Using the template - Endpoint security vulnerability report

This topic describes a template report that uses logs from the SIEM database (siemdb).

The Endpoint Security Vulnerability Report provides a comprehensive security rating overview and historical trends specifically for all managed endpoints based on the vulnerabilities. This report utilizes retrieved data from FortiClient EMS and FortiGuard, including the outbreak alert and endpoint vulnerability information.

FortiClient EMS connector(s) must be created and enabled to generate this report with data. The EMS connector can insert the data into FortiAnalyzer Fabric SIEM logs. For more information about configuration, see below.

To collect data through the EMS connectors and insert it to Fabric (SIEM) logs:

1. In Fabric View > Fabric Connectors, create an EMS connector. See Creating or editing Security Fabric connectors.

   Once the first EMS connector is configured, the Update Asset, Identity and Vulnerability in Sequence playbook is automatically created in Fabric View > Automation > Playbook . This default playbook gets the endpoints and their vulnerabilities from EMS. It is scheduled to run once per day, but it can be edited according your needs. See Playbooks.

2. In Fabric View > Asset Identity Center > Asset Identity List > Asset List, click More > Data Sources.

   The Data Source Selection dialog displays.

3. Click Create New.

4. Configure the following, and then click OK.

   1. From the Data Source dropdown, select EMS Connector.

   2. Enable the Status.

   3. For the Connectors field, select the EMS connector that you have created.

5. In Device Manager, authorize the EMS device.

   The EMS device will receive the related endpoint vulnerabilities logs.

   When the playbook is run, it will call the EMS API to get all endpoints and vulnerabilities data, and it will be inserted as FortiAnalyzer Fabric (SIEM) logs. Note that the predefined EMS-Connector Log Parser to parse the logs; you can find this parser in Incidents & Events > Log Parser > Log Parsers.

   Multiple EMS connectors are supported. If needed, repeat the steps to create another EMS connector.

The report can be created from the template in Reports > Report Definitions > Templates.

See below for an example of page 1 from the Endpoint Security Vulnerability Report.

The data query for the Endpoint Security Vulnerability Report is based on the SIEM database (siemdb), and it uses SIEM normalized logs and the fct_mdata.

The following fields have been added in FortiAnalyzer 7.4.4 for this report:

• event_subtype=endpoint-vuln is added in the siemdb

• release_data and detection_product are added to fct_mdata

The related charts, macros, and datasets for this report use the "SIEM-" prefix in their name.