An analyst wants to create an incident and generate a report whenever FortiAnalyzer generates a malicious
attachment event based on FortiSandbox analysis. The endpoint hosts are protected by FortiClient EMS
integrated with FortiSandbox. All devices are logging to FortiAnalyzer.
Which connector must the analyst use in this playbook?