Anti Exploit high CPU

[kd007]

Has anyone else noticed high CPU usage (10%-20%+ for the process itself) with Anti-Exploit enabled? Our workstations are mostly laptops and some folks testing this feature have heard their fans rev up, only to then find high CPU usage for this process when we're not doing much on the system.

Doesn't seem to be causing a problem, just more of an annoyance at this time.

Changing subject, we did get one detection with AE almost right away after enabling on a user's Excel spreadsheet. Nice to see this working but FortiClient didn't give me any information to decide whether or not it was a false positive. Anyone have a similar experience?

[Mark123]

About high CPU usage of the Anti Exploit engine: We have the same issue in our company. Total CPU increases from a 5% to 45% continuously. Two processes are responsible for this high CPU usage: FortiClient Anti-Exploit (fortiae) and System (ntoskrnl). FortiClient Anti-Exploit using around 20% CPU, System using around 21% CPU. On top of that we observed other strange behaviour. We stopped the FortiClient Anti-Exploit process. After it started again, it used only a small amout of CPU. But after a few days the CPU started to go up again to 45% caused by FortiClient Anti-Exploit and System. All together this doesn't look good. So we have reported this to Fortinet Support. We are waiting for their feedback. Would be good if you report your issue also to Fortinet Support.

[kd007]

Also what version of FC are you using? We had problems on v5.6.6 but v6.0.0 does not seem to have this issue.

[Mark123]

Thanks for your feedback. We are running v5.6.6. Good to hear you don't reproduce the issue anymore in v6.0.0. We plan to rollout v6.0.0 in the next maintenance window.

[Mark123]

About high CPU usages of the Anti Exploit engine: We have the same issue in our company. Total CPU increases from a 5% to 45% continuously. Two processes are responsible for this high CPU usage: FortiClient Anti-Exploit (fortiae) and System (ntoskrnl). FortiClient Anti-Exploit using around 20% CPU, System using around 21% CPU. On top of that we observer other strange behaviour. We stopped the FortiClient Anti-Exploit process. After it started again, it used only a small amout of CPU. But after a few days the CPU started to go up again to 45% caused by FortiClient Anti-Exploit and System. All together this doesn't look good. So we have reported this to Fortinet Support. We are waiting for their feedback. Would be good if you report your issue also to Fortinet Support.