FortiClient proactively defends against advanced attacks. Its tight integration with the Security Fabric enables policy-based automation to contain threats and control outbreaks. FortiClient is compatible with Fabric-Ready partners to further strengthen enterprises’ security posture.
This article describes step-by-step instructions on how to troubleshoot and resolve the issue when vulnerabilities detected by FortiClient do not appear in FortiClient EMS (Endpoint Management Server).
Scope
FortiClient EMS.
Solution
FortiClient is an endpoint security solution that helps detect and mitigate vulnerabilities on client devices. FortiClient EMS is a centralized management server that provides visibility and control over FortiClient endpoints. In some cases, it can happen to have a situation where vulnerabilities detected by FortiClient on individual endpoints do not seem to be reflected in FortiClient EMS. This guide will help to troubleshoot and resolve this issue.
Troubleshooting Steps:
Check for Endpoint Communication: Ensure that the FortiClient endpoints are properly communicating with FortiClient EMS. Verify that the endpoints are connected to the EMS server and send regular status updates.
Confirm Vulnerability Scanning:
Verify that the FortiClient endpoints are performing vulnerability scanning. Check the FortiClient settings on the individual endpoints to ensure that the vulnerability scanning feature is enabled.
Review FortiClient EMS Configuration:
Log in to FortiClient EMS and review the configuration settings. Ensure that the vulnerability scanning feature is enabled at the EMS level as well.
Check Vulnerability Signature Updates:
Ensure that both FortiClient endpoints and FortiClient EMS have up-to-date vulnerability signature databases. Outdated signatures may not accurately reflect the latest vulnerabilities.
Inspect Vulnerability Severity Levels:
Verify the severity levels of the detected vulnerabilities on the FortiClient endpoints. Sometimes, vulnerabilities with low severity may not be included in certain reports or dashboards by default.
Review EMS Dashboard Filters:
Access the FortiClient EMS dashboard and review any applied filters or search criteria. It is possible that filters are in place that are excluding certain vulnerabilities from the view.
Examine FortiClient EMS Logs:
Check the logs within FortiClient EMS for any error messages or warnings related to vulnerability data. Look for any potential issues with data ingestion or processing.
Run a Synchronization:
Trigger a manual synchronization between the FortiClient endpoints and FortiClient EMS. This can help ensure that the latest vulnerability data is sent to the EMS server.
Check for Compatibility Issues:
Ensure that the FortiClient endpoint versions and FortiClient EMS versions are compatible with each other. Incompatibility can lead to data synchronization issues.
Consult Fortinet Support:
If the issue persists and it is impossible to identify the root cause, consider reaching out to Fortinet Support for assistance. The service can provide advanced troubleshooting and guidance based on the specific environment.
