Skip to main content
SteveRoadWarrior
SteveRoadWarrior
New Member
January 25, 2018
Question

EMS and Forticlient not reporting virus infection

  • January 25, 2018
  • 1 reply
  • 4228 views

We're getting no telemetry from the FortiClient to our EMS Server about virus infections.

We get all kinds of great information about Forticlient and vulnerabilities.

 

I get the fact that we would need a FortiAnalyzer to read the web logging telemetry.

 

But AV infections is pretty important and we're not getting any info back from the clients.

If I had to choose between vulnerabilities, which are working, and viruses which is not working I'd pick knowing about viruses any way. 

Anyone else noticing this?

 

    1 reply

    SteveG
    SteveG
    New Member
    January 25, 2018

    On our EMS we have a widget on the FortiClient Status page that shows PC's with infections. Also in the All Endpoints view there's a filter to show only clients that have an AV Event... We're running EMS 1.2.2

    SteveRoadWarrior
    SteveRoadWarriorAuthor
    New Member
    January 29, 2018

    Thanks for the reply.  We think we've worked it out.

     

    EMS 1.2.3 here.  We found two problems with our install:

     

    1) we needed to open port 8014 inbound to the EMS Server to receive telemetry from FortiClients on an external IP.

    2) we found we need to cycle the Forti.... services once a day, or we don't get details about the infections.  Looks like some sort of SQL exhaustion, maybe we used the wrong SQL (express vs. full SQL).  We haven't run that down yet.

     

    to sum up:

    - forticlients report vulnerability management on port 8013 (or 443/10443, haven't dug into it yet)

    - forticlients report AV, Web Vulnerability and Firewall/Application blocking on port 8014 of the EMS server

    Terms & ConditionsAccessibility statement