Fortigate integration with EMS

The indicator of compromise is a function that is licensed specifically on the analyzer, and it takes data from the logs and checks against their curated lists. The analyzer will then alert the fortigate that an endpoint IP is likely compromised. The reason for the indirect notification path is likely because there are existing 2-way communication between the firewalls and the EMS systems so just use the existing paths rather than create new methods. A more direct approach is probably better, and maybe they should eventually work on it, but it probably doesn't exist on its own now.

The on-client web filter can be turned off if it detects that it is on a network with a fortigate. There is an option in the web filter tab of a profile on EMS to use "client web filtering when on-net" or something like that. If you set the on-net detection rules properly, the client web filter will turn off and use whatever web filter you have at your network perimeter. When it detects it's no longer on-net, it will turn on the local web filter and use whatever policy is set in the EMS.

The on-net detection isn't 100% bulletproof and in theory can be tricked if someone knows the parameters you have set, but it's an option.

KimoAnalyzer wrote:
 

Secondly: when configuring Endpoint compliance profile in a FG policy to enforce a certain web profile: does this mean that the endpoint will make the web filtering itself? in other words if this security policy has already a web filter profile : then webfiltering inspection will happen twice (once on the Endpoint and once on the Fortigate)