There are a few places to check, depending on what FortiEDR blocked and what kind of exception needs to be created.
Check the endpoint popup and Activity Log first:
When FortiEDR blocks a process, the endpoint can show a popup with the process name and PID. Example: 'Connection blocked for process powershell.exe PID 6996'.
To identify the blocked item from the endpoint:
Note the process name and PID from the popup.
Open the FortiEDR Tray App / Activity Log by selecting the FortiEDR system tray icon.
In the Activity Log, find the matching PID and note the corresponding RAW ID.
This is useful because the RAW ID can then be searched in the Manager to locate the event.
Search the event in FortiEDR Manager:
After getting the RAW ID: Go to Event Viewer in FortiEDR Manager Search for the RAW ID to find the corresponding event If nothing appears in All, switch to Archived, because archived events are not shown in the All view.
From the event, it is possible to review details such as: process name. classification. process path. raw data items. triggered rules.
The Incidents/Event Viewer also supports: free text search by process, device, or ID. sorting by columns. opening Exception Manager. launching Investigate for process-chain analysis.
Create the exception from the event itself:
Open the relevant security event. Select Exception Manager. Configure the exception parameters. Save/apply the exception.
Supported exception criteria include: Exceptions can be very granular, for example: Allow an application only from an exact path. Allow it only when created by a specific parent process. Apply it only for specific users or destinations.
If it was an Application Control block, check the Application Control view:
If the process was blocked because of Application Control (predefined blocked apps that are not allowed to launch), the blocked event can be confirmed in Event Viewer under the Application Control view.
Note: Application Control Manager is for blocking predefined applications from launching.
Applications can also be added to the block list from Forensics or Threat Hunting, and then they appear in Application Control Manager.
For events not visible in Event Viewer:
There are several reasons why a popup may appear, but the event is not immediately available in Event Viewer:
Possible causes:
The event may actually belong to Communication Control, not Event Viewer. The event may be aggregated in the default Process view and hidden under an aggregated entry. The collector may have connectivity/status issues.
What to verify: Collector status is Running in Inventory: Collectors or via CLI. Collector is connected to the Aggregator server on TCP 8081 and Core on 555. The tray app shows Connection Status: Connected.
Local OS logs can also help:
For Windows endpoints, blocked communication or ransomware-related file modification activity is also recorded in the local Windows Event Viewer under: Event Viewer -> Windows Logs -> Application. This can help confirm what was blocked on the endpoint, even before creating an exception in the Manager.
Which type of allow rule/exclusion to use:
There are two common methods, depending on what was blocked:
Security Event Exception:
Use this when a legitimate activity triggered a FortiEDR security event and the exact behavior with context should be allowed.
Best when scoping the exception by:
process. parent process. path. user. destination. triggered rule.
Exclusions:
Use Exclusion Manager to exclude trusted software from FortiEDR scanning/monitoring more broadly.
Fortinet distinguishes:
Execution Prevention exclusion: excludes files/directories from NGAV execution-prevention scanning.
Process exclusion: excludes a process from post-execution monitoring such as exfiltration/ransomware prevention.
Fortinet also notes that to fully exclude both the file and its process behavior, configure: Practical workflow: Reproduce or identify the block on the endpoint popup. Note the PID. Open FortiEDR Tray App / Activity Log and get the RAW ID. Search the RAW ID in Event Viewer (and Archived if needed). Review event details such as path, rule, and parent process. Click Exception Manager and create a granular exception. If the block was from app launch prevention, also verify Application Control view/Application Control Manager. For broader trust-based bypassing, use Exclusion Manager instead.
| 
