FortiClient EMS + Antivirus

[atsushi]

The FortiClient licenses we have appear to include antivirus licenses but I can't find much info on it. I can't find any settings related to antivirus in the EMS (Endpoint Management Server). Does anyone have any experience deploying antivirus protection from the EMS? Lots of our licenses are due for renewal soon so I'm considering using FortiClient antivirus as a replacement for ESET.

Can't find much info about AV generally really. Is it just invisibly built-in? There is a vulnerability scan, but when I opened my panel just now the last scan was in January for some reason ... plus from what I've seen it seems to be more about CVE type vulnerabilities than 'viruses', but maybe that's not a meaningful distinction. Does it actually do active scanning like ESET would?

Thanks for any info.

[Cajuntank]

EMS has several features for FortiClient's configuration including Antivirus, Web Filtering, Application firewall, SSO Agent, etc... These features are available for deployment to be installed or not. From there, profiles are defined to those endpoints that will have various configurations for those features and as long as the clients are communicating to EMS, then any changes made in EMS will get reflected to the clients. Under the profile in question, there will be a Malware Protection tab where Antivirus can be configured with various settings like, turning AV on or off as a whole, blocking communication channels used by Attackers, blocking malicious websites, Real-time protection settings, scheduled scan settings, anti-Ransomware, Anti-Exploit, Cloud based Malware protection, folder and file exclusions, etc...

That being said, you will have to do your own research on if it is a viable replacement for ESET (i.e... is it a better AV product than ESET, or Cylance, or Sophos, etc...). I have my own opinion for my environment, but your environment and opinion may vary :)