what is compromised host by verdict

Forum|Forum|2 years ago
July 9, 2024
3 replies
6615 views

hi all,

I happened to find there are compromised host under Security tab of dashboard, why are they here? Are they attacked?

And the host are dynamically displayed. 2 days ago, it displays 2 host, now it displays only 1 host. What are the criteria for this?

How can I remove them from here (to really solve the problem).

Thanks!

mpapisetty

Staff

Hi @sean3 ,

This is a list of hosts that are analyzed to be compromised by the security fabric.

More information can be found here - https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/110327/viewing-session-information-for-a-compromised-host

You could look at all the sessions and the security actions taken based on the inspection to understand what traffic was blocked.

There are also configurable threat weights - https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/250999/log-settings-and-targets#ThreatWeight - and these are used to calculate an overall threat score that is then used to mark an endpoint as compromised.

sean3Author

Explorer II

thanks mpapisetty for the advice.

so, it does not require to take any specific action, right?

mpapisetty

Staff

It depends on the 13 sessions that got blocked. What sort of sessions are these? If they look expected (for example, someone was testing a virus download to test firewall efficacy etc), you can ignore the alert. If not, you will have to look at the host to see if something is indeed compromised and take corrective action.

Sign up

Login with SSO

Login to the community

Login with SSO