Upgrade information

The latest FortiNDR firmware versions are available for download from FortiCloud. You should always backup your system configuration before upgrading the firmware on your device. Be aware that some configuration settings are not saved to the backup configuration file and will need to be manually restored after upgrade.

Firmware

Version 7.4.3 primarily fixes known issue 1006195 where upgrading to v7.2.2 will result in lost configuration. Version 7.4.3 offers a few new functionalities such as SNMP polling, MITRE ATT&CK coverage plus some bug fixes. For details, please refer to Resolved issues. Direct upgrade from 7.2.0 is supported. Direct upgrade from v7.0.x - v7.1.x is not supported due to legacy database support.

FNR-1000F, FNR-3500F (gen3 and above)

• 7.4.3 firmware is designed to run on FNR-1000F and FNR-3500F (gen3 and above) and is not compatible with older FAI-3500F hardware (gen1/2). For more information, see Supported models.

• When upgrading FNR-3500F from 7.4.0 to 7.4.3 in Center Mode, you will need to run the following command after upgrade:

  execute db restore

  This CLI will reset the database to an empty state. If upgrade is from 7.4.2 to 7.4.3 this step is not necessary.

VM Devices:

• Direct upgrade from v7.2.x and v7.4.x to v7.4.3 is supported.
• Direct upgrade from v1.5.x, v7.0.x or v7.1.0 to v7.4.3 is not supported.

If your current version FortiNDR does not have a password, you will be prompted to create a password after upgrading, otherwise you cannot login.

Downloading the latest firmware version

To download the latest version of FortiNDR:

1. Log into FortiCloud.
2. In the banner, click Support > Firmware Download.

   

3. From the Select Product dropdown, select FortiNDR.
4. Click the Download tab.
5. Use the folders in the directory to locate and download the latest firmware version.

   

Upgrading the firmware version

Before you begin:

You should always backup your system configuration before upgrading the firmware on your device.

Be aware the following settings are not backed up to the configuration file:

• Network Share
• Network Share Quarantine
• File size limit
• Email Alert Recipients

Record these settings so you can manually restore them after upgrade.

The File size limit can be found by pressing the Tab key in the following CLI:

execute file-size-threshold {ICAP|OFTP|inline-blocking|manual-upload|network-share|sniffer} <size_limit_1-10240MB>

Please make a note for each file input value.

These settings cannot be recovered after they are removed.

To upgrade the FortiNDR firmware version:

1. Back up the configuration file:
   1. Click the Account menu at the top-right of the page.
   2. Go to Configuration > Backup. The configuration file is saved to your computer.
2. Upgrade the firmware:
   1. Go to System > Firmware.
   2. Click Upload and navigate to the location of the file you downloaded from FortiCloud.
   3. Click OK. After the firmware is upgraded the system reboots.
   4. After the upgrade is complete, use the following the CLI to restore the database.

      execute db restore 

      This command will format the database and remove all the logs and the following settings: Device input, Network Share, Network Share Quarantine, File size limit and Email Alert Recipients.

3. Use the configuration settings you recorded earlier to manually restore the settings. For Device Input, you just need to re-authorize the device again.