Within FortiSandbox's scan process, the tracer engine executes and observes file behavior in a virtual environment, while the rating engine takes over afterward: it analyzes the data produced by the tracer engine, checks the file's hash against the FortiGuard database (to quickly identify known clean or malicious files without needing full re-analysis), and ultimately generates the verdict/rating (such as Clean, Low Risk, Medium Risk, High Risk, or Malicious) for the scanned object. Rating third-party device security and distributing verdicts to other Fortinet devices are not functions performed by the rating engine itself.
Community Discussion