FortiEDR Zero Trust tagging rule and visibility

You can add a Zero Trust tagging rule to dynamically tag endpoints that have FortiEDR installed and running. If FortiEDR is installed, the endpoint details page shows the FortiEDR status. FortiEDR can have one of the following statuses on the endpoint details page:

Status	Description
Running	FortiEDR is installed on the endpoint and running.
Installed	FortiEDR is installed on the endpoint and not running.
None	FortiEDR is not installed on the endpoint.

To add a FortiEDR Zero Trust tagging rule:

1. Add a FortiEDR Zero Trust tagging rule:
   1. In EMS, go to Zero Trust Tags > Zero Trust Tagging Rules.
   2. Click Add.
   3. Click Add Rule.
   4. For OS, select Windows, Mac, or Linux.
   5. From the Rule Type dropdown list, select FortiEDR.
   6. From the FortiEDR dropdown list, select FortiEDR is installed and running.

      

   7. Click Save.
   8. Configure other fields as desired, then click Save.
2. On the endpoint, install FortiEDR and check the FortiEDR status on a FortiEDR collector. See Installing FortiEDR Collectors.

   

3. In FortiClient, go to the avatar page. Confirm that the FortiEDR tag appears.
4. In EMS, go to Endpoints > All Endpoints.
5. Select the endpoint. Under Zero Trust Tags, confirm that the FortiEDR tag appears. Under Third Party Features, confirm that FortiEDR shows as Running.