FortiSandbox

The OpenCTI FortiSandbox enrichment connector enriches StixFile and Artifact observables with Fortinet FortiSandbox verdicts. For each observable it queries the FortiSandbox JSON-RPC API by hash (SHA-256/SHA-1/MD5), maps the rating (clean, low/medium/high risk, suspicious, malicious) to an OpenCTI score and labels, completes the file hashes, and attaches a STIX Malware Analysis object with the FortiSandbox result. When enabled, unknown files carried by the observable can be submitted for on-demand analysis and polled for a verdict. The connector is playbook compatible and always returns the enriched bundle.