On our EMS we have a widget on the FortiClient Status page that shows PC's with infections. Also in the All Endpoints view there's a filter to show only clients that have an AV Event... We're running EMS 1.2.2
Thanks for the reply. We think we've worked it out.
EMS 1.2.3 here. We found two problems with our install:
1) we needed to open port 8014 inbound to the EMS Server to receive telemetry from FortiClients on an external IP.
2) we found we need to cycle the Forti.... services once a day, or we don't get details about the infections. Looks like some sort of SQL exhaustion, maybe we used the wrong SQL (express vs. full SQL). We haven't run that down yet.
to sum up:
- forticlients report vulnerability management on port 8013 (or 443/10443, haven't dug into it yet)
- forticlients report AV, Web Vulnerability and Firewall/Application blocking on port 8014 of the EMS server
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.