Technical Tip: Explanation of Device Security information

Description

This article provides details about Device Security information.

Scope

FortiEDR Collector v6.1 and above.

Solution

Device Security information is a feature introduced in the latest Collector 6.1+ versions. Device Security information allows the EDR console to show security information.

This information is shared by the collector if the latest versions are running on the devices.

EDR manager, by default, will classify the device as Compliant or Partially compliant, depending on the device status.

Windows device:

For Windows collectors, the following information is provided:

• IsWindowsFirewallEnabled

• IsWSCRegistered

• IsBitlockerEnabled

• IsUACEnabled

• IsWindowsUpdated
  
  

macOS device:

For macOS collectors, the following information is provided:

• IsSipEnabled

• IsGateKeeperEnabled

• IHostFirewall Enabled

• IsDiskEncryptionEnabled
  
  

In several cases, if the device is compliant but still not showing on an EDR console, a restart/reboot on the collector side may be needed.