EMS Only for FAZ

[TribeNZ]

Hi - I have a question around getting EMS specific info from a FAZ. I have a Trial running where the EMS is only used for ZTNA access and WebFilter on the endpoint. No other features of the Forticlient such as AV. I have linked the FAZ and the EMS server and the EMS server is sending logs to the FAZ. However in the FAZ I am not seeing any data in reports if I only include the EMS devices. So my thinking is endpoint is not sending its logs for browsing to the EMS server ? I need to check that the endpoint can send logs of user activity to the FAZ directly ? What I want to achieve is to see usage of the ZTNA policies and endpoint browsing. None of that traffic is directed via the Gate so its all endpoint traffic I need to get from the endpoint to the EMS to the FAZ ? Or am I way off mark ? 

[Jean-Philippe_P]

Hello TribeNZ, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

[BlaBlaBla]

Thanks - I am getting some data in there, but it is not reliable and does not provide web traffic. In some testing, I hit blocked sites on the endpoints that do not show in the report. I think Webfilter is not really the solution for securing web traffic and Sase would be more appropriate. 

[Jean-Philippe_P]

Hello TribeNZ,

We are still looking for an answer to your question.

We will come back to you ASAP.

Thanks,

[vraev]

Hi,

Please review the following articles:

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-integrate-EMS-in-the-FortiAnaly...
https://docs.fortinet.com/document/fortianalyzer/7.4.2/administration-guide/513591/forticlient-suppo...
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Control-logging-from-FortiClient-EMS-t...
https://docs.fortinet.com/document/fortianalyzer/7.2.1/administration-guide/743670/configuring-log-s...
https://community.fortinet.com/t5/FortiAnalyzer/Troubleshooting-Tip-How-to-investigate-log-visibilit...
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Enable-FortiAnalyzer-to-receive-log-fr...
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-make-multitenancy-visible-from/...
https://docs.fortinet.com/document/fortianalyzer/6.4.0/new-features/350431/ems-connector

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-run-a-FortiClient-Endpoint-Anti...
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-implement-Indicators-Of-Comprom...
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-determine-the-failed-status-fro...

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-integrate-EMS-in-the-FortiAnaly...
https://docs.fortinet.com/document/fortianalyzer/7.4.2/administration-guide/513591/forticlient-suppo...
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Control-logging-from-FortiClient-EMS-t...
https://docs.fortinet.com/document/fortianalyzer/7.2.1/administration-guide/743670/configuring-log-s...
https://community.fortinet.com/t5/FortiAnalyzer/Troubleshooting-Tip-How-to-investigate-log-visibilit...
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Enable-FortiAnalyzer-to-receive-log-fr...
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-make-multitenancy-visible-from/...
https://docs.fortinet.com/document/fortianalyzer/6.4.0/new-features/350431/ems-connector

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-run-a-FortiClient-Endpoint-Anti...
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-implement-Indicators-Of-Comprom...
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-determine-the-failed-status-fro...

best,