Fabric tags require connection to FortiAnalyzer. See the following process:

1. EMS administrator configures FortiAnalyzer in an endpoint profile. See System Settings.
2. FortiClient connects to EMS and receives FortiAnalyzer connection information from the endpoint profile.
3. FortiClient sends logs to FortiAnalyzer.
4. FortiAnalyzer administrator configures rule to tag endpoints which have indicators of compromise (IOC).
5. If a log entry received from FortiClient on the FortiAnalyzer matches an IOC, FortiAnalyzer adds a tag to that endpoint.
6. EMS adds this tag to the endpoint. You can view the tag in the endpoint details, as well as in Zero Trust Tag Monitor. Note that this tag displays as a Fabric tag in Zero Trust Tag Monitor, but the tag displays under Classification Tags in endpoint details. See Viewing the Endpoints pane.
7. If FortiGate is configured to receive all tags for this specific endpoint, EMS sends the tag to FortiGate.

See EMS API support for FortiAnalyzer to notify and tag suspicious endpoints.

Date and time that EMS added the endpoint to the dynamic endpoint group.