Technical Tip: Tracking file scans events in FortiEDR

Description

This article describes how to filter and identify Periodic System file scan events in FortiEDR.

Scope

FortiEDR.

Solution

FortiEDR can execute periodic file scans if configured.

File scans can be configured weekly, bi-weekly, or monthly under Administration -> Settings -> File Scan option:

File scans do not generate logs or events by default after completion, but if during a File scan, a malicious file is detected, then a security event gets generated.

To track Periodic file scans, generate an Audit trail report (Administration -> Settings -> Audit Trail -> Select dates -> Generate Audit):

Filter the Excel by 'Periodic system scan' to get all records related to the file scans: