Cybersecurity Forum

This forum is for all security enthusiasts to discuss Fortinet's latest & evolving technologies and to connect & network with peers in the cybersecurity hemisphere. Share and learn on a broad range of topics like best practices, use cases, integrations and more. For support specific questions/resources, please visit the Support Forum or the Knowledge Base.

BobPatr
New Contributor

FortiClinent quarantine

Can FortiCllient find malware on a FortiCleint-equipped PC?

Can FortiClient then alert the EMS to the fact that there's an infected PC?  Can it tell the EMS which PC it is?  If so, what's that information? 

And then can the EMS manager use it to quarantine the infected/reporting PC?  Can the PC really be quanrantined to break the operation of the malware? 

2 REPLIES 2
joe_FTNT
Staff
Staff

Q1: Can FortiCllient find malware on a FortiCleint-equipped PC? — Yes indeed ---

Q2: Can FortiClient then alert the EMS to the fact that there's an infected PC? —Yes, alerts are sent to EMS and an email alert can be generated and sent out from EMS as well ---

Q3: Can it tell the EMS which PC it is? If so, what's that information? — Yes, the machine and usually logged in user is visible in EMS as well as the summary of the alert (virus detected, virus name)--

Q4: And then can the EMS manager use it to quarantine the infected/reporting PC? — You can then manually quarantine the entire system by right clicking in EMS and choosing Quarantine--

Q5: Can the PC really be quanrantined to break the operation of the malware? — Yes. FortiClient will enable a feature that then blocks all inbound and outbound traffic from that endpoint locally. The endpoint at this point can only accept communication from EMS so that it can be ‘unquarantined’ after the endpoint is remediated.

Further information can be logged and reported on by FortiAnalyzer.

From: "Bob Patrick via forticlient.public" >">mailto:forticlient.public@fuse-lists.fortinet.com>>
Reply-To: "forticlient.public@fuse-lists.fortinet.com<mailto:forticlient.public@fuse-lists.fortinet.com>" >">mailto:forticlient.public@fuse-lists.fortinet.com>>
Date: Thursday, September 22, 2016 at 3:03 PM
To: "forticlient.public@fuse-lists.fortinet.com<mailto:forticlient.public@fuse-lists.fortinet.com>" >">mailto:forticlient.public@fuse-lists.fortinet.com>>
Subject: [forticlient.public] - FortiClinent quarantine
Resent-From: >">mailto:forticlient.public@fuse-lists.fortinet.com>>
Resent-Date: Thursday, September 22, 2016 at 3:03 PM


Can FortiCllient find malware on a FortiCleint-equipped PC?

Can FortiClient then alert the EMS to the fact that there's an infected PC? Can it tell the EMS which PC it is? If so, what's that information?

And then can the EMS manager use it to quarantine the infected/reporting PC? Can the PC really be quanrantined to break the operation of the malware?

-----End Original Message-----
Joe Martins
Director Product Management
BobPatr

JOE—

Wonderful! Thanks!

BOB

From: Joe Martins via forticlient.public [mailto:forticlient.public@fuse-lists.fortinet.com]
Sent: Thursday, September 22, 2016 4:14 PM
To: forticlient.public@fuse-lists.fortinet.com
Subject: [forticlient.public] - RE: FortiClinent quarantine


Q1: Can FortiCllient find malware on a FortiCleint-equipped PC? — Yes indeed ---

Q2: Can FortiClient then alert the EMS to the fact that there's an infected PC? —Yes, alerts are sent to EMS and an email alert can be generated and sent out from EMS as well ---

Q3: Can it tell the EMS which PC it is? If so, what's that information? — Yes, the machine and usually logged in user is visible in EMS as well as the summary of the alert (virus detected, virus name)--

Q4: And then can the EMS manager use it to quarantine the infected/reporting PC? — You can then manually quarantine the entire system by right clicking in EMS and choosing Quarantine--

Q5: Can the PC really be quanrantined to break the operation of the malware? — Yes. FortiClient will enable a feature that then blocks all inbound and outbound traffic from that endpoint locally. The endpoint at this point can only accept communication from EMS so that it can be ‘unquarantined’ after the endpoint is remediated.

Further information can be logged and reported on by FortiAnalyzer.

From: "Bob Patrick via forticlient.public" >">mailto:forticlient.public@fuse-lists.fortinet.com>>
Reply-To: "forticlient.public@fuse-lists.fortinet.com<mailto:forticlient.public@fuse-lists.fortinet.com>" >">mailto:forticlient.public@fuse-lists.fortinet.com>>
Date: Thursday, September 22, 2016 at 3:03 PM
To: "forticlient.public@fuse-lists.fortinet.com<mailto:forticlient.public@fuse-lists.fortinet.com>" >">mailto:forticlient.public@fuse-lists.fortinet.com>>
Subject: [forticlient.public] - FortiClinent quarantine
Resent-From: >">mailto:forticlient.public@fuse-lists.fortinet.com>>
Resent-Date: Thursday, September 22, 2016 at 3:03 PM


Can FortiCllient find malware on a FortiCleint-equipped PC?

Can FortiClient then alert the EMS to the fact that there's an infected PC? Can it tell the EMS which PC it is? If so, what's that information?

And then can the EMS manager use it to quarantine the infected/reporting PC? Can the PC really be quanrantined to break the operation of the malware?

-----End Original Message-----

-----End Original Message-----
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.