FortiInsight monitors endpoint activity in the form of events. It provides automated inspection and alerts against these events in the form of policy and Augmented intelligence (AI) based inspection.
Article Id 191970
This article explain how to troubleshoot when the endpoint uses a VPN to connect to the corporate network, the agent is unable to send data; this issue is caused when the VPN is blocking the connection between the endpoint and the cloud service. Therefore no data or telemetry is showing in console and, the agent automatically saves the data locally until the connection is made. 

For any FortiInsight version; including Zonefox products.
- Add the appropriate CIDR IP addresses from VPN in the cloud portal whitelist; this will permit the VPN addresses to be supported in the collector portion.
- In some cases VPN configuration needs to be applied in VPN side such as a new outbound rule or permit traffic to https://(Serial_Number)
- Test connection to cloud service by entering the URL: https://(Serial_Number) on endpoint side, to receive a JSON message back.