EMS and Forticlient not reporting virus infection

[SteveRoadWarrior]

We're getting no telemetry from the FortiClient to our EMS Server about virus infections.

We get all kinds of great information about Forticlient and vulnerabilities.

I get the fact that we would need a FortiAnalyzer to read the web logging telemetry.

But AV infections is pretty important and we're not getting any info back from the clients.

If I had to choose between vulnerabilities, which are working, and viruses which is not working I'd pick knowing about viruses any way. 

Anyone else noticing this?

[SteveG]

On our EMS we have a widget on the FortiClient Status page that shows PC's with infections. Also in the All Endpoints view there's a filter to show only clients that have an AV Event... We're running EMS 1.2.2

[SteveRoadWarrior]

Thanks for the reply.  We think we've worked it out.

EMS 1.2.3 here.  We found two problems with our install:

1) we needed to open port 8014 inbound to the EMS Server to receive telemetry from FortiClients on an external IP.

2) we found we need to cycle the Forti.... services once a day, or we don't get details about the infections.  Looks like some sort of SQL exhaustion, maybe we used the wrong SQL (express vs. full SQL).  We haven't run that down yet.

to sum up:

- forticlients report vulnerability management on port 8013 (or 443/10443, haven't dug into it yet)

- forticlients report AV, Web Vulnerability and Firewall/Application blocking on port 8014 of the EMS server