Fortinet Document Library

Version:


Table of Contents

Fortinet FortiClient EMS

1.0.0
Copy Link

About the connector

FortiClient Enterprise Management Server (FortiClient EMS) is a security management solution that enables scalable and centralized management of multiple endpoints (computers). FortiClient EMS provides efficient and effective administration of endpoints running FortiClient.

This document provides information about the Fortinet FortiClient EMS connector, which facilitates automated interactions, with the Fortinet FortiClient EMS server using FortiSOAR™ playbooks. Add the Fortinet FortiClient EMS connector as a step in FortiSOAR™ playbooks and perform automated operations, such as quarantining or unquarantining an endpoint ticket in Fortinet FortiClient EMS or retrieving details for events, profiles, etc. from Fortinet FortiClient EMS.

Version information

Connector Version: 1.0.0

FortiSOAR™ Version Tested on: 6.4.1-2133

Authored By: Fortinet

Certified: Yes

Installing the connector

From FortiSOAR™ 5.0.0 onwards, use the Connector Store to install the connector. For the detailed procedure to install a connector, click here.
You can also use the yum command to install connectors. Connectors provided by FortiSOAR™ are delivered using a FortiSOAR™ repository. Therefore, you must set up your FortiSOAR™ repository and run the yum command as a root user to install connectors:

yum install cyops-connector-fortinet-forticlient-ems

Prerequisites to configuring the connector

  • You must have the URL of Fortinet FortiClient EMS server to which you will connect and perform automated operations and credentials (username-password pair) to access that server.
  • To access the FortiSOAR™ UI, ensure that port 443 is open through the firewall for the FortiSOAR™ instance.

Configuring the connector

For the procedure to configure a connector, click here.

Configuration parameters

In FortiSOAR™, on the Connectors page, click the Fortinet FortiClient EMS connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details: 

Parameter Description
Server URL URL of the FortiClient EMS server to which you will connect and perform automated operations.
Username Username used to access the FortiClient EMS server to which you will connect and perform the automated operations.
Password Password used to access the FortiClient EMS server to which you will connect and perform the automated operations.
Domain Domain name of the FortiClient EMS server to which you will connect and perform the automated operations.
Verify SSL Specifies whether the SSL certificate for the server is to be verified or not.

Actions supported by the connector

The following automated operations can be included in playbooks and you can also use the annotations to access operations from version 4.10.0 and onwards:

Function Description Annotation and Category
Quarantine Endpoints Quarantines the specified endpoints on the Fortinet FortiClient EMS server based on the endpoint IDs you have specified. quarantine_endpoints
Investigation
Unquarantine Endpoints Unquarantines the specified endpoints on the Fortinet FortiClient EMS server based on the endpoint IDs you have specified. unquarantine_endpoints
Investigation
Get All Endpoints Retrieves a list of all the endpoints connected to the specified Fortinet FortiClient EMS server. get_endpoints
Investigation
Get Endpoint Details Retrieves details for a specific endpoint from the Fortinet FortiClient EMS server based on the device ID you have specified. get_endpoints
Investigation
Get Events For Endpoint Retrieves events related to a specific endpoint from the Fortinet FortiClient EMS server based on the device ID, event type, and other input parameters you have specified. get_events_for_endpoint
Investigation
Get Verification Rules Retrieves a list of all compliance verification rules from the Fortinet FortiClient EMS server. get_host_verification_rules
Investigation
Get Host Verification Tags Retrieves a list of all host verification tags from the Fortinet FortiClient EMS server. get_host_verification_tags
Investigation
Get Profile Details Retrieves information for a specific profile from the Fortinet FortiClient EMS server based on the profile ID you have specified. get_profile_by_id
Investigation
Get All Profiles Retrieves information for all profiles from the Fortinet FortiClient EMS server. get_all_profiles
Investigation

operation: Quarantine Endpoints

Input parameters

Parameter Description
Endpoint IDs IDs of the endpoints to quarantine on the Fortinet FortiClient EMS server.

Output

The output contains the following populated JSON schema:
{
     "result": {
         "retval": "",
         "message": ""
     },
     "data": [
         {
             "id": "",
             "name": "",
             "full_host": "",
             "host": "",
             "ip_addr": "",
             "uid": "",
             "retval": "",
             "message": ""
         }
     ]
}

operation: Unquarantine Endpoints

Input parameters

Parameter Description
Endpoint IDs IDs of the endpoints to unquarantine on the Fortinet FortiClient EMS server.

Output

The output contains the following populated JSON schema:
{
     "result": {
         "retval": "",
         "message": ""
     },
     "data": [
         {
             "id": "",
             "name": "",
             "full_host": "",
             "host": "",
             "ip_addr": "",
             "uid": "",
             "retval": "",
             "message": ""
         }
     ]
}

operation: Get All Endpoints

Input parameters

Parameter Description
Count (Optional)The number of endpoints to be returned by this operation.
Offset (Optional)Index of the first item to be returned by this operation.

Output

The output contains the following populated JSON schema:
{
     "result": {
         "retval": "",
         "message": ""
     },
     "data": {
         "endpoints": [
             {
                 "device_id": "",
                 "name": "",
                 "ip_addr": "",
                 "os_version": "",
                 "group_id": "",
                 "group_name": "",
                 "group_path": "",
                 "orig_group_name": "",
                 "orig_group_id": "",
                 "endpoint_policy_name": "",
                 "domain_id": "",
                 "installer_name": "",
                 "deployment_state": "",
                 "last_seen": "",
                 "is_installed": "",
                 "is_managed": "",
                 "is_ems_registered": "",
                 "is_ems_online": "",
                 "is_ems_onnet": "",
                 "is_fgt_configured": "",
                 "is_fgt_registered": "",
                 "is_fgt_online": "",
                 "is_excluded": "",
                 "is_quarantined": "",
                 "quarantine_access_code": "",
                 "comparable_fct_version": "",
                 "username": "",
                 "display_name": "",
                 "avatar": "",
                 "profile_name": "",
                 "is_profile_synced": "",
                 "off_net_profile_name": "",
                 "is_off_net_profile_synced": "",
                 "ip_list_name": "",
                 "is_ip_list_synced": "",
                 "policy_sync": "",
                 "av_enabled": "",
                 "ae_enabled": "",
                 "cs_enabled": "",
                 "rm_enabled": "",
                 "fw_enabled": "",
                 "wf_enabled": "",
                 "vpn_enabled": "",
                 "vuln_enabled": "",
                 "ssoma_enabled": "",
             &nnbsp;   "sb_enabled": "",
                 "av_events_count": "",
                 "wf_events_count": "",
                 "fw_events_count": "",
                 "sb_events_count": "",
                 "ae_events_count": "",
                 "rm_events_count": "",
                 "cs_events_count": "",
                 "vuln_events_count": "",
                 "sys_events_count": "",
                 "vuln_events_max_severity": ""
             }
         ],
         "total": ""
     }
}

operation: Get Endpoint Details

Input parameters

Parameter Description
Device ID ID of the device whose details you want to retrieve from the Fortinet FortiClient EMS server.

Output

The output contains the following populated JSON schema:
{
     "result": {
         "retval": "",
         "message": ""
     },
     "data": {
         "endpoints": [
             {
                 "device_id": "",
                 "host": "",
                 "alias": "",
                 "name": "",
                 "ip_addr": "",
                 "mac_addr": "",
                 "os_version": "",
                 "os_service_pack": "",
                 "distinguished_name": "",
                 "group_tag": "",
                 "group_id": "",
                 "group_name": "",
                 "group_path": "",
                 "orig_group_name": "",
                 "orig_group_id": "",
                 "endpoint_policy_name": "",
                 "domain_id": "",
                 "installer_name": "",
                 "deployment_state": "",
                 "scheduled_install_time": "",
                 "installation_state": "",
                 "deployment_state_time": "",
                 "deployment_state_data": "",
                 "forticlient_id": "",
                 "uid": "",
                 "caps": "",
                 "fct_sn": "",
                 "fgt_sn": "",
                 "last_seen": "",
                 "deregister": "",
                 "run_cmd": "",
                 "quarantine_message": "",
                 "is_installed": "",
                 "is_managed": "",
                 "is_ems_registered": "",
                 "is_ems_online": "",
                 "is_ems_onnet": "",
                 "is_fgt_configured": "",
                 "is_fgt_registered": "",
                 "is_fgt_online": "",
                 "is_excluded": "",
                 "is_quarantined": "",
                 "quarantine_access_code": "",
                 "fct_version": "",
                 "comparable_fct_version": "",
                 "username": "",
                 "display_name": "",
                 "email": "",
                 "service": "",
                 "phone": "",
                 "user_domain": "",
                 "avatar_fingerprint": "",
                 "avatar": "",
                 "profile_name": "",
                 "is_profile_assigned": "",
                 "is_profile_synced": "",
                 "is_profile_imported": "",
                 "off_net_profile_name": "",
                 "is_off_net_profile_imported": "",
                 "is_off_net_profile_synced": "",
                 "ip_list_name": "",
                 "is_ip_list_synced": "",
                 "policy_sync": "",
                 "av_installed": "",
                 "av_enabled": "",
                 "av_hidden": "",
                 "ae_installed": "",
                 "ae_enabled": "",
                 "ae_hidden": "",
                 "cs_installed": "",
                 "cs_enabled": "",
                 "cs_hidden": "",
                 "rm_installed": "",
                 "rm_enabled": "",
                 "rm_hidden": "",
                 "fw_installed": "",
                 "fw_enabled": "",
                 "fw_hidden": "",
                 "wf_installed": "",
                 "wf_enabled": "",
                 "wf_hidden": "",
                 "vpn_installed": "",
                 "vpn_enabled": "",
                 "vpn_hidden": "",
                 "vuln_installed": "",
                 "vuln_enabled": "",
                 "vuln_hidden": "",
                 "ssoma_installed": "",
                 "ssoma_enabled": "",
                 "ssoma_hidden": "",
                 "sb_installed": "",
                 "sb_enabled": "",
                 "sb_hidden": "",
                 "av_last_scan_type": "",
                 "av_last_scan_date": "",
                 "av_last_full_scan_date": "",
                 "av_last_cancelled_scan_type": "",
                 "av_last_cancelled_scan_date": "",
                 "av_scan_scheduled": "",
                 "av_next_sch_type": "",
                 "av_next_scan_on": "",
                 "av_next_scan_hour": "",
                 "av_next_scan_min": "",
                 "av_next_scan_type": "",
                 "vuln_next_scheduled": "",
                 "vuln_next_sch_type": "",
                 "vuln_next_scan_on": "",
                 "vuln_next_start_hour": "",
                 "vuln_next_start_min": "",
                 "is_av_scanning": "",
                 "is_vuln_scanning": "",
                 "last_vuln_scan": "",
                 "vuln_scan_status": "",
                 "av_sig_version": "",
                 "av_eng_version": "",
                 "vuln_sig_version": "",
                 "vuln_eng_version": "",
                 "app_sig_version": "",
                 "app_eng_version": "",
                 "av_events_count": "",
                 "wf_events_count": "",
                 "fw_events_count": "",
                 "sb_events_count": "",
                 "ae_events_count": "",
                 "rm_events_count": "",
                 "cs_events_count": "",
                 "vuln_events_count": "",
                 "sys_events_count": "",
                 "vuln_events_max_severity": "",
                 "tags": ""
             }
         ],
         "total": ""
     }
}

operation: Get Events For Endpoint

Input parameters

Parameter Description
Device ID ID of the device whose associated events you want to retrieve from the Fortinet FortiClient EMS server.
Event Type Type of event that you want to retrieve for the specified device from the Fortinet FortiClient EMS server. You can choose from the following options: Antivirus Events, System Events, Web filter Events, or Vulnerability Events.
Offset (Optional)Index of the first item to be returned by this operation.
Aggregate List If you select this checkbox, then this operation will retrieve an aggregated event list from the Fortinet FortiClient EMS server.

Output

The output contains the following populated JSON schema:
{
     "events": [
         {
             "devicename": "",
             "id": "",
             "time": "",
             "type": "",
             "name": "",
             "source": "",
             "message": "",
             "context0": "",
             "context1": "",
             "context2": "",
             "context3": "",
             "context4": "",
             "context5": "",
             "context6": "",
             "context7": "",
             "context8": "",
             "context9": "",
             "context10": "",
             "checksum": "",
             "count": ""
         }
     ],
     "total": ""
}

operation: Get Verification Rules

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
     "result": {
         "retval": "",
         "message": ""
     },
     "data": {
         "policies": [
             {
                 "id": "",
                 "name": "",
                 "status": "",
                 "comments": "",
                 "tag_name": "",
                 "tag": ""
             }
         ],
         "total": ""
     }
}

operation: Get Host Verification Tags

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
     "result": {
         "retval": "",
         "message": ""
     },
     "data": [
         {
             "id": "",
             "name": "",
             "policies": [
                 {
                     "name": ""
                 }
             ]
         }
     ]
}

operation: Get Profile Details

Input parameters

Parameter Description
Profile ID ID of profile whose details you want to retrieve from the Fortinet FortiClient EMS server.

Output

The output contains the following populated JSON schema:
{
     "result": {
         "retval": "",
         "message": ""
     },
     "data": {
         "id": "",
         "name": "",
         "is_chrome": "",
         "is_default": "",
         "fp_id": "",
         "profile": {
             "id": "",
             "name": "",
             "fortiProductId": "",
             "isChrome": "",
             "isDefault": "",
             "xml": "",
             "advXml": "",
             "parserError": "",
             "syncError": "",
             "malware": {
                 "excludedFolders": "",
                 "excludedFiles": "",
                 "antivirus": {
                     "enabled": "",
                     "sbMalware": "",
                     "signatureTimer": "",
                     "scanEmail": "",
                     "shellIntegration": "",
                     "rootkitDetection": "",
                     "scanOnInsertion": "",
                     "scanMimeFile": "",
                     "fortiGuardAnalytics": "",
                     "signatureExpiredNotification": "",
                     "cullMalwareAfterDays": "",
                     "realTimeProtection": {
                         "enabled": "",
                         "scanCompressedFiles": "",
                         "compressedFilesMaxSize": "",
                         "scanWhen": "",
                         "scanWhenNetwork": "",
                         "ignoreSystemWhen": "",
                         "onVirusFound": "",
                         "alertOnDetect": "",
                         "antimalwareScanInterface": "",
                         "scanAdware": "",
                         "scanRiskware": "",
                         "rtpAdvHeuristicsEnabled": "",
                         "rtpAdvHeuristicsAction": "",
                         "excludedExtensions": ""
                     },
                     "onDemand": {
                         "signatureLoadMemoryThreshold": "",
                         "onVirusFound": "",
                         "pauseOnBatteryPower": "",
                         "allowAdminToStop": "",
                         "automaticVirusSubmission": "",
                         "scanCompressedFiles": "",
                         "compressedFilesMaxSize": "",
                         "scanRiskware": "",
                         "scanAdware": "",
                         "malwareAdvHeuristicsEnabled": "",
                         "malwareAdvHeuristicsAction": ""
                     },
                     "schedule": {
                         "enabled": "",
                         "ignore3rdPartyAvConflicts": "",
                         "scanType": "",
                         "scanRemovableMedia": "",
                         "scanNetworkDrives": "",
                         "priority": "",
                         "scheduleType": "",
                         "dayOfMonth": "",
                         "time": ""
                     }
                 },
                 "antiexploit": {
                     "enabled": "",
                     "notification": "",
                     "exclusions": ""
                 },
                 "usb": {
                     "enabled": "",
                     "show_bubble_notifications": "",
                     "action": "",
                     "rules": {}
                 },
                 "cloudscan": {
                     "enabled": "",
                     "timeoutEnabled": "",
                     "timeout": "",
                     "submitRemovable": "",
                     "submitNetwork": "",
                     "submitWeb": "",
                     "submitEmail": "",
                     "excludeTrustedSources": "",
                     "excludedExtensions": "",
                     "action": "",
                     "denyOnError": ""
                 }
             },
             "sandbox": {
                 "enabled": "",
                 "fortiSandboxId": "",
                 "serverType": "",
                 "address": "",
                 "authStatus": "",
                 "loginAuthenticated": "",
                 "username": "",
                 "mode": "",
                 "supportedExts": [],
                 "customExts": [],
                 "timeoutEnabled": "",
                 "timeout": "",
                 "submitRemovable": "",
                 "submitNetwork": "",
                 "submitWeb": "",
          &nbsnbsp;      "submitEmail": "",
                 "excludeTrustedSources": "",
                 "excludeCustomPaths": "",
                 "excludedFolders": "",
                 "excludedFiles": "",
                 "includeCustomPaths": "",
                 "includedFolders": "",
                 "includedFiles": "",
                 "action": "",
                 "denyOnError": "",
                 "verdictLevel": "",
                 "fortiCloudRegion": "",
                 "fortiCloudTimeOffset": ""
             },
             "webfilter": {
                 "enabled": "",
                 "syncWithFgtFmg": "",
                 "fgtFmgProfileId": "",
                 "blockMaliciousWebsites": "",
                 "useExclusionList": "",
                 "disableWhenManagedByFgt": "",
                 "logAllUrls": "",
                 "logUserInitiatedTraffic": "",
                 "safeSearch": "",
                 "restrictionLevel": "",
                 "httpsBlockMethod": "",
                 "httpsPluginEnabled": "",
                 "httpsPluginSyncMode": "",
                 "httpsPluginAddressbarOnly": "",
                 "wordFilterEnabled": "",
                 "wordFilterCategoryEnabled": "",
                 "wordFilterCustomEnabled": "",
                 "wordFilterCustom": [],
                 "categories": {
                     "enabled": "",
                     "rateIps": "",
                     "useHttps": "",
                     "allow_web": "",
                     "serverRegion": "",
                     "categories": {}
                 },
                 "urls": {
                     "urls": {}
                 },
                 "bannedWordCategories": {
                     "categories": {}
                 },
                 "fgtFmgProfiles": []
             },
             "firewall": {
                 "enabled": "",
                 "exploitSignaturesEnabled": "",
                 "showBubbleNotifications": "",
                 "cAndCEnabled": "",
                 "rules": {
                     "applications": {},
                     "applicationProperties": {},
                     "categories": {},
                     "unknownApplications": {
                         "action": ""
                     },
                     "filters": []
                 }
             },
             "vpn": {
                 "enabled": "",
                 "allowPersonalVpn": "",
                 "disableConnectDisconnect": "",
                 "showVpnBeforeLogon": "",
                 "useLegacyVpnBeforeLogon": "",
                 "useLocalCompCert": "",
                 "useCurrentUserCert": "",
                 "keepRunningMaxTries": "",
                 "minimizeWindowOnConnect": "",
                 "useWindowsCredentials": "",
                 "showNegotiationWindow": "",
                 "vendorId": "",
                 "sslEnabled": "",
                 "ipsecEnabled": "",
                 "dnsCacheServiceControl": "",
                 "preferSslVpnDns": "",
                 "disallowInvalidServerCert": "",
                 "beepIfError": "",
                 "useWindowsStoreCerts": "",
                 "useSmartCardCert": "",
                 "blockIpv6": "",
                 "enableUdpChecksum": "",
                 "disableDefaultRoute": "",
                 "showAuthCertOnly": "",
                 "checkForCertPrivateKey": "",
                 "enhancedKeyUsageMandatory": "",
                 "suppressVpnNotification": "",
                 "tunnels": []
             },
             "vulnerability": {
                 "enabled": "",
                 "scanOnFgtRegistration": "",
                 "scanOnSignatureUpdate": "",
                 "autoPatchEnabled": "",
                 "autoPatchLevel": "",
                 "osUpdates": "",
                 "proxyEnabled": "",
                 "exemptManual": "",
                 "exemptApplications": "",
                 "applicationExclusions": [],
                 "exemptNoAutoPatch": "",
                 "schedule": {
                     "enabled": "",
                        "scheduleType": "",
                     "scanTime": "",
                     "scan_on_maintenance": "",
                     "maintenance_period": "",
                     "maintenance_deadline": ""
                 }
             },
             "system": {
                 "ui": {
                     "disableBackup": "",
                     "hideUserInfo": "",
                     "hideTray": "",
                     "showHostTag": "",
                     "cultureCode": "",
                     "password": ""
                 },
                 "log": {
                     "level": "",
                     "events": [],
                     "onnet": "",
                     "upload": "",
                     "categories": "",
                     "server": "",
                     "ssl": "",
                     "frequency": "",
                     "retention": "",
                     "timeout": "",
                     "compressed": "",
                     "sendSoftwareInventory": "",
                     "sendWindowsEvent": "",
                     "sendWindowsEventInterval": "",
                     "logProtocol": "",
                     "netlogServer": ""
                 },
                 "proxy": {
                     "update": "",
                     "failover": "",
                     "online_scep": "",
                     "virusSubmission": "",
                     "protocol": "",
                     "server": "",
                     "port": "",
                     "username": "",
                     "password": ""
                 },
                 "update": {
                     "fmEnabled": "",
                     "fmServer": "",
                     "fmPort": "",
                     "fmFailoverPort": "",
                     "fmTimeout": "",
                     "fmFailover": "",
                     "autoPatch": "",
                     "updateAction": "",
                     "scheduled": "",
                     "scheduleType": "",
                     "updateTime": "",
                     "updateInterval": "",
                     "sendUsageStats": "",
                     "serverRegion": "",
                     "useLegacyFdn": ""
                 },
                 "fortiProxy": {
                     "enabled": "",
                     "https": "",
                     "timeout": "",
                     "pop3ClientComforting": "",
                     "pop3CerverComforting": "",
                     "smtpClientComforting": "",
                     "selfTestEnabled": "",
                     "selfTestNotification": "",
                     "selfTestLastPort": ""
                 },
                 "certificates": {
                     "ids": []
                 },
                 "userIdentity": {
                     "enableManuallyEntering": "",
                     "enableLinkedin": "",
                     "enableGoogle": "",
                     "enableSalesforce": "",
                     "notifyUser": ""
                 }
             },
             "endpoint": {
                 "display_antivirus": "",
                 "display_sandbox": "",
                 "display_webfilter": "",
                 "display_firewall": "",
                 "display_vpn": "",
                 "display_vulnerability_scan": "",
                 "bubbleNotifications": "",
                 "logoffNotification": "",
                 "disableUnregister": "",
                 "disableSwitch": "",
                 "hideComplianceWarning": "",
                 "sendSoftwareInventory": "",
                 "enableSubnets": "",
                 "enableMacs": "",
                 "subnets": [],
                 "macs": []
             },
             "singleSignOnMobilityAgent": {
                 "enabled": "",
                 "server": "",
                 "port": "",
                 "key": ""
             },
             "wanOptimization": {},
             "apple": {
                 "configName": ""
             },
             "basicXml": ""
         }
     }
}

operation: Get All Profiles

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
     "result": {
         "retval": "",
         "message": ""
     },
     "data": [
         {
             "id": "",
             "name": "",
             "profiles": [
                 {
                     "id": "",
                     "name": "",
                     "is_chrome": "",
                     "is_default": "",
                     "parser_error": "",
                     "update_time": "",
                     "fp_id": "",
                     "sync_task": "",
                     "sync_error": "",
                     "manual_sync_time": ""
                 }
             ]
         }
     ]
}

Included playbooks

The Sample - Fortinet FortiClient EMS - 1.0.0 playbook collection comes bundled with the Fortinet FortiClient EMS connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Fortinet FortiClient EMS connector.

  • Get All Endpoints
  • Get All Profiles
  • Get Endpoint Details
  • Get Events For Endpoint
  • Get Host Verification Tags
  • Get Profile Details
  • Get Verification Rules
  • Quarantine Endpoints
  • Unquarantine Endpoints

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.

About the connector

FortiClient Enterprise Management Server (FortiClient EMS) is a security management solution that enables scalable and centralized management of multiple endpoints (computers). FortiClient EMS provides efficient and effective administration of endpoints running FortiClient.

This document provides information about the Fortinet FortiClient EMS connector, which facilitates automated interactions, with the Fortinet FortiClient EMS server using FortiSOAR™ playbooks. Add the Fortinet FortiClient EMS connector as a step in FortiSOAR™ playbooks and perform automated operations, such as quarantining or unquarantining an endpoint ticket in Fortinet FortiClient EMS or retrieving details for events, profiles, etc. from Fortinet FortiClient EMS.

Version information

Connector Version: 1.0.0

FortiSOAR™ Version Tested on: 6.4.1-2133

Authored By: Fortinet

Certified: Yes

Installing the connector

From FortiSOAR™ 5.0.0 onwards, use the Connector Store to install the connector. For the detailed procedure to install a connector, click here.
You can also use the yum command to install connectors. Connectors provided by FortiSOAR™ are delivered using a FortiSOAR™ repository. Therefore, you must set up your FortiSOAR™ repository and run the yum command as a root user to install connectors:

yum install cyops-connector-fortinet-forticlient-ems

Prerequisites to configuring the connector

Configuring the connector

For the procedure to configure a connector, click here.

Configuration parameters

In FortiSOAR™, on the Connectors page, click the Fortinet FortiClient EMS connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details: 

Parameter Description
Server URL URL of the FortiClient EMS server to which you will connect and perform automated operations.
Username Username used to access the FortiClient EMS server to which you will connect and perform the automated operations.
Password Password used to access the FortiClient EMS server to which you will connect and perform the automated operations.
Domain Domain name of the FortiClient EMS server to which you will connect and perform the automated operations.
Verify SSL Specifies whether the SSL certificate for the server is to be verified or not.

Actions supported by the connector

The following automated operations can be included in playbooks and you can also use the annotations to access operations from version 4.10.0 and onwards:

Function Description Annotation and Category
Quarantine Endpoints Quarantines the specified endpoints on the Fortinet FortiClient EMS server based on the endpoint IDs you have specified. quarantine_endpoints
Investigation
Unquarantine Endpoints Unquarantines the specified endpoints on the Fortinet FortiClient EMS server based on the endpoint IDs you have specified. unquarantine_endpoints
Investigation
Get All Endpoints Retrieves a list of all the endpoints connected to the specified Fortinet FortiClient EMS server. get_endpoints
Investigation
Get Endpoint Details Retrieves details for a specific endpoint from the Fortinet FortiClient EMS server based on the device ID you have specified. get_endpoints
Investigation
Get Events For Endpoint Retrieves events related to a specific endpoint from the Fortinet FortiClient EMS server based on the device ID, event type, and other input parameters you have specified. get_events_for_endpoint
Investigation
Get Verification Rules Retrieves a list of all compliance verification rules from the Fortinet FortiClient EMS server. get_host_verification_rules
Investigation
Get Host Verification Tags Retrieves a list of all host verification tags from the Fortinet FortiClient EMS server. get_host_verification_tags
Investigation
Get Profile Details Retrieves information for a specific profile from the Fortinet FortiClient EMS server based on the profile ID you have specified. get_profile_by_id
Investigation
Get All Profiles Retrieves information for all profiles from the Fortinet FortiClient EMS server. get_all_profiles
Investigation

operation: Quarantine Endpoints

Input parameters

Parameter Description
Endpoint IDs IDs of the endpoints to quarantine on the Fortinet FortiClient EMS server.

Output

The output contains the following populated JSON schema:
{
     "result": {
         "retval": "",
         "message": ""
     },
     "data": [
         {
             "id": "",
             "name": "",
             "full_host": "",
             "host": "",
             "ip_addr": "",
             "uid": "",
             "retval": "",
             "message": ""
         }
     ]
}

operation: Unquarantine Endpoints

Input parameters

Parameter Description
Endpoint IDs IDs of the endpoints to unquarantine on the Fortinet FortiClient EMS server.

Output

The output contains the following populated JSON schema:
{
     "result": {
         "retval": "",
         "message": ""
     },
     "data": [
         {
             "id": "",
             "name": "",
             "full_host": "",
             "host": "",
             "ip_addr": "",
             "uid": "",
             "retval": "",
             "message": ""
         }
     ]
}

operation: Get All Endpoints

Input parameters

Parameter Description
Count (Optional)The number of endpoints to be returned by this operation.
Offset (Optional)Index of the first item to be returned by this operation.

Output

The output contains the following populated JSON schema:
{
     "result": {
         "retval": "",
         "message": ""
     },
     "data": {
         "endpoints": [
             {
                 "device_id": "",
                 "name": "",
                 "ip_addr": "",
                 "os_version": "",
                 "group_id": "",
                 "group_name": "",
                 "group_path": "",
                 "orig_group_name": "",
                 "orig_group_id": "",
                 "endpoint_policy_name": "",
                 "domain_id": "",
                 "installer_name": "",
                 "deployment_state": "",
                 "last_seen": "",
                 "is_installed": "",
                 "is_managed": "",
                 "is_ems_registered": "",
                 "is_ems_online": "",
                 "is_ems_onnet": "",
                 "is_fgt_configured": "",
                 "is_fgt_registered": "",
                 "is_fgt_online": "",
                 "is_excluded": "",
                 "is_quarantined": "",
                 "quarantine_access_code": "",
                 "comparable_fct_version": "",
                 "username": "",
                 "display_name": "",
                 "avatar": "",
                 "profile_name": "",
                 "is_profile_synced": "",
                 "off_net_profile_name": "",
                 "is_off_net_profile_synced": "",
                 "ip_list_name": "",
                 "is_ip_list_synced": "",
                 "policy_sync": "",
                 "av_enabled": "",
                 "ae_enabled": "",
                 "cs_enabled": "",
                 "rm_enabled": "",
                 "fw_enabled": "",
                 "wf_enabled": "",
                 "vpn_enabled": "",
                 "vuln_enabled": "",
                 "ssoma_enabled": "",
             &nnbsp;   "sb_enabled": "",
                 "av_events_count": "",
                 "wf_events_count": "",
                 "fw_events_count": "",
                 "sb_events_count": "",
                 "ae_events_count": "",
                 "rm_events_count": "",
                 "cs_events_count": "",
                 "vuln_events_count": "",
                 "sys_events_count": "",
                 "vuln_events_max_severity": ""
             }
         ],
         "total": ""
     }
}

operation: Get Endpoint Details

Input parameters

Parameter Description
Device ID ID of the device whose details you want to retrieve from the Fortinet FortiClient EMS server.

Output

The output contains the following populated JSON schema:
{
     "result": {
         "retval": "",
         "message": ""
     },
     "data": {
         "endpoints": [
             {
                 "device_id": "",
                 "host": "",
                 "alias": "",
                 "name": "",
                 "ip_addr": "",
                 "mac_addr": "",
                 "os_version": "",
                 "os_service_pack": "",
                 "distinguished_name": "",
                 "group_tag": "",
                 "group_id": "",
                 "group_name": "",
                 "group_path": "",
                 "orig_group_name": "",
                 "orig_group_id": "",
                 "endpoint_policy_name": "",
                 "domain_id": "",
                 "installer_name": "",
                 "deployment_state": "",
                 "scheduled_install_time": "",
                 "installation_state": "",
                 "deployment_state_time": "",
                 "deployment_state_data": "",
                 "forticlient_id": "",
                 "uid": "",
                 "caps": "",
                 "fct_sn": "",
                 "fgt_sn": "",
                 "last_seen": "",
                 "deregister": "",
                 "run_cmd": "",
                 "quarantine_message": "",
                 "is_installed": "",
                 "is_managed": "",
                 "is_ems_registered": "",
                 "is_ems_online": "",
                 "is_ems_onnet": "",
                 "is_fgt_configured": "",
                 "is_fgt_registered": "",
                 "is_fgt_online": "",
                 "is_excluded": "",
                 "is_quarantined": "",
                 "quarantine_access_code": "",
                 "fct_version": "",
                 "comparable_fct_version": "",
                 "username": "",
                 "display_name": "",
                 "email": "",
                 "service": "",
                 "phone": "",
                 "user_domain": "",
                 "avatar_fingerprint": "",
                 "avatar": "",
                 "profile_name": "",
                 "is_profile_assigned": "",
                 "is_profile_synced": "",
                 "is_profile_imported": "",
                 "off_net_profile_name": "",
                 "is_off_net_profile_imported": "",
                 "is_off_net_profile_synced": "",
                 "ip_list_name": "",
                 "is_ip_list_synced": "",
                 "policy_sync": "",
                 "av_installed": "",
                 "av_enabled": "",
                 "av_hidden": "",
                 "ae_installed": "",
                 "ae_enabled": "",
                 "ae_hidden": "",
                 "cs_installed": "",
                 "cs_enabled": "",
                 "cs_hidden": "",
                 "rm_installed": "",
                 "rm_enabled": "",
                 "rm_hidden": "",
                 "fw_installed": "",
                 "fw_enabled": "",
                 "fw_hidden": "",
                 "wf_installed": "",
                 "wf_enabled": "",
                 "wf_hidden": "",
                 "vpn_installed": "",
                 "vpn_enabled": "",
                 "vpn_hidden": "",
                 "vuln_installed": "",
                 "vuln_enabled": "",
                 "vuln_hidden": "",
                 "ssoma_installed": "",
                 "ssoma_enabled": "",
                 "ssoma_hidden": "",
                 "sb_installed": "",
                 "sb_enabled": "",
                 "sb_hidden": "",
                 "av_last_scan_type": "",
                 "av_last_scan_date": "",
                 "av_last_full_scan_date": "",
                 "av_last_cancelled_scan_type": "",
                 "av_last_cancelled_scan_date": "",
                 "av_scan_scheduled": "",
                 "av_next_sch_type": "",
                 "av_next_scan_on": "",
                 "av_next_scan_hour": "",
                 "av_next_scan_min": "",
                 "av_next_scan_type": "",
                 "vuln_next_scheduled": "",
                 "vuln_next_sch_type": "",
                 "vuln_next_scan_on": "",
                 "vuln_next_start_hour": "",
                 "vuln_next_start_min": "",
                 "is_av_scanning": "",
                 "is_vuln_scanning": "",
                 "last_vuln_scan": "",
                 "vuln_scan_status": "",
                 "av_sig_version": "",
                 "av_eng_version": "",
                 "vuln_sig_version": "",
                 "vuln_eng_version": "",
                 "app_sig_version": "",
                 "app_eng_version": "",
                 "av_events_count": "",
                 "wf_events_count": "",
                 "fw_events_count": "",
                 "sb_events_count": "",
                 "ae_events_count": "",
                 "rm_events_count": "",
                 "cs_events_count": "",
                 "vuln_events_count": "",
                 "sys_events_count": "",
                 "vuln_events_max_severity": "",
                 "tags": ""
             }
         ],
         "total": ""
     }
}

operation: Get Events For Endpoint

Input parameters

Parameter Description
Device ID ID of the device whose associated events you want to retrieve from the Fortinet FortiClient EMS server.
Event Type Type of event that you want to retrieve for the specified device from the Fortinet FortiClient EMS server. You can choose from the following options: Antivirus Events, System Events, Web filter Events, or Vulnerability Events.
Offset (Optional)Index of the first item to be returned by this operation.
Aggregate List If you select this checkbox, then this operation will retrieve an aggregated event list from the Fortinet FortiClient EMS server.

Output

The output contains the following populated JSON schema:
{
     "events": [
         {
             "devicename": "",
             "id": "",
             "time": "",
             "type": "",
             "name": "",
             "source": "",
             "message": "",
             "context0": "",
             "context1": "",
             "context2": "",
             "context3": "",
             "context4": "",
             "context5": "",
             "context6": "",
             "context7": "",
             "context8": "",
             "context9": "",
             "context10": "",
             "checksum": "",
             "count": ""
         }
     ],
     "total": ""
}

operation: Get Verification Rules

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
     "result": {
         "retval": "",
         "message": ""
     },
     "data": {
         "policies": [
             {
                 "id": "",
                 "name": "",
                 "status": "",
                 "comments": "",
                 "tag_name": "",
                 "tag": ""
             }
         ],
         "total": ""
     }
}

operation: Get Host Verification Tags

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
     "result": {
         "retval": "",
         "message": ""
     },
     "data": [
         {
             "id": "",
             "name": "",
             "policies": [
                 {
                     "name": ""
                 }
             ]
         }
     ]
}

operation: Get Profile Details

Input parameters

Parameter Description
Profile ID ID of profile whose details you want to retrieve from the Fortinet FortiClient EMS server.

Output

The output contains the following populated JSON schema:
{
     "result": {
         "retval": "",
         "message": ""
     },
     "data": {
         "id": "",
         "name": "",
         "is_chrome": "",
         "is_default": "",
         "fp_id": "",
         "profile": {
             "id": "",
             "name": "",
             "fortiProductId": "",
             "isChrome": "",
             "isDefault": "",
             "xml": "",
             "advXml": "",
             "parserError": "",
             "syncError": "",
             "malware": {
                 "excludedFolders": "",
                 "excludedFiles": "",
                 "antivirus": {
                     "enabled": "",
                     "sbMalware": "",
                     "signatureTimer": "",
                     "scanEmail": "",
                     "shellIntegration": "",
                     "rootkitDetection": "",
                     "scanOnInsertion": "",
                     "scanMimeFile": "",
                     "fortiGuardAnalytics": "",
                     "signatureExpiredNotification": "",
                     "cullMalwareAfterDays": "",
                     "realTimeProtection": {
                         "enabled": "",
                         "scanCompressedFiles": "",
                         "compressedFilesMaxSize": "",
                         "scanWhen": "",
                         "scanWhenNetwork": "",
                         "ignoreSystemWhen": "",
                         "onVirusFound": "",
                         "alertOnDetect": "",
                         "antimalwareScanInterface": "",
                         "scanAdware": "",
                         "scanRiskware": "",
                         "rtpAdvHeuristicsEnabled": "",
                         "rtpAdvHeuristicsAction": "",
                         "excludedExtensions": ""
                     },
                     "onDemand": {
                         "signatureLoadMemoryThreshold": "",
                         "onVirusFound": "",
                         "pauseOnBatteryPower": "",
                         "allowAdminToStop": "",
                         "automaticVirusSubmission": "",
                         "scanCompressedFiles": "",
                         "compressedFilesMaxSize": "",
                         "scanRiskware": "",
                         "scanAdware": "",
                         "malwareAdvHeuristicsEnabled": "",
                         "malwareAdvHeuristicsAction": ""
                     },
                     "schedule": {
                         "enabled": "",
                         "ignore3rdPartyAvConflicts": "",
                         "scanType": "",
                         "scanRemovableMedia": "",
                         "scanNetworkDrives": "",
                         "priority": "",
                         "scheduleType": "",
                         "dayOfMonth": "",
                         "time": ""
                     }
                 },
                 "antiexploit": {
                     "enabled": "",
                     "notification": "",
                     "exclusions": ""
                 },
                 "usb": {
                     "enabled": "",
                     "show_bubble_notifications": "",
                     "action": "",
                     "rules": {}
                 },
                 "cloudscan": {
                     "enabled": "",
                     "timeoutEnabled": "",
                     "timeout": "",
                     "submitRemovable": "",
                     "submitNetwork": "",
                     "submitWeb": "",
                     "submitEmail": "",
                     "excludeTrustedSources": "",
                     "excludedExtensions": "",
                     "action": "",
                     "denyOnError": ""
                 }
             },
             "sandbox": {
                 "enabled": "",
                 "fortiSandboxId": "",
                 "serverType": "",
                 "address": "",
                 "authStatus": "",
                 "loginAuthenticated": "",
                 "username": "",
                 "mode": "",
                 "supportedExts": [],
                 "customExts": [],
                 "timeoutEnabled": "",
                 "timeout": "",
                 "submitRemovable": "",
                 "submitNetwork": "",
                 "submitWeb": "",
          &nbsnbsp;      "submitEmail": "",
                 "excludeTrustedSources": "",
                 "excludeCustomPaths": "",
                 "excludedFolders": "",
                 "excludedFiles": "",
                 "includeCustomPaths": "",
                 "includedFolders": "",
                 "includedFiles": "",
                 "action": "",
                 "denyOnError": "",
                 "verdictLevel": "",
                 "fortiCloudRegion": "",
                 "fortiCloudTimeOffset": ""
             },
             "webfilter": {
                 "enabled": "",
                 "syncWithFgtFmg": "",
                 "fgtFmgProfileId": "",
                 "blockMaliciousWebsites": "",
                 "useExclusionList": "",
                 "disableWhenManagedByFgt": "",
                 "logAllUrls": "",
                 "logUserInitiatedTraffic": "",
                 "safeSearch": "",
                 "restrictionLevel": "",
                 "httpsBlockMethod": "",
                 "httpsPluginEnabled": "",
                 "httpsPluginSyncMode": "",
                 "httpsPluginAddressbarOnly": "",
                 "wordFilterEnabled": "",
                 "wordFilterCategoryEnabled": "",
                 "wordFilterCustomEnabled": "",
                 "wordFilterCustom": [],
                 "categories": {
                     "enabled": "",
                     "rateIps": "",
                     "useHttps": "",
                     "allow_web": "",
                     "serverRegion": "",
                     "categories": {}
                 },
                 "urls": {
                     "urls": {}
                 },
                 "bannedWordCategories": {
                     "categories": {}
                 },
                 "fgtFmgProfiles": []
             },
             "firewall": {
                 "enabled": "",
                 "exploitSignaturesEnabled": "",
                 "showBubbleNotifications": "",
                 "cAndCEnabled": "",
                 "rules": {
                     "applications": {},
                     "applicationProperties": {},
                     "categories": {},
                     "unknownApplications": {
                         "action": ""
                     },
                     "filters": []
                 }
             },
             "vpn": {
                 "enabled": "",
                 "allowPersonalVpn": "",
                 "disableConnectDisconnect": "",
                 "showVpnBeforeLogon": "",
                 "useLegacyVpnBeforeLogon": "",
                 "useLocalCompCert": "",
                 "useCurrentUserCert": "",
                 "keepRunningMaxTries": "",
                 "minimizeWindowOnConnect": "",
                 "useWindowsCredentials": "",
                 "showNegotiationWindow": "",
                 "vendorId": "",
                 "sslEnabled": "",
                 "ipsecEnabled": "",
                 "dnsCacheServiceControl": "",
                 "preferSslVpnDns": "",
                 "disallowInvalidServerCert": "",
                 "beepIfError": "",
                 "useWindowsStoreCerts": "",
                 "useSmartCardCert": "",
                 "blockIpv6": "",
                 "enableUdpChecksum": "",
                 "disableDefaultRoute": "",
                 "showAuthCertOnly": "",
                 "checkForCertPrivateKey": "",
                 "enhancedKeyUsageMandatory": "",
                 "suppressVpnNotification": "",
                 "tunnels": []
             },
             "vulnerability": {
                 "enabled": "",
                 "scanOnFgtRegistration": "",
                 "scanOnSignatureUpdate": "",
                 "autoPatchEnabled": "",
                 "autoPatchLevel": "",
                 "osUpdates": "",
                 "proxyEnabled": "",
                 "exemptManual": "",
                 "exemptApplications": "",
                 "applicationExclusions": [],
                 "exemptNoAutoPatch": "",
                 "schedule": {
                     "enabled": "",
                        "scheduleType": "",
                     "scanTime": "",
                     "scan_on_maintenance": "",
                     "maintenance_period": "",
                     "maintenance_deadline": ""
                 }
             },
             "system": {
                 "ui": {
                     "disableBackup": "",
                     "hideUserInfo": "",
                     "hideTray": "",
                     "showHostTag": "",
                     "cultureCode": "",
                     "password": ""
                 },
                 "log": {
                     "level": "",
                     "events": [],
                     "onnet": "",
                     "upload": "",
                     "categories": "",
                     "server": "",
                     "ssl": "",
                     "frequency": "",
                     "retention": "",
                     "timeout": "",
                     "compressed": "",
                     "sendSoftwareInventory": "",
                     "sendWindowsEvent": "",
                     "sendWindowsEventInterval": "",
                     "logProtocol": "",
                     "netlogServer": ""
                 },
                 "proxy": {
                     "update": "",
                     "failover": "",
                     "online_scep": "",
                     "virusSubmission": "",
                     "protocol": "",
                     "server": "",
                     "port": "",
                     "username": "",
                     "password": ""
                 },
                 "update": {
                     "fmEnabled": "",
                     "fmServer": "",
                     "fmPort": "",
                     "fmFailoverPort": "",
                     "fmTimeout": "",
                     "fmFailover": "",
                     "autoPatch": "",
                     "updateAction": "",
                     "scheduled": "",
                     "scheduleType": "",
                     "updateTime": "",
                     "updateInterval": "",
                     "sendUsageStats": "",
                     "serverRegion": "",
                     "useLegacyFdn": ""
                 },
                 "fortiProxy": {
                     "enabled": "",
                     "https": "",
                     "timeout": "",
                     "pop3ClientComforting": "",
                     "pop3CerverComforting": "",
                     "smtpClientComforting": "",
                     "selfTestEnabled": "",
                     "selfTestNotification": "",
                     "selfTestLastPort": ""
                 },
                 "certificates": {
                     "ids": []
                 },
                 "userIdentity": {
                     "enableManuallyEntering": "",
                     "enableLinkedin": "",
                     "enableGoogle": "",
                     "enableSalesforce": "",
                     "notifyUser": ""
                 }
             },
             "endpoint": {
                 "display_antivirus": "",
                 "display_sandbox": "",
                 "display_webfilter": "",
                 "display_firewall": "",
                 "display_vpn": "",
                 "display_vulnerability_scan": "",
                 "bubbleNotifications": "",
                 "logoffNotification": "",
                 "disableUnregister": "",
                 "disableSwitch": "",
                 "hideComplianceWarning": "",
                 "sendSoftwareInventory": "",
                 "enableSubnets": "",
                 "enableMacs": "",
                 "subnets": [],
                 "macs": []
             },
             "singleSignOnMobilityAgent": {
                 "enabled": "",
                 "server": "",
                 "port": "",
                 "key": ""
             },
             "wanOptimization": {},
             "apple": {
                 "configName": ""
             },
             "basicXml": ""
         }
     }
}

operation: Get All Profiles

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
     "result": {
         "retval": "",
         "message": ""
     },
     "data": [
         {
             "id": "",
             "name": "",
             "profiles": [
                 {
                     "id": "",
                     "name": "",
                     "is_chrome": "",
                     "is_default": "",
                     "parser_error": "",
                     "update_time": "",
                     "fp_id": "",
                     "sync_task": "",
                     "sync_error": "",
                     "manual_sync_time": ""
                 }
             ]
         }
     ]
}

Included playbooks

The Sample - Fortinet FortiClient EMS - 1.0.0 playbook collection comes bundled with the Fortinet FortiClient EMS connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Fortinet FortiClient EMS connector.

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.