I installed Forticlient yesterday, to use with my CF just to see this new version and I came across this new option, which translated into English means:
"Dynamic Threat Detection Using Threat Intelligence Data"
Has anyone tested and could tell how efficient this dynamic detection is?
Are these for the free or paid version? Thanks
Quite impressed with Forticlient about detecting CCleaner's suspicious behavior.
Some people may even argue that FortiClient doesn't contain an AV.
If you just want the web-filter then how about using their DNS? Poll - Which DNS Server do you use? /DNS Tunnelling
It'll probably connect to their cloud environment where the APT sandbox is present. The APT sandbox will basically execute the target under strict virtualisation and analyse behavior, format into detailed logs. The logs are interpreted to determine good from bad and vice-versa. It is basically Cuckoo on steroids x1000000 for stability, security, reliability/accuracy and efficiency.
What is the difference between hybrid-analysis, Cuckoo and FortiSandbox?
Cuckoo injects code into the monitored sample and then it abuses this leverage to patch the memory of various routines exported by modules like NTDLL. It does attempt to identify attacks on its hooks and alike and prevent it but it won't be perfect. It doesn't "isolate" the sample itself. The logs may also be a bit misleading sometimes (as is Hybrid-Analysis) - e.g. the Windows Loader queries a registry key, now it shows in logs and makes you think the sample itself did that via the authors code... Now you are there wondering if it was internally done by Windows itself or not, because the logs for Cuckoo doesn't provide the call stack AFAIK (neither does Hybrid-Analysis in the same sense AFAIK).
Lots of questions...
1) You could use it just as a web filter (a very good one at that) by just installing the web filtration module during the installation and unchecking the other features. Howwever as someone else noted, you could also use FortiGuard DNS (for free) to do virtually the same thing.
Fortinet Secure DNS (malware/phishing/malvertising/botnet blocking)
208.91.112.53
208.91.112.52
2) It DOES include a BB now. In the GUI under settings you will find 'Dynamic Thread Detection using threat intelligence data'. That's basically the BB and you can turn it on in the free version in the GUI.
3) Sandbox aspects are not free. These work in conjunction with their appliances. As Opcode noted, it's an extremely advanced sandbox appliance that works on your network and if necessary integrates into the Forticlient. Without a Fortigate edge device AND FortiSandbox, you won't be able to use these features. However, you will have the benefit of everything else, including the exploit blocker, etc.
4) Exploit, BB (dynamic threat detection) don't use signatures. However Forticlient includes signatures for their other aspects such as the antivirus. By default, extreme signatures and deep heuristics are ON for on-demand scans but OFF for real-time protection. They can be ticked on for realtime under the INI settings posted about earlier. I recommend they be enabled unless you have an old, slow dual-core machine or something.
The benefit of having Fortinet hardware is - endpoint management, sandboxing, localized update pushes, compliance scans and as part of the Security Fabric of Fortinet. Otherwise, the free client does everything else.
As you can see from my setup, I have the full security fabric deployed.
