Fortinet white logo
Fortinet white logo

User Guide

Sensors

Sensors

The Sensors page shows the sensors deployed in your account, both in the aggregate and individually. Use this page to generate provisioning codes, check the status of individual sensors, and view telemetry data.

To access to the Sensors page:
  • Click the gear icon at the top-right of the page and select Sensors.
Tooltip

You can pivot to the Sensor Details page from the Sensor ID column in the detections Details. Go to Detections > Triage detections and open a detector. Click a sensor in the Sensor ID column. If the sensor is available, the Sensor Details page opens.

Sensor ID Click the Sensor ID to view the sensor Status, Telemetry and Settings pages. For information, see Sensor status
Status

The sensor connection status.

Online

Sensor is connected to FortiNDR Cloud within last hour.

Offline

No telemetry data received by the sensor for at least an hour.

Provisioning

Provisioning code has been created and made initial connection but provisioning process is not complete.

Decommissioned

Sensor has been factory reset (only applicable for 1.12 or above).

Decommissioned (legacy)

A sensor earlier than 1.12 has been marked as decommissioned and has not sent any additional data. If sensor sends data to FortiNDR Cloud, status will change to Online.

Decommissioned (auto)

A sensor 1.12 or later has been marked as decommissioned, but has not communicated with FortiNDR Cloud in the last 7 days. If the sensor later connects to FortiNDR Cloud, it should factory reset itself and switch to Decommissioned status.

Decommission Pending

The sensor decommissioning has been initiated.

Paused

The sensor is not receiving traffic and can be enabled later.

Shutdown

A Zscaler virtual sensor is no longer active.

All other statuses are written by the sensor itself.

Version

The sensor version. Unknown is displayed when there is no data for the version.

Labels Annotations that are applied to the sensor. See, Manage Annotations
Location The sensor location.

EPS (7 Day Average)

The average throughput over last 7 days as Events Per Second

BITS/S (7 Day Average) The average throughput over last 7 days as Bits Per Second.
Type The platform the sensor was deployed on.

Actions

Click to edit the sensor settings. See Sensor settings.

PCAP

Indicates if Packet Capture is enabled or disabled.

To filter the Sensors page:
  1. In the toolbar, click the filter icon.

  2. Filter the page by Status, Type or Version.
Tooltip

You can use the Search function to search for a sensor by ID, label or location.

Sensors

Sensors

The Sensors page shows the sensors deployed in your account, both in the aggregate and individually. Use this page to generate provisioning codes, check the status of individual sensors, and view telemetry data.

To access to the Sensors page:
  • Click the gear icon at the top-right of the page and select Sensors.
Tooltip

You can pivot to the Sensor Details page from the Sensor ID column in the detections Details. Go to Detections > Triage detections and open a detector. Click a sensor in the Sensor ID column. If the sensor is available, the Sensor Details page opens.

Sensor ID Click the Sensor ID to view the sensor Status, Telemetry and Settings pages. For information, see Sensor status
Status

The sensor connection status.

Online

Sensor is connected to FortiNDR Cloud within last hour.

Offline

No telemetry data received by the sensor for at least an hour.

Provisioning

Provisioning code has been created and made initial connection but provisioning process is not complete.

Decommissioned

Sensor has been factory reset (only applicable for 1.12 or above).

Decommissioned (legacy)

A sensor earlier than 1.12 has been marked as decommissioned and has not sent any additional data. If sensor sends data to FortiNDR Cloud, status will change to Online.

Decommissioned (auto)

A sensor 1.12 or later has been marked as decommissioned, but has not communicated with FortiNDR Cloud in the last 7 days. If the sensor later connects to FortiNDR Cloud, it should factory reset itself and switch to Decommissioned status.

Decommission Pending

The sensor decommissioning has been initiated.

Paused

The sensor is not receiving traffic and can be enabled later.

Shutdown

A Zscaler virtual sensor is no longer active.

All other statuses are written by the sensor itself.

Version

The sensor version. Unknown is displayed when there is no data for the version.

Labels Annotations that are applied to the sensor. See, Manage Annotations
Location The sensor location.

EPS (7 Day Average)

The average throughput over last 7 days as Events Per Second

BITS/S (7 Day Average) The average throughput over last 7 days as Bits Per Second.
Type The platform the sensor was deployed on.

Actions

Click to edit the sensor settings. See Sensor settings.

PCAP

Indicates if Packet Capture is enabled or disabled.

To filter the Sensors page:
  1. In the toolbar, click the filter icon.

  2. Filter the page by Status, Type or Version.
Tooltip

You can use the Search function to search for a sensor by ID, label or location.