Troubleshooting Tip: Top threat information is not displayed in FortiView menu for FortiClient section

[HernandezA]

Description	This article describes the process to validate steps needed to receive Threat information in Fortiview menu for FortiClient section.
Scope	FortiAnalyzer, FortiAnalyzer Cloud, EMS Cloud, EMS, FortiClient.
Solution	Prerequisites: The user has already created the FortiAnalyzer/FortiManager Cloud instance in the same account as the device with the available license feature. (See the Cloud deployment guide). The user has access to the FortiAnalyzer/FortiManager Cloud instance with an administrator account. Integrate FortiClient EMS in the FortiAnalyzer (Technical Tip: How to integrate FortiClient EMS in the FortiAnalyzer). Context: The FortiAnalyzer has a menu to display a summary of threats related with endpoints for Forticlient logs source, in order to generate that information, the FortiAnalyzer must receive specific logs (Threats) and the EMS must be in specific ADOM type (Fabric), if there is not received that information the FortiAnalyzer cannot show any data. Fortiview -> Threats -> Top Threats (FortiClient). Configuration steps: Confirm the EMS connection in device manager of FortiAnalyzer and validate the system profile in EMS has the setting enabled for logging (the logs needed for Threats is to enable UTM). In FortiAnalyzer Device Manager>All Logging Devices. FortiClient EMS -> Endpoint Profiles -> System Settings -> System Profile Settings. Confirm that at least the web-filter profile has been configured in EMS and assigned to the endpoint/endpoint group to register the logs. If the option 'log ALL URLs' is enabled, all of the traffic logs will be generated and not just blocked or monitored. See FortiClient EMS -> Endpoint Profiles -> Web Filter Settings. Verify the endpoint profiles of system and web-filter were assigned to the endpoint/ endpoint-group. Go to FortiClient EMS -> Endpoint Policy & Components -> Manage profiles -> Endpoint Policy. FortiClient EMS -> Endpoints -> All Endpoints -> Locate the endpoint that was assigned to the profiles. Confirm FortiClient is running and connected to EMS in endpoint and generate traffic or web searching in endpoint. Confirm the blocked sessions and validate the Fortiview> Threats (FortiClient) categories are according to web-filter profile configured. Note: Is it highly important that all the platforms have the same time and zone. If this is not the case, the information will not be displayed. See FortiClient EMS -> System Settings -> FortiGuard Services. See FortiAnalyzer -> Status -> System Time -> Time Zone.