FortiNAC Endpoint Compliance Cybereason

Currently this antivirus is not supported by FortiNAC but you can raise a 'New Feature Request (NFR)' over your local Fortinet representatives to add support for it.

For now, you can try to achieve the requirement by calling a second scan if the antivirus check failed the first one, like shown here:

Hi Rafael

I didn't use FNAC since a while but if I remember well I think you can do that by creating two compliance rules, one with AV, and the second with custom scan, then adding the client hosts with Cybereason Antivirus in a separate group, then apply the compliance rule with custom scan to only that group. The other group having SentinelOne AV will be scanned by the regular rule (with normal AV check).

It sounds like you have a policy in there that evaluates the host as being allowed to be on the network. It is weird that if you disable the host it goes back online but I'm pretty positive that it is a rule that allows the host to be on the network and I suspect it is a rule that looks for the persistent agent as that is a common rule to have.