New Member

Question

EMS Only for FAZ

Forum|Forum|2 years ago
January 16, 2024
3 replies
1966 views

Hi - I have a question around getting EMS specific info from a FAZ. I have a Trial running where the EMS is only used for ZTNA access and WebFilter on the endpoint. No other features of the Forticlient such as AV. I have linked the FAZ and the EMS server and the EMS server is sending logs to the FAZ. However in the FAZ I am not seeing any data in reports if I only include the EMS devices. So my thinking is endpoint is not sending its logs for browsing to the EMS server ? I need to check that the endpoint can send logs of user activity to the FAZ directly ? What I want to achieve is to see usage of the ZTNA policies and endpoint browsing. None of that traffic is directed via the Gate so its all endpoint traffic I need to get from the endpoint to the EMS to the FAZ ? Or am I way off mark ?

Jean-Philippe_P

Staff & Editor

Hello TribeNZ,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

Jean-Philippe - Fortinet Community Team

New Member

Thanks - I am getting some data in there, but it is not reliable and does not provide web traffic. In some testing, I hit blocked sites on the endpoints that do not show in the report. I think Webfilter is not really the solution for securing web traffic and Sase would be more appropriate.

Jean-Philippe_P

Staff & Editor

Hello TribeNZ,

We are still looking for an answer to your question.

We will come back to you ASAP.

Thanks,

Jean-Philippe - Fortinet Community Team

Staff

Hi,

Please review the following articles:

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-integrate-EMS-in-the-FortiAnalyzer/ta-p/190143
https://docs.fortinet.com/document/fortianalyzer/7.4.2/administration-guide/513591/forticlient-support-and-adoms
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Control-logging-from-FortiClient-EMS-to/ta-p/244327
https://docs.fortinet.com/document/fortianalyzer/7.2.1/administration-guide/743670/configuring-log-storage-policy
https://community.fortinet.com/t5/FortiAnalyzer/Troubleshooting-Tip-How-to-investigate-log-visibility-after/ta-p/197350
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Enable-FortiAnalyzer-to-receive-log-from/ta-p/218388
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-make-multitenancy-visible-from/ta-p/264308
https://docs.fortinet.com/document/fortianalyzer/6.4.0/new-features/350431/ems-connector

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-run-a-FortiClient-Endpoint-Antivirus/ta-p/270412
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-implement-Indicators-Of-Compromised-IOC/ta-p/192722
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-determine-the-failed-status-from-FortiSoC/ta-p/270417

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-integrate-EMS-in-the-FortiAnalyzer/ta-p/190143
https://docs.fortinet.com/document/fortianalyzer/7.4.2/administration-guide/513591/forticlient-support-and-adoms
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Control-logging-from-FortiClient-EMS-to/ta-p/244327
https://docs.fortinet.com/document/fortianalyzer/7.2.1/administration-guide/743670/configuring-log-storage-policy
https://community.fortinet.com/t5/FortiAnalyzer/Troubleshooting-Tip-How-to-investigate-log-visibility-after/ta-p/197350
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Enable-FortiAnalyzer-to-receive-log-from/ta-p/218388
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-make-multitenancy-visible-from/ta-p/264308
https://docs.fortinet.com/document/fortianalyzer/6.4.0/new-features/350431/ems-connector

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-run-a-FortiClient-Endpoint-Antivirus/ta-p/270412
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-implement-Indicators-Of-Compromised-IOC/ta-p/192722
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-determine-the-failed-status-from-FortiSoC/ta-p/270417

best,