FortiEDR
FortiEDR automates the protection against advanced threats, pre and post-execution, with real time orchestrated incident response functionality.
Luke_FTNT
Staff
Staff
Article Id 226609
Description This article discusses a common question pertaining to pre-execution security events and Threat Hunting data collection.
Scope FortiEDR 5.0+
Solution

FortiEDR offers several types of security policies and rules which allow or block processes and files. Separately, FortiEDR offers Threat Hunting capabilities which enrich analysts to perform deep, historic forensics investigations.

 

In some cases, users may view an event in the Event Viewer and select the ‘Threat Hunting’ icon:

 

event-viewer-example.png

 

Only to find no Threat Hunting data is returned:

 

threat-hunting-no-data-example.png

 

If the security rule, found in Event Viewer, is for ‘Malicious File Detected’, then this is considered expected behavior.

 

Execution Prevention (aka pre-execution prevention) relies on FortiEDR’s Next Generation Antivirus (NGAV) engine. Security events triggered here will show under the 'Malicious File Detected” security rule. In such case, the file read attempt on the endpoint is blocked prior to reaching the Collectors Threat Hunting function and thus no Threat Hunting data is collected.

Contributors