of Fortinet's breach protection solution that integrates with Fortinet's Security Fabric platform to address the rapidly evolving and more targeted threats including ransomware, crypto-malware, and others across a broad digital attack surface. Specifically, it delivers real-time actionable intelligence through the automation of zero-day advanced malware detection and response.

Attack Surface Broad Coverage with Security Fabric

Effective defense against advanced targeted attacks through a cohesive and extensible architecture working to protect networks, emails, web applications, and endpoints from campus to the public cloud, and Industrial Control System (ICS) devices found in an Operational Technology (OT) environment.

Automated Zero-day Advanced Malware Detection and Response

Native integration and open APIs automate the submission of objects from Fortinet and third-party vendor protection points, and the sharing of threat intelligence in real time for immediate threat response and reduction on the reliance on scarce security resources.

Certified and Top Rated

Constantly undergoes rigorous, real-world independent testing such as NSS Labs Breach Detection Systems (BDS) and Breach Prevention Systems (BPS) and ICSA Labs Advanced Threat Defense (ATD) and consistently earns top marks in dealing with known and unknown threats.