The Tracer engine in FortiSandbox executes a sample within the sandbox environment and observes its runtime behavior. It specifically monitors network activity such as web URLs the sample attempts to access, file system changes such as new files and processes generated during execution, and registry activity such as keys being created, modified, or deleted. Determining sample file types and comparing checksums against previous verdicts are handled by other FortiSandbox components (pre-scan/pre-filtering and rating engines), not the tracer itself.
Community Discussion