Fortinet FortiSandbox Zero-Day Threat Protection (On-Demand)

The company came to us and provided a proof of concept (POC) for six or seven months for testing the machine and evaluating how we can use Fortinet FortiSandbox . Also, we use FortiSandbox  for scanning files, like attachments.

Currently, there isn't a standout feature. We use Fortinet FortiSandbox for scanning files such as attachments, and we have not faced any issues so far. Up to now, it is performing well.

We sometimes face a delay in email scanning due to not having multiple virtual machines. Improvements could be made in dynamic scanning, scanning all email components such as URLs and attachments, and analyzing the Sandbox response. Additionally, better integration with cloud solutions and enhanced performance would be beneficial.

I have been using FortiSandbox for six months, specifically for testing purposes on the Alibaba Cloud  platform.

The solution is stable up to now because it is still new, just six months maximum.

The solution's performance is fine and more improved compared to the last two months.

As of now, I've primarily been in contact with the consultants for support and have only needed one ticket with Fortinet. I have no substantial experience with Fortinet's direct technical support.

Neutral

I previously used Cisco, but Fortinet is much easier in terms of configuration and service time.

The initial setup of Fortinet was easy, more so than other products. Even though I'm not directly involved, it has been very easy to work with Fortinet, especially compared to other solutions.

It was a combined effort. A consultant from an external company worked alongside us on the implementation. Most of the integration and support involved consultants.

I think it's affordable. For the six to seven months of usage, the cost has been reasonable.

FortiSandbox is rated five out of ten. It meets the requirements but still has room for growth and improvements.

We use FortiSandbox  for scanning files and images that pass through our networks. It integrates with different devices, such as five adapters and other Fortinet devices.

It is time-saving and more secure. It saves us from a lot of antivirus and anti-malware issues.

The adapter is beneficial as it allows integration with various devices, not just Fortinet.

It would be better if we could integrate FortiSandbox  with endpoint security solutions. This would allow us to scan files opened by the endpoint user and not just over the network.

I have about one year of experience working with FortiSandbox.

I would rate the stability of FortiSandbox as eight out of ten.

I would rate the scalability of FortiSandbox as eight out of ten.

Fortinet provides really good technical support. They introduce high-level support for us.

Positive

The initial configuration is straightforward and not difficult. We have an ID for port one and can assign port three for ID two for the device.

I am not familiar with the pricing because my role is strictly technical.

I recommend using FortiSandbox, especially if your environment relies on FortiGate  devices or is integrated with Fortinet. It ensures better compatibility.

I'd rate the solution nine out of ten.

We use Fortinet FortiSandbox for malware analysis, seamlessly integrating with various solutions such as FortiGate, FortiMail for Mail Security, FortiWeb, and other endpoints. FortiSandbox also supports ICAP integration with FortiWeb, enhancing its capabilities. These integrations can be configured within FortiSandbox, either internally or externally. Additionally, FortiSandbox offers integration with Exchange as an adapter.

The integration is easy with other Fortinet products like FortiMail. The technology of sandboxing FortiSandbox can cover it.

Fortinet FortiSandbox has the capability for manual analysis' Unlike its competitors, FortiSandbox offers functionalities such as banning, sniffing, and analyzing traffic in the network. It can connect as a bandwidth analyzer and provide analytics on the network traffic. It's not limited to just sandboxing; it can also operate at the endpoint, firewall, or gateway levels to submit files for analysis and monitor network traffic for analysts.

The solution must focus on API integration with other vendors.

I have been using Fortinet FortiSandbox as an integrator since 2017.

The solution is stable on dedicated appliances like virtual machines. It also depends on the capabilities of the host system, including CPU and RAM.

The solution is scalable. You can configure up to one hundred nodes as workers. Additionally, you can include up to ninety-eight worker nodes in other models, allowing them to function as a cluster.

It has a defense line from zero-day attacks and sophisticated attacks. You will need an EDR solution and the endpoint.

Six persons are using this solution.

Customer support is friendly and has a good team.

A network security engineer can deploy the solution. The organization's IT department manages administration, including application and network security. Multiple administrators may use FortiSandbox, each with their front-end interface for managing it.

The solution provide zero-day attacks which benefitted a lot.

If the customer's operating system is supported, there's no need for a custom package. It's straightforward. If a custom operating system is required, it will take longer due to the need for package customization.

Overall, I rate the solution an eight out of ten.

We implemented FortiSandbox in three main steps: planning the infrastructure and topology, setting up dedicated Internet access for the sandbox, and configuring manual uploading and email forwarding. For email communication, we used either FortiMail or BCC/force mirroring solutions. FortiSandbox has successfully identified and blocked email attachments containing threats. 

The real-time analysis capability of FortiSandbox is beneficial for email analysis, but it's not practical for real-time web traffic analysis because users won't wait for the FortiSandbox to complete its analysis before accessing content.

I have experience working with Fortinet FortiSandbox, but it's been about one year since the first implementation.

It is stable

The solution is scalable especially suitable for enterprise businesses.

I haven't needed technical support, and while the pricing can be expensive, the performance and security it offers are commendable.

I rate the initial setup of Fortinet FortiSandbox as a little bit difficult due to licensing issues,

I would recommend FortiSandbox for high-security environments like financial or government sectors. Overall, I rate it an eight out of ten.