Endpoint vulnerability dashboard

To use this dashboard in FortiAnalyzer, you must connect and authorize a FortiClient EMS device and create an EMS connector.

The Endpoint Vulnerability dashboard displays endpoint vulnerability information from EMS connectors. It includes the following widgets:

Widget	Description
Endpoints by Vulnerability Severity	A donut chart displaying the endpoints by vulnerability severity.
Vulnerability Age Distribution (Total Count)	Donut charts displaying vulnerabilities (total and unique) by age.
Vulnerability Age Distribution (Unique Vuln)
Top 10 Vulnerable Windows	Bar charts displaying the endpoints with the largest number of critical and high vulnerabilities.
Top 10 Vulnerable MacOS
Top 10 Vulnerable Linux
Historical Trends Windows	Line charts displaying the historical trends of vulnerabilities by severity.
Historical Trends MacOS
Historical Trends Linux
Top Vuln App Trend	A line chart displaying the top vulnerable apps over time.
Vuln Per Category	A bar chart displaying the number of vulnerabilities by category.
Top 20 Vulnerable Applications	A bar chart displaying the number of critical and high vulnerabilities by application.
Top 10 Vulnerabilities Windows	Tables displaying the top vulnerabilities.
Top 10 Vulnerabilities MacOS
Top 10 Vulnerabilities Linux
Top 20 Users Own Multiple Devices	A table displaying the users, including their number of unique hosts and a list of their devices.

To collect information for the managed endpoint vulnerability dashboard:

1. In Fabric View > Fabric Connectors, create an EMS connector. See Creating or editing Security Fabric connectors.

   Once the first EMS connector is configured, the Update Asset, Identity and Vulnerability in Sequence playbook is automatically created in Fabric View > Automation > Playbook . This default playbook gets the endpoints and their vulnerabilities from EMS. It is scheduled to run once per day, but it can be edited according your needs. See Playbooks.

2. In Fabric View > Asset Identity Center > Asset Identity List > Asset List, click More > Data Sources.

   The Data Source Selection dialog displays.

3. Click Create New.

4. Configure the following, and then click OK.

   1. From the Data Source dropdown, select EMS Connector.

   2. Enable the Status.

   3. For the Connectors field, select the EMS connector that you have created.

5. In Device Manager, authorize the EMS device.

   The EMS device will receive the related endpoint vulnerabilities logs.

   When the playbook is run, it will call the EMS API to get all endpoints and vulnerabilities data, and it will be inserted as FortiAnalyzer Fabric (SIEM) logs. Note that the predefined EMS-Connector Log Parser to parse the logs; you can find this parser in Incidents & Events > Log Parser > Log Parsers.

   Multiple EMS connectors are supported. If needed, repeat the steps to create another EMS connector.