In a ForliSandbox integration, what does the remediation option do?

In the context of FortiClient's FortiSandbox integration, "remediation" refers to the action taken after a file has been analyzed and confirmed to be malicious. The endpoint profile settings provide options for this scenario. One of the available remediation actions is Alert Only. This action logs the event and notifies the user and/or administrator about the malicious file detection without automatically quarantining it. While quarantine is another remediation option, "Alert and notify only" is a valid and selectable action within the configuration.

A. Denying access based on "no results" is not remediation; it's a preventative blocking action for unknown files, which is a separate setting.

C. Excluding specified files is a pre-scanning configuration to prevent certain files or paths from being sent to the Sandbox, not a post-detection remediation action.

D. Waiting for results before allowing a file is a preventative measure known as "Block malicious files when FortiSandbox detects malware," not a remediation action on a detected threat.

1. FortiClient EMS 7.2 Administration Guide, Page 119, "Sandbox". The guide lists the configurable actions for "When a malicious file is detected by FortiSandbox," which include "Alert Only" and "Quarantine File."