DOCUMENT LIBRARY

FortiGate / FortiOS

FortiManager

FortiAnalyzer

Administration Guide

Introduction
- Getting Started
- Standalone, Center and Sensor operating mode
- FortiNDR traffic and files input types
- Files and malware scan flow using AV and ANN
- Planning deployment
- Initial setup
- Hardening
Dashboard
- NDR Overview
- Malware Overview
- System Status
- Custom dashboards
- Dashboard widgets in Center mode
Network Insights
- Device Inventory
- OT Devices
- Botnet
- FortiGuard IOC
- Network Attacks
- Weak/Vulnerable Communication
- Encrypted Attack
- Top talker
- Top application
- Top URL/Domain
- MITRE ATT&CK
- ML Discovery (Center and Standalone)
- Anomaly tab
- Connection tab
- Session tab
- Malware Attack Scenario
  - Attack scenario navigation and timeline
  - Understanding kill chain and scenario engine
- Malware Observed
Investigations (Center)
- Global query
- Advanced Query Language
Security Fabric
- Device Input
- Network Share
- Network Share Quarantine
- Cloud Storage
- Fabric Connectors
- Enforcement Settings
- Automation Framework
- Automation log
- FortiSandbox integration (FortiSandbox 4.0.1 and higher)
- FortiGate inline blocking (FOS 7.0.1 and higher)
- FortiGate integration (integrated mode with FOS 6.2 and higher)
Virtual Security Analyst
- Express Malware Analysis
- Outbreak Search
- Static Filter
- NDR Muting
- ML Configuration
- Malware Big Picture
- Device Enrichment (Standalone, Sensor and Center)
- Creating a Device Enrichment Profile
Netflow
- Netflow Dashboard
- Netflow Log
- Netflow ML discovery
- Netflow ML Configuration
Network
System
- Administrators
  - Password policy
- Admin Profiles
- Sensor/Center settings
- Firmware
- Settings
- SNMP
- Artifact Storage (Standalone and Sensor)
- FortiGuard
- Certificates
- High Availability (HA)
- Conserve Mode
- Backup or restore the system configuration
User & Authentication
- RADIUS Server
- LDAP Servers
- Creating remote wildcard administrators
Log & Report
- Malware Log
- NDR Log
- Events
- Daily Feature Learned
- Log Settings
- Alert Email Setting
- Email Alert Recipients
- NDR logs samples
- AV log samples
- NetFlow logs samples
Appendix A: API guide
Appendix B: Sample script to submit files
Appendix C: FortiNDR ports
Appendix D: FortiGuard updates
Appendix E: Event severity level by category
Appendix F: IPv6 support
Appendix G: Supported IPS (including OT), Application Control, and protocols
Appendix H: File types and protocols
Appendix I: Center Sensor Deployment
Appendix J: Custom IPS signatures
- Detection Logic and tuning
- Example configuration
Change Log

Home FortiNDR 7.6.3 Administration Guide

7.6.3

Change Log

Date	Change Description
2025-10-03	Initial release.
2025-10-16	Updated ML Discovery (Center and Standalone), Appendix J: Custom IPS signatures ,Network Attacks and NDR Log.
2025-10-30	Updated Planning deployment .
2025-11-21	Updated FortiGate quarantine webhook setup example.
2025-12-12	Updated FortiGuard
2026-02-02	Updated Appendix A: API guide

Change Log

Date	Change Description
2025-10-03	Initial release.
2025-10-16	Updated ML Discovery (Center and Standalone), Appendix J: Custom IPS signatures ,Network Attacks and NDR Log.
2025-10-30	Updated Planning deployment .
2025-11-21	Updated FortiGate quarantine webhook setup example.
2025-12-12	Updated FortiGuard
2026-02-02	Updated Appendix A: API guide

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

Web Application / API Protection

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

All Products

Administration Guide

Change Log

Change Log

Change Log

Change Log