Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
jprocha
New Contributor II

FortiNAC Custom Scans - Regular Expressions

Hello, everyone!

 

I am facing a question regarding custom scans on FortiNAC.

Currently I have a scan to check for my AV service. Every once in a while the network agent gets updated and the syntax for the service name changes. After that, all my hosts start to fail the scans.

Is there anyway to turn the service name into a regular expression? Let's say, instead of checking for a service "ABC.20.17", am I able to check for "ABC.20.*" for any patch version of the given service? Tried on my lab environment but did't work.

 

Appreciate the help!

 

FortiNAC 

jprocha
FCSS - FortiNAC - FortiSwitch
jprochaFCSS - FortiNAC - FortiSwitch
1 Solution
ebilcari

You can schedule the Scan to run every 10~60 minutes, it will check the AV installation, updates and also the status, like for example:

av status.PNG

 

The 'Processes' custom scan would require the full name of the process like 'notepad.exe', as I know it will not accept any wildcard options since it's designed for specific checks.

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.

View solution in original post

4 REPLIES 4
ebilcari
Staff
Staff

The Antivirus checks are predefined in FortiNAC and are automatically updated, there is no need to use custom scan to check them. Is this a specific antivirus not supported yet by FortiNAC?

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
jprocha
New Contributor II

I use custom scans as a way to make sure the AV is not only installed but also running on the machine and apply monitoring to verify it stays active.

jprocha
FCSS - FortiNAC - FortiSwitch
jprochaFCSS - FortiNAC - FortiSwitch
ebilcari

You can schedule the Scan to run every 10~60 minutes, it will check the AV installation, updates and also the status, like for example:

av status.PNG

 

The 'Processes' custom scan would require the full name of the process like 'notepad.exe', as I know it will not accept any wildcard options since it's designed for specific checks.

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
jprocha
New Contributor II

Thank you for the return.

 

Unfortunately looks like the Real-time Protection Check is only available for Windows Defender. Other AVs don't have this option. Might be something nice for a future update.

 

Appreciate the help!

 

Regards, 

jprocha
FCSS - FortiNAC - FortiSwitch
jprochaFCSS - FortiNAC - FortiSwitch
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors