FortiEDR experiences anyone

[ekrartona]

I know fortiedr is from the ensilo acquisition. Anyone have any recent experiences with FortiEDR ? and maybe some opinions on how it compares to other ones in the market ? We have fortigate routers and switches, but not sure we definitely need to have that "single panel" convenience, though it sounds nice. Obviously nothing catches everything, and we would prefer better lateral spread prevention, than protection of said endpoint (as in we could sacrifice a known corrupted endpoint, which maybe the fortisandbox might help with as well). that and we would only allow VPN connections if the client was running forticlient with protection, rather than letting any endpoint connect. It might be difficult to determine on login, whether the endpoint had EDR running outside of the fortinet security fabric mechanisms..

So we are considering Windows Defender ATP (endpoint), s1, fortiedr right now. There just isnt much information on fortiedr out there. S1 kind of requires MSP, and we're looking to keep it on-prem which is why we are looking at Defender for Endpoint and FortiEDR. Any opinions are welcome. Thanks

And I guess the next question is - does anyone have inside information as to whether fortiedr might just be rolled in to the advanced versions of forticlient ? Because there are now 3 premiuum forticlient versions (outside of the free vpn one). Woudlnt it make sense to have it rolled in to one ?

And finally, fortinet has started to either rename or re-release fortiedr with fortixdr. I imagine its the same product, just trying to capitalize on the xdr marketing is my guess.

But MS Defender ATP being rolled in to one sounds enticing as well. Currently working on a test of that as well, but tests only tell so much. Any opinions are more than welcome, and thanks.

[anignan]

Hi @ekrartona ,

I think fortiedr is a good product which can be part of fortinet security fabric. The collector is running at the kernel level and can see all processes activities. it is very light and does not take resources ... fortixdr rerquires an XDR license where a local core can connect with FAZ do correlations of logs and run automated playbooks for remediation.

Abdel

[CKD]

I think it deserves more plus. 
I've used it in different work environments. It's especially great for post-infection
its new investigation view is very useful.
also experienced CrowdStrike, SentinelOne, SymantecEDR, Trellix HX, Trellix mvision
My fav one is FortiEDR

For your last statement you are right FortiXDR is not a different product than FortiEDR
but increased capabilities with different license

Pros:
- Easy to manage 
- User friendly GUI
- Powerful application control, communication control of applications 
- Quick and helpful support
- You can integrate it with FortiGate, FortiSandbox, FortiNAC and you can create your little XDR :) of course you need XDR license to integrate it with other Forti products
- Threat Hunting with processes, dns requests, logs, registry changes and many other parameters (Which I defined some queries as SIEM correlations)

cons:
- not all rules work very well, once you enable all rules some of them can trigger a lot of false-positives
for me:
partially mapped, bad format, stack tampering, file failed verification test
these 4 rules are the ones creating most false positives.

Ceyhun Kıvanç Demir