According to FortiSandbox documentation on Real-Time Anti-Phishing, a URL can only be forwarded to the RTAP cloud service if the scan profile's VM Association tab has the WEBLink file type associated with a VM image, since the URL must first be submitted to a sandboxing VM for dynamic analysis before RTAP evaluation occurs. WEBLink (the URL-detection file type) is separate from the 'Web' file type group, which only covers files such as htm, js, lnk, and url that represent shortcuts/embedded links rather than actual URL submissions. If WEBLink is not selected/associated with a VM image in the profile, URLs never enter the VM scan pipeline and therefore are never sent to the RTAP service, even though URL is enabled in the Pre-Filter tab and the Real-time Zero-Day Anti-Phishing Service toggle is enabled under Advanced settings.
Community Discussion