About the connector
FortiClient Enterprise Management Server (FortiClient EMS) is a security management solution that enables scalable and centralized management of multiple endpoints (computers). FortiClient EMS provides efficient and effective administration of endpoints running FortiClient.
This document provides information about the Fortinet FortiClient EMS connector, which facilitates automated interactions, with the Fortinet FortiClient EMS server using FortiSOAR™ playbooks. Add the Fortinet FortiClient EMS connector as a step in FortiSOAR™ playbooks and perform automated operations, such as quarantining or unquarantining an endpoint ticket in Fortinet FortiClient EMS or retrieving details for events, profiles, etc. from Fortinet FortiClient EMS.
Version information
Connector Version: 1.0.0
FortiSOAR™ Version Tested on: 6.4.1-2133
FortiClient EMS version Tested on: 6.4.0
Authored By: Fortinet
Certified: Yes
Installing the connector
From FortiSOAR™ 5.0.0 onwards, use the Connector Store to install the connector. For the detailed procedure to install a connector, click here.
You can also use the yum command to install connectors. Connectors provided by FortiSOAR™ are delivered using a FortiSOAR™ repository. Therefore, you must set up your FortiSOAR™ repository and run the yum command as a root user to install connectors:
yum install cyops-connector-fortinet-forticlient-ems
Prerequisites to configuring the connector
- You must have the URL of the Fortinet FortiClient EMS server to which you will connect and perform automated operations and credentials (username-password pair) to access that server.
- To access the FortiSOAR™ UI, ensure that port 443 is open through the firewall for the FortiSOAR™ instance.
- To run actions using the Fortinet FortiClient connector, uses must be assigned appropriate "Roles". Roles are associated with different permissions. To view the various roles that can be assigned to a user, in the Fortinet FortiClient EMS server, navigate to Administration >> Admin Roles.
For example, if you have assigned a role with only "Read" permissions to a user, then that user can run actions such as Get All Endpoints, Get Endpoint Details, etc, but not run actions such as Quarantine Endpoints, Unquarantine Endpoints, etc
Configuring the connector
For the procedure to configure a connector, click here.
Configuration parameters
In FortiSOAR™, on the Connectors page, click the Fortinet FortiClient EMS connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:
| Parameter |
Description |
| Server URL |
URL of the FortiClient EMS server to which you will connect and perform automated operations. |
| Username |
Username used to access the FortiClient EMS server to which you will connect and perform the automated operations. |
| Password |
Password used to access the FortiClient EMS server to which you will connect and perform the automated operations. |
| Domain |
Domain name of the FortiClient EMS server to which you will connect and perform the automated operations. |
| Verify SSL |
Specifies whether the SSL certificate for the server is to be verified or not. |
Actions supported by the connector
The following automated operations can be included in playbooks and you can also use the annotations to access operations from version 4.10.0 and onwards:
| Function |
Description |
Annotation and Category |
| Quarantine Endpoints |
Quarantines the specified endpoints on the Fortinet FortiClient EMS server based on the endpoint IDs you have specified. |
quarantine_endpoints
Investigation |
| Unquarantine Endpoints |
Unquarantines the specified endpoints on the Fortinet FortiClient EMS server based on the endpoint IDs you have specified. |
unquarantine_endpoints
Investigation |
| Get All Endpoints |
Retrieves a list of all the endpoints connected to the specified Fortinet FortiClient EMS server. |
get_endpoints
Investigation |
| Get Endpoint Details |
Retrieves details for a specific endpoint from the Fortinet FortiClient EMS server based on the device ID you have specified. |
get_endpoints
Investigation |
| Get Events For Endpoint |
Retrieves events related to a specific endpoint from the Fortinet FortiClient EMS server based on the device ID, event type, and other input parameters you have specified. |
get_events_for_endpoint
Investigation |
| Get Verification Rules |
Retrieves a list of all compliance verification rules from the Fortinet FortiClient EMS server. |
get_host_verification_rules
Investigation |
| Get Host Verification Tags |
Retrieves a list of all host verification tags from the Fortinet FortiClient EMS server. |
get_host_verification_tags
Investigation |
| Get Profile Details |
Retrieves information for a specific profile from the Fortinet FortiClient EMS server based on the profile ID you have specified. |
get_profile_by_id
Investigation |
| Get All Profiles |
Retrieves information for all profiles from the Fortinet FortiClient EMS server. |
get_all_profiles
Investigation |
operation: Quarantine Endpoints
Input parameters
| Parameter |
Description |
| Endpoint IDs |
IDs of the endpoints to quarantine on the Fortinet FortiClient EMS server. |
Output
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": [
{
"id": "",
"name": "",
"full_host": "",
"host": "",
"ip_addr": "",
"uid": "",
"retval": "",
"message": ""
}
]
}
operation: Unquarantine Endpoints
Input parameters
| Parameter |
Description |
| Endpoint IDs |
IDs of the endpoints to unquarantine on the Fortinet FortiClient EMS server. |
Output
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": [
{
"id": "",
"name": "",
"full_host": "",
"host": "",
"ip_addr": "",
"uid": "",
"retval": "",
"message": ""
}
]
}
operation: Get All Endpoints
Input parameters
| Parameter |
Description |
| Count |
(Optional) The number of endpoints to be returned by this operation. |
| Offset |
(Optional) Index of the first item to be returned by this operation. |
Output
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": {
"endpoints": [
{
"device_id": "",
"name": "",
"ip_addr": "",
"os_version": "",
"group_id": "",
"group_name": "",
"group_path": "",
"orig_group_name": "",
"orig_group_id": "",
"endpoint_policy_name": "",
"domain_id": "",
"installer_name": "",
"deployment_state": "",
"last_seen": "",
"is_installed": "",
"is_managed": "",
"is_ems_registered": "",
"is_ems_online": "",
"is_ems_onnet": "",
"is_fgt_configured": "",
"is_fgt_registered": "",
"is_fgt_online": "",
"is_excluded": "",
"is_quarantined": "",
"quarantine_access_code": "",
"comparable_fct_version": "",
"username": "",
"display_name": "",
"avatar": "",
"profile_name": "",
"is_profile_synced": "",
"off_net_profile_name": "",
"is_off_net_profile_synced": "",
"ip_list_name": "",
"is_ip_list_synced": "",
"policy_sync": "",
"av_enabled": "",
"ae_enabled": "",
"cs_enabled": "",
"rm_enabled": "",
"fw_enabled": "",
"wf_enabled": "",
"vpn_enabled": "",
"vuln_enabled": "",
"ssoma_enabled": "",
"sb_enabled": "",
"av_events_count": "",
"wf_events_count": "",
"fw_events_count": "",
"sb_events_count": "",
"ae_events_count": "",
"rm_events_count": "",
"cs_events_count": "",
"vuln_events_count": "",
"sys_events_count": "",
"vuln_events_max_severity": ""
}
],
"total": ""
}
}
operation: Get Endpoint Details
Input parameters
| Parameter |
Description |
| Device ID |
ID of the device whose details you want to retrieve from the Fortinet FortiClient EMS server. |
Output
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": {
"endpoints": [
{
"device_id": "",
"host": "",
"alias": "",
"name": "",
"ip_addr": "",
"mac_addr": "",
"os_version": "",
"os_service_pack": "",
"distinguished_name": "",
"group_tag": "",
"group_id": "",
"group_name": "",
"group_path": "",
"orig_group_name": "",
"orig_group_id": "",
"endpoint_policy_name": "",
"domain_id": "",
"installer_name": "",
"deployment_state": "",
"scheduled_install_time": "",
"installation_state": "",
"deployment_state_time": "",
"deployment_state_data": "",
"forticlient_id": "",
"uid": "",
"caps": "",
"fct_sn": "",
"fgt_sn": "",
"last_seen": "",
"deregister": "",
"run_cmd": "",
"quarantine_message": "",
"is_installed": "",
"is_managed": "",
"is_ems_registered": "",
"is_ems_online": "",
"is_ems_onnet": "",
"is_fgt_configured": "",
"is_fgt_registered": "",
"is_fgt_online": "",
"is_excluded": "",
"is_quarantined": "",
"quarantine_access_code": "",
"fct_version": "",
"comparable_fct_version": "",
"username": "",
"display_name": "",
"email": "",
"service": "",
"phone": "",
"user_domain": "",
"avatar_fingerprint": "",
"avatar": "",
"profile_name": "",
"is_profile_assigned": "",
"is_profile_synced": "",
"is_profile_imported": "",
"off_net_profile_name": "",
"is_off_net_profile_imported": "",
"is_off_net_profile_synced": "",
"ip_list_name": "",
"is_ip_list_synced": "",
"policy_sync": "",
"av_installed": "",
"av_enabled": "",
"av_hidden": "",
"ae_installed": "",
"ae_enabled": "",
"ae_hidden": "",
"cs_installed": "",
"cs_enabled": "",
"cs_hidden": "",
"rm_installed": "",
"rm_enabled": "",
"rm_hidden": "",
"fw_installed": "",
"fw_enabled": "",
"fw_hidden": "",
"wf_installed": "",
"wf_enabled": "",
"wf_hidden": "",
"vpn_installed": "",
"vpn_enabled": "",
"vpn_hidden": "",
"vuln_installed": "",
"vuln_enabled": "",
"vuln_hidden": "",
"ssoma_installed": "",
"ssoma_enabled": "",
"ssoma_hidden": "",
"sb_installed": "",
"sb_enabled": "",
"sb_hidden": "",
"av_last_scan_type": "",
"av_last_scan_date": "",
"av_last_full_scan_date": "",
"av_last_cancelled_scan_type": "",
"av_last_cancelled_scan_date": "",
"av_scan_scheduled": "",
"av_next_sch_type": "",
"av_next_scan_on": "",
"av_next_scan_hour": "",
"av_next_scan_min": "",
"av_next_scan_type": "",
"vuln_next_scheduled": "",
"vuln_next_sch_type": "",
"vuln_next_scan_on": "",
"vuln_next_start_hour": "",
"vuln_next_start_min": "",
"is_av_scanning": "",
"is_vuln_scanning": "",
"last_vuln_scan": "",
"vuln_scan_status": "",
"av_sig_version": "",
"av_eng_version": "",
"vuln_sig_version": "",
"vuln_eng_version": "",
"app_sig_version": "",
"app_eng_version": "",
"av_events_count": "",
"wf_events_count": "",
"fw_events_count": "",
"sb_events_count": "",
"ae_events_count": "",
"rm_events_count": "",
"cs_events_count": "",
"vuln_events_count": "",
"sys_events_count": "",
"vuln_events_max_severity": "",
"tags": ""
}
],
"total": ""
}
}
operation: Get Events For Endpoint
Input parameters
| Parameter |
Description |
| Device ID |
ID of the device whose associated events you want to retrieve from the Fortinet FortiClient EMS server. |
| Event Type |
Type of event that you want to retrieve for the specified device from the Fortinet FortiClient EMS server. You can choose from the following options: Antivirus Events, System Events, Web filter Events, or Vulnerability Events. |
| Offset |
(Optional) Index of the first item to be returned by this operation. |
| Aggregate List |
If you select this checkbox, then this operation will retrieve an aggregated event list from the Fortinet FortiClient EMS server. |
Output
The output contains the following populated JSON schema:
{
"events": [
{
"devicename": "",
"id": "",
"time": "",
"type": "",
"name": "",
"source": "",
"message": "",
"context0": "",
"context1": "",
"context2": "",
"context3": "",
"context4": "",
"context5": "",
"context6": "",
"context7": "",
"context8": "",
"context9": "",
"context10": "",
"checksum": "",
"count": ""
}
],
"total": ""
}
operation: Get Verification Rules
Input parameters
None.
Output
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": {
"policies": [
{
"id": "",
"name": "",
"status": "",
"comments": "",
"tag_name": "",
"tag": ""
}
],
"total": ""
}
}
operation: Get Host Verification Tags
Input parameters
None.
Output
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": [
{
"id": "",
"name": "",
"policies": [
{
"name": ""
}
]
}
]
}
operation: Get Profile Details
Input parameters
| Parameter |
Description |
| Profile ID |
ID of profile whose details you want to retrieve from the Fortinet FortiClient EMS server. |
Output
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": {
"id": "",
"name": "",
"is_chrome": "",
"is_default": "",
"fp_id": "",
"profile": {
"id": "",
"name": "",
"fortiProductId": "",
"isChrome": "",
"isDefault": "",
"xml": "",
"advXml": "",
"parserError": "",
"syncError": "",
"malware": {
"excludedFolders": "",
"excludedFiles": "",
"antivirus": {
"enabled": "",
"sbMalware": "",
"signatureTimer": "",
"scanEmail": "",
"shellIntegration": "",
"rootkitDetection": "",
"scanOnInsertion": "",
"scanMimeFile": "",
"fortiGuardAnalytics": "",
"signatureExpiredNotification": "",
"cullMalwareAfterDays": "",
"realTimeProtection": {
"enabled": "",
"scanCompressedFiles": "",
"compressedFilesMaxSize": "",
"scanWhen": "",
"scanWhenNetwork": "",
"ignoreSystemWhen": "",
"onVirusFound": "",
"alertOnDetect": "",
"antimalwareScanInterface": "",
"scanAdware": "",
"scanRiskware": "",
"rtpAdvHeuristicsEnabled": "",
"rtpAdvHeuristicsAction": "",
"excludedExtensions": ""
},
"onDemand": {
"signatureLoadMemoryThreshold": "",
"onVirusFound": "",
"pauseOnBatteryPower": "",
"allowAdminToStop": "",
"automaticVirusSubmission": "",
"scanCompressedFiles": "",
"compressedFilesMaxSize": "",
"scanRiskware": "",
"scanAdware": "",
"malwareAdvHeuristicsEnabled": "",
"malwareAdvHeuristicsAction": ""
},
"schedule": {
"enabled": "",
"ignore3rdPartyAvConflicts": "",
"scanType": "",
"scanRemovableMedia": "",
"scanNetworkDrives": "",
"priority": "",
"scheduleType": "",
"dayOfMonth": "",
"time": ""
}
},
"antiexploit": {
"enabled": "",
"notification": "",
"exclusions": ""
},
"usb": {
"enabled": "",
"show_bubble_notifications": "",
"action": "",
"rules": {}
},
"cloudscan": {
"enabled": "",
"timeoutEnabled": "",
"timeout": "",
"submitRemovable": "",
"submitNetwork": "",
"submitWeb": "",
"submitEmail": "",
"excludeTrustedSources": "",
"excludedExtensions": "",
"action": "",
"denyOnError": ""
}
},
"sandbox": {
"enabled": "",
"fortiSandboxId": "",
"serverType": "",
"address": "",
"authStatus": "",
"loginAuthenticated": "",
"username": "",
"mode": "",
"supportedExts": [],
"customExts": [],
"timeoutEnabled": "",
"timeout": "",
"submitRemovable": "",
"submitNetwork": "",
"submitWeb": "",
"submitEmail": "",
"excludeTrustedSources": "",
"excludeCustomPaths": "",
"excludedFolders": "",
"excludedFiles": "",
"includeCustomPaths": "",
"includedFolders": "",
"includedFiles": "",
"action": "",
"denyOnError": "",
"verdictLevel": "",
"fortiCloudRegion": "",
"fortiCloudTimeOffset": ""
},
"webfilter": {
"enabled": "",
"syncWithFgtFmg": "",
"fgtFmgProfileId": "",
"blockMaliciousWebsites": "",
"useExclusionList": "",
"disableWhenManagedByFgt": "",
"logAllUrls": "",
"logUserInitiatedTraffic": "",
"safeSearch": "",
"restrictionLevel": "",
"httpsBlockMethod": "",
"httpsPluginEnabled": "",
"httpsPluginSyncMode": "",
"httpsPluginAddressbarOnly": "",
"wordFilterEnabled": "",
"wordFilterCategoryEnabled": "",
"wordFilterCustomEnabled": "",
"wordFilterCustom": [],
"categories": {
"enabled": "",
"rateIps": "",
"useHttps": "",
"allow_web": "",
"serverRegion": "",
"categories": {}
},
"urls": {
"urls": {}
},
"bannedWordCategories": {
"categories": {}
},
"fgtFmgProfiles": []
},
"firewall": {
"enabled": "",
"exploitSignaturesEnabled": "",
"showBubbleNotifications": "",
"cAndCEnabled": "",
"rules": {
"applications": {},
"applicationProperties": {},
"categories": {},
"unknownApplications": {
"action": ""
},
"filters": []
}
},
"vpn": {
"enabled": "",
"allowPersonalVpn": "",
"disableConnectDisconnect": "",
"showVpnBeforeLogon": "",
"useLegacyVpnBeforeLogon": "",
"useLocalCompCert": "",
"useCurrentUserCert": "",
"keepRunningMaxTries": "",
"minimizeWindowOnConnect": "",
"useWindowsCredentials": "",
"showNegotiationWindow": "",
"vendorId": "",
"sslEnabled": "",
"ipsecEnabled": "",
"dnsCacheServiceControl": "",
"preferSslVpnDns": "",
"disallowInvalidServerCert": "",
"beepIfError": "",
"useWindowsStoreCerts": "",
"useSmartCardCert": "",
"blockIpv6": "",
"enableUdpChecksum": "",
"disableDefaultRoute": "",
"showAuthCertOnly": "",
"checkForCertPrivateKey": "",
"enhancedKeyUsageMandatory": "",
"suppressVpnNotification": "",
"tunnels": []
},
"vulnerability": {
"enabled": "",
"scanOnFgtRegistration": "",
"scanOnSignatureUpdate": "",
"autoPatchEnabled": "",
"autoPatchLevel": "",
"osUpdates": "",
"proxyEnabled": "",
"exemptManual": "",
"exemptApplications": "",
"applicationExclusions": [],
"exemptNoAutoPatch": "",
"schedule": {
"enabled": "",
"scheduleType": "",
"scanTime": "",
"scan_on_maintenance": "",
"maintenance_period": "",
"maintenance_deadline": ""
}
},
"system": {
"ui": {
"disableBackup": "",
"hideUserInfo": "",
"hideTray": "",
"showHostTag": "",
"cultureCode": "",
"password": ""
},
"log": {
"level": "",
"events": [],
"onnet": "",
"upload": "",
"categories": "",
"server": "",
"ssl": "",
"frequency": "",
"retention": "",
"timeout": "",
"compressed": "",
"sendSoftwareInventory": "",
"sendWindowsEvent": "",
"sendWindowsEventInterval": "",
"logProtocol": "",
"netlogServer": ""
},
"proxy": {
"update": "",
"failover": "",
"online_scep": "",
"virusSubmission": "",
"protocol": "",
"server": "",
"port": "",
"username": "",
"password": ""
},
"update": {
"fmEnabled": "",
"fmServer": "",
"fmPort": "",
"fmFailoverPort": "",
"fmTimeout": "",
"fmFailover": "",
"autoPatch": "",
"updateAction": "",
"scheduled": "",
"scheduleType": "",
"updateTime": "",
"updateInterval": "",
"sendUsageStats": "",
"serverRegion": "",
"useLegacyFdn": ""
},
"fortiProxy": {
"enabled": "",
"https": "",
"timeout": "",
"pop3ClientComforting": "",
"pop3CerverComforting": "",
"smtpClientComforting": "",
"selfTestEnabled": "",
"selfTestNotification": "",
"selfTestLastPort": ""
},
"certificates": {
"ids": []
},
"userIdentity": {
"enableManuallyEntering": "",
"enableLinkedin": "",
"enableGoogle": "",
"enableSalesforce": "",
"notifyUser": ""
}
},
"endpoint": {
"display_antivirus": "",
"display_sandbox": "",
"display_webfilter": "",
"display_firewall": "",
"display_vpn": "",
"display_vulnerability_scan": "",
"bubbleNotifications": "",
"logoffNotification": "",
"disableUnregister": "",
"disableSwitch": "",
"hideComplianceWarning": "",
"sendSoftwareInventory": "",
"enableSubnets": "",
"enableMacs": "",
"subnets": [],
"macs": []
},
"singleSignOnMobilityAgent": {
"enabled": "",
"server": "",
"port": "",
"key": ""
},
"wanOptimization": {},
"apple": {
"configName": ""
},
"basicXml": ""
}
}
}
operation: Get All Profiles
Input parameters
None.
Output
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": [
{
"id": "",
"name": "",
"profiles": [
{
"id": "",
"name": "",
"is_chrome": "",
"is_default": "",
"parser_error": "",
"update_time": "",
"fp_id": "",
"sync_task": "",
"sync_error": "",
"manual_sync_time": ""
}
]
}
]
}
Included playbooks
The Sample - Fortinet FortiClient EMS - 1.0.0 playbook collection comes bundled with the Fortinet FortiClient EMS connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Fortinet FortiClient EMS connector.
- Get All Endpoints
- Get All Profiles
- Get Endpoint Details
- Get Events For Endpoint
- Get Host Verification Tags
- Get Profile Details
- Get Verification Rules
- Quarantine Endpoints
- Unquarantine Endpoints
Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.
