Fortinet black logo

EMS Administration Guide

Viewing the Endpoints content pane

Viewing the Endpoints content pane

You can view information about endpoints on the Endpoints content pane.

  1. Go to Endpoints, and select All Endpoints, a domain, or workgroup.

    The list of endpoints in FortiClient EMS, a quick status bar, and a toolbar display in the content pane.

    Not Installed

    Number of endpoints that do not have FortiClient installed. Click to display the list of endpoints without FortiClient installed.

    Not Registered

    Number of endpoints not connected to FortiClient EMS or FortiGate. Click to display the list of disconnected endpoints.

    Out-Of-Sync

    Number of endpoints with an out-of-sync profile. Click to display the list of endpoints with out-of-sync profiles.

    Not Compliant

    Number of endpoints not compliant with the FortiGate compliance rules. Click to display the list of not compliant endpoints.

    Security Risk

    Number of endpoints that are a security risk. Click to display the list of endpoints.

    Checkbox

    Click to select all endpoints displayed in the content pane.

    Show/Hide Heading

    Click to hide or display the following column headings: Device, User, IP, Configurations, Connections, Status, and Events.

    Show/Hide Full Group Path

    Click to hide or display the full path for the group that the endpoint belongs to.

    Refresh

    Click to refresh the list of endpoints in the content pane.

    Search All Fields

    Type a value and press Enter to search for the value in the list of endpoints.

    Filters

    Click to display and hide filters you can use to filter the list of endpoints.

    Device

    Visible when headings are displayed. Displays an icon to represent the operating system on the endpoint and the device name.

    User

    Visible when headings are displayed. Displays the name of the user logged into the endpoint.

    IP

    Visible when headings are displayed. Displays the endpoint's IP address.

    Configurations

    Visible when headings are displayed. Displays the name of the profile assigned to the endpoint and the profile's synchronization status.

    Connections

    Visible when headings are displayed. Displays whether the endpoint is connected to FortiClient EMS or FortiGate and the connection status of Online, Offline, or Not Registered.

    Status

    Visible when headings are displayed. Displays one of the following compliance statuses for the endpoint.

    • Compliant
    • Not compliant
    • Not participating in compliance
    • Quarantined
    • Excluded
    • Not registered
    • Not installed

    Events

    Visible when headings are displayed. Displays FortiClient events for the endpoint.

  2. Click an endpoint to display its details in the content pane.

    The following dropdown lists display in the toolbar for the selected endpoint:

    Checkbox

    Click to select and deselect all endpoints in the content pane. You can then select or clear the checkbox for individual endpoints to fine-tune the list of selected endpoints.

    Scan

    Click to start a Vulnerability or AntiVirus scan on the selected endpoint.

    Patch

    Click to patch all critical and high vulnerabilities on the selected endpoint. Choose one of the following options:

    • Selected Vulnerabilities on Selected Clients
    • Selected Vulnerabilities on All Affected Clients
    • All Critical and High Vulnerabilities

    Action

    Click to perform one of the following actions on the selected endpoint:

    • Upload FortiClient Logs
    • Request Diagnostic Results
    • Update Signatures
    • Re-register
    • De-register
    • Register
    • Quarantine
    • Un-quarantine
    • Exclude from Management
    • Mark as Uninstalled
    • Delete Device

    The following tabs are available in the content pane toolbar when you select an endpoint, depending on which FortiClient features have been installed on the endpoint and enabled via the assigned profile:

    Summary

    <user name>

    Displays the name of the user logged into the selected endpoint. Also displays the user's avatar, email address, and phone number if these are provided to FortiClient on the endpoint. If the user's LinkedIn, Google, Salesforce, or other cloud app account is linked in FortiClient, the username from the cloud application displays.

    Device

    Displays the selected endpoint's device name.

    OS

    Displays the selected endpoint's operating system and version number.

    IP

    Displays the selected endpoint's IP address.

    MAC

    Displays the selected endpoint's MAC address.

    Last Seen

    Displays the last date and time that FortiClient sent a keep-alive message to EMS. This information is useful if FortiClient is offline because it indicates when the last keep-alive message occurred.

    Location

    Displays whether the selected endpoint is on-net or off-net.

    Connection

    Displays when the selected endpoint is connected to FortiClient EMS or FortiGate. Also displays the connection status.

    Configuration

    Displays the following information for the selected endpoint:

    • Profile: Name of the profile assigned to the selected endpoint
    • Installer: Name of the FortiClient installer used for the selected endpoint. Displays Not Assigned if no FortiClient installer has been assigned to the selected endpoint.
    • Gateway List: Name of the gateway list used for the selected endpoint. Displays Not Assigned if no gateway list has been assigned to the selected endpoint.
    • FortiClient Version: FortiClient version installed on the selected endpoint.
    • FortiClient Serial Number: Serial number for the selected endpoint's FortiClient license.

    Compliance

    Displays if the endpoint is compliant. If the endpoint is not compliant, displays the features for which FortiClient is not compliant.

    Features

    Displays which features are enabled for FortiClient.

    Antivirus Events

    Date/Time

    Displays the antivirus event's date and time.

    Message

    Displays the antivirus event's message.

    Sandbox Events

    Date/Time

    Displays the sandbox event's date and time.

    Message

    Displays the sandbox event's message.

    Firewall Events

    Date/Time

    Displays the firewall event's date and time.

    Message

    Displays the firewall event's message.

    Vulnerability Events

    Vulnerability

    Displays the vulnerability's name. For example, Security update available for Adobe Reader.

    Category

    Displays the vulnerability's category. For example, Third Party App.

    Application

    Displays the name of the application with the vulnerability.

    Severity

    Displays the vulnerability's severity.

    FortiGuard ID

    Displays the FortiGuard ID number. If you click the FortiGuard ID number, it redirects you to FortiGuard where further information is provided if available.

    Bulletin

    Displays a link to a bulletin about the software vulnerability.

    Web Filter Events

    Date/Time

    Displays the web filter event's date and time.

    Message

    Displays the web filter event's message.

    System Events

    Date/Time

    Displays the system event's date and time.

    Message

    Displays the system event's message.

Viewing the Endpoints content pane

You can view information about endpoints on the Endpoints content pane.

  1. Go to Endpoints, and select All Endpoints, a domain, or workgroup.

    The list of endpoints in FortiClient EMS, a quick status bar, and a toolbar display in the content pane.

    Not Installed

    Number of endpoints that do not have FortiClient installed. Click to display the list of endpoints without FortiClient installed.

    Not Registered

    Number of endpoints not connected to FortiClient EMS or FortiGate. Click to display the list of disconnected endpoints.

    Out-Of-Sync

    Number of endpoints with an out-of-sync profile. Click to display the list of endpoints with out-of-sync profiles.

    Not Compliant

    Number of endpoints not compliant with the FortiGate compliance rules. Click to display the list of not compliant endpoints.

    Security Risk

    Number of endpoints that are a security risk. Click to display the list of endpoints.

    Checkbox

    Click to select all endpoints displayed in the content pane.

    Show/Hide Heading

    Click to hide or display the following column headings: Device, User, IP, Configurations, Connections, Status, and Events.

    Show/Hide Full Group Path

    Click to hide or display the full path for the group that the endpoint belongs to.

    Refresh

    Click to refresh the list of endpoints in the content pane.

    Search All Fields

    Type a value and press Enter to search for the value in the list of endpoints.

    Filters

    Click to display and hide filters you can use to filter the list of endpoints.

    Device

    Visible when headings are displayed. Displays an icon to represent the operating system on the endpoint and the device name.

    User

    Visible when headings are displayed. Displays the name of the user logged into the endpoint.

    IP

    Visible when headings are displayed. Displays the endpoint's IP address.

    Configurations

    Visible when headings are displayed. Displays the name of the profile assigned to the endpoint and the profile's synchronization status.

    Connections

    Visible when headings are displayed. Displays whether the endpoint is connected to FortiClient EMS or FortiGate and the connection status of Online, Offline, or Not Registered.

    Status

    Visible when headings are displayed. Displays one of the following compliance statuses for the endpoint.

    • Compliant
    • Not compliant
    • Not participating in compliance
    • Quarantined
    • Excluded
    • Not registered
    • Not installed

    Events

    Visible when headings are displayed. Displays FortiClient events for the endpoint.

  2. Click an endpoint to display its details in the content pane.

    The following dropdown lists display in the toolbar for the selected endpoint:

    Checkbox

    Click to select and deselect all endpoints in the content pane. You can then select or clear the checkbox for individual endpoints to fine-tune the list of selected endpoints.

    Scan

    Click to start a Vulnerability or AntiVirus scan on the selected endpoint.

    Patch

    Click to patch all critical and high vulnerabilities on the selected endpoint. Choose one of the following options:

    • Selected Vulnerabilities on Selected Clients
    • Selected Vulnerabilities on All Affected Clients
    • All Critical and High Vulnerabilities

    Action

    Click to perform one of the following actions on the selected endpoint:

    • Upload FortiClient Logs
    • Request Diagnostic Results
    • Update Signatures
    • Re-register
    • De-register
    • Register
    • Quarantine
    • Un-quarantine
    • Exclude from Management
    • Mark as Uninstalled
    • Delete Device

    The following tabs are available in the content pane toolbar when you select an endpoint, depending on which FortiClient features have been installed on the endpoint and enabled via the assigned profile:

    Summary

    <user name>

    Displays the name of the user logged into the selected endpoint. Also displays the user's avatar, email address, and phone number if these are provided to FortiClient on the endpoint. If the user's LinkedIn, Google, Salesforce, or other cloud app account is linked in FortiClient, the username from the cloud application displays.

    Device

    Displays the selected endpoint's device name.

    OS

    Displays the selected endpoint's operating system and version number.

    IP

    Displays the selected endpoint's IP address.

    MAC

    Displays the selected endpoint's MAC address.

    Last Seen

    Displays the last date and time that FortiClient sent a keep-alive message to EMS. This information is useful if FortiClient is offline because it indicates when the last keep-alive message occurred.

    Location

    Displays whether the selected endpoint is on-net or off-net.

    Connection

    Displays when the selected endpoint is connected to FortiClient EMS or FortiGate. Also displays the connection status.

    Configuration

    Displays the following information for the selected endpoint:

    • Profile: Name of the profile assigned to the selected endpoint
    • Installer: Name of the FortiClient installer used for the selected endpoint. Displays Not Assigned if no FortiClient installer has been assigned to the selected endpoint.
    • Gateway List: Name of the gateway list used for the selected endpoint. Displays Not Assigned if no gateway list has been assigned to the selected endpoint.
    • FortiClient Version: FortiClient version installed on the selected endpoint.
    • FortiClient Serial Number: Serial number for the selected endpoint's FortiClient license.

    Compliance

    Displays if the endpoint is compliant. If the endpoint is not compliant, displays the features for which FortiClient is not compliant.

    Features

    Displays which features are enabled for FortiClient.

    Antivirus Events

    Date/Time

    Displays the antivirus event's date and time.

    Message

    Displays the antivirus event's message.

    Sandbox Events

    Date/Time

    Displays the sandbox event's date and time.

    Message

    Displays the sandbox event's message.

    Firewall Events

    Date/Time

    Displays the firewall event's date and time.

    Message

    Displays the firewall event's message.

    Vulnerability Events

    Vulnerability

    Displays the vulnerability's name. For example, Security update available for Adobe Reader.

    Category

    Displays the vulnerability's category. For example, Third Party App.

    Application

    Displays the name of the application with the vulnerability.

    Severity

    Displays the vulnerability's severity.

    FortiGuard ID

    Displays the FortiGuard ID number. If you click the FortiGuard ID number, it redirects you to FortiGuard where further information is provided if available.

    Bulletin

    Displays a link to a bulletin about the software vulnerability.

    Web Filter Events

    Date/Time

    Displays the web filter event's date and time.

    Message

    Displays the web filter event's message.

    System Events

    Date/Time

    Displays the system event's date and time.

    Message

    Displays the system event's message.