FortiClient Enterprise Management Server (FortiClient EMS) is a security management solution that enables scalable and centralized management of multiple endpoints (computers). FortiClient EMS provides efficient and effective administration of endpoints running FortiClient.
This document provides information about the Fortinet FortiClient EMS connector, which facilitates automated interactions, with the Fortinet FortiClient EMS server using FortiSOAR™ playbooks. Add the Fortinet FortiClient EMS connector as a step in FortiSOAR™ playbooks and perform automated operations, such as quarantining or unquarantining an endpoint ticket in Fortinet FortiClient EMS or retrieving details for events, profiles, etc. from Fortinet FortiClient EMS.
Connector Version: 1.0.1
FortiSOAR™ Version Tested on: 7.2.0-914
FortiClient EMS version Tested on: 7.0.2 build 0123
Authored By: Fortinet
Certified: Yes
Following enhancements have been made to the Fortinet FortiClient EMS connector in version 1.0.1:
Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.
You can also use the following yum command as a root
user to install connectors from an SSH session:
yum install cyops-connector-fortinet-forticlient-ems
To run actions using the Fortinet FortiClient connector users must be assigned appropriate "Roles". Roles are associated with different permissions. To view the various roles that can be assigned to a user, in the Fortinet FortiClient EMS server, navigate to Administration >> Admin Roles.
For example, if you have assigned a role with only "Read" permissions to a user, then that user can run actions such as Get All Endpoints, Get Endpoint Details, etc, but not run actions such as Quarantine Endpoints, Unquarantine Endpoints, etc
You do not require to configure this connector since it looks up the freely accessible Fortinet FortiClient EMS blocklists. For the description of the Content Hub and other details, click here.
In FortiSOAR™, on the Content Hub (or Connector Store) page, click the Manage tab, and then click the Fortinet FortiClient EMS connector card. On the connector popup, click the Configurations tab to enter the required configuration details.
Parameter | Description |
---|---|
Server URL | The URL of the FortiClient EMS server to which you will connect and perform automated operations. |
Username | The username used to access the FortiClient EMS server to which you will connect and perform the automated operations. |
Password | The Password used to access the FortiClient EMS server to which you will connect and perform the automated operations. |
Domain | The domain name of the FortiClient EMS server to which you will connect and perform the automated operations. |
Verify SSL | Specifies whether the SSL certificate for the server is to be verified or not. |
The following automated operations can be included in playbooks and you can also use the annotations to access operations from version 4.10.0 and onwards:
Function | Description | Annotation and Category |
---|---|---|
Quarantine Endpoints | Quarantines the specified endpoints on the Fortinet FortiClient EMS server based on the endpoint IDs you have specified. | quarantine_endpoints Investigation |
Unquarantine Endpoints | Unquarantines the specified endpoints on the Fortinet FortiClient EMS server based on the endpoint IDs you have specified. | unquarantine_endpoints Investigation |
Get All Endpoints | Retrieves a list of all the endpoints connected to the specified Fortinet FortiClient EMS server. | get_endpoints Investigation |
Get Endpoint Details | Retrieves details for a specific endpoint from the Fortinet FortiClient EMS server based on the device ID you have specified. | get_endpoints Investigation |
Get Events For Endpoint | Retrieves events related to a specific endpoint from the Fortinet FortiClient EMS server based on the device ID, event type, and other input parameters you have specified. | get_events_for_endpoint Investigation |
Get Verification Rules | (Deprecated) Retrieves a list of all compliance verification rules from the Fortinet FortiClient EMS server. | get_host_verification_rules Investigation |
Get Host Verification Tags | (Deprecated) Retrieves a list of all host verification tags from the Fortinet FortiClient EMS server. | get_host_verification_tags Investigation |
Get Profile Details | Retrieves information for a specific profile from the Fortinet FortiClient EMS server based on the profile ID you have specified. | get_profile_by_id Investigation |
Get All Profiles | Retrieves information for all profiles from the Fortinet FortiClient EMS server. | get_all_profiles Investigation |
Parameter | Description |
---|---|
Endpoint IDs | IDs of the endpoints to quarantine on the Fortinet FortiClient EMS server. |
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": [
{
"id": "",
"name": "",
"full_host": "",
"host": "",
"ip_addr": "",
"uid": "",
"retval": "",
"message": ""
}
]
}
Parameter | Description |
---|---|
Endpoint IDs | IDs of the endpoints to unquarantine on the Fortinet FortiClient EMS server. |
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": [
{
"id": "",
"name": "",
"full_host": "",
"host": "",
"ip_addr": "",
"uid": "",
"retval": "",
"message": ""
}
]
}
Parameter | Description |
---|---|
Count | (Optional) The number of endpoints to be returned by this operation. |
Offset | (Optional) Index of the first item to be returned by this operation. |
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": {
"endpoints": [
{
"device_id": "",
"name": "",
"ip_addr": "",
"os_version": "",
"group_id": "",
"group_name": "",
"group_path": "",
"orig_group_name": "",
"orig_group_id": "",
"endpoint_policy_name": "",
"domain_id": "",
"installer_name": "",
"deployment_state": "",
"last_seen": "",
"is_installed": "",
"is_managed": "",
"is_ems_registered": "",
"is_ems_online": "",
"is_ems_onnet": "",
"is_fgt_configured": "",
"is_fgt_registered": "",
"is_fgt_online": "",
"is_excluded": "",
"is_quarantined": "",
"quarantine_access_code": "",
"comparable_fct_version": "",
"username": "",
"display_name": "",
"avatar": "",
"profile_name": "",
"is_profile_synced": "",
"off_net_profile_name": "",
"is_off_net_profile_synced": "",
"ip_list_name": "",
"is_ip_list_synced": "",
"policy_sync": "",
"av_enabled": "",
"ae_enabled": "",
"cs_enabled": "",
"rm_enabled": "",
"fw_enabled": "",
"wf_enabled": "",
"vpn_enabled": "",
"vuln_enabled": "",
"ssoma_enabled": "",
"sb_enabled": "",
"av_events_count": "",
"wf_events_count": "",
"fw_events_count": "",
"sb_events_count": "",
"ae_events_count": "",
"rm_events_count": "",
"cs_events_count": "",
"vuln_events_count": "",
"sys_events_count": "",
"vuln_events_max_severity": ""
}
],
"total": ""
}
}
Parameter | Description |
---|---|
Device ID | ID of the device whose details you want to retrieve from the Fortinet FortiClient EMS server. |
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": {
"endpoints": [
{
"device_id": "",
"host": "",
"alias": "",
"name": "",
"ip_addr": "",
"mac_addr": "",
"os_version": "",
"os_service_pack": "",
"distinguished_name": "",
"group_tag": "",
"group_id": "",
"group_name": "",
"group_path": "",
"orig_group_name": "",
"orig_group_id": "",
"endpoint_policy_name": "",
"domain_id": "",
"installer_name": "",
"deployment_state": "",
"scheduled_install_time": "",
"installation_state": "",
"deployment_state_time": "",
"deployment_state_data": "",
"forticlient_id": "",
"uid": "",
"caps": "",
"fct_sn": "",
"fgt_sn": "",
"last_seen": "",
"deregister": "",
"run_cmd": "",
"quarantine_message": "",
"is_installed": "",
"is_managed": "",
"is_ems_registered": "",
"is_ems_online": "",
"is_ems_onnet": "",
"is_fgt_configured": "",
"is_fgt_registered": "",
"is_fgt_online": "",
"is_excluded": "",
"is_quarantined": "",
"quarantine_access_code": "",
"fct_version": "",
"comparable_fct_version": "",
"username": "",
"display_name": "",
"email": "",
"service": "",
"phone": "",
"user_domain": "",
"avatar_fingerprint": "",
"avatar": "",
"profile_name": "",
"is_profile_assigned": "",
"is_profile_synced": "",
"is_profile_imported": "",
"off_net_profile_name": "",
"is_off_net_profile_imported": "",
"is_off_net_profile_synced": "",
"ip_list_name": "",
"is_ip_list_synced": "",
"policy_sync": "",
"av_installed": "",
"av_enabled": "",
"av_hidden": "",
"ae_installed": "",
"ae_enabled": "",
"ae_hidden": "",
"cs_installed": "",
"cs_enabled": "",
"cs_hidden": "",
"rm_installed": "",
"rm_enabled": "",
"rm_hidden": "",
"fw_installed": "",
"fw_enabled": "",
"fw_hidden": "",
"wf_installed": "",
"wf_enabled": "",
"wf_hidden": "",
"vpn_installed": "",
"vpn_enabled": "",
"vpn_hidden": "",
"vuln_installed": "",
"vuln_enabled": "",
"vuln_hidden": "",
"ssoma_installed": "",
"ssoma_enabled": "",
"ssoma_hidden": "",
"sb_installed": "",
"sb_enabled": "",
"sb_hidden": "",
"av_last_scan_type": "",
"av_last_scan_date": "",
"av_last_full_scan_date": "",
"av_last_cancelled_scan_type": "",
"av_last_cancelled_scan_date": "",
"av_scan_scheduled": "",
"av_next_sch_type": "",
"av_next_scan_on": "",
"av_next_scan_hour": "",
"av_next_scan_min": "",
"av_next_scan_type": "",
"vuln_next_scheduled": "",
"vuln_next_sch_type": "",
"vuln_next_scan_on": "",
"vuln_next_start_hour": "",
"vuln_next_start_min": "",
"is_av_scanning": "",
"is_vuln_scanning": "",
"last_vuln_scan": "",
"vuln_scan_status": "",
"av_sig_version": "",
"av_eng_version": "",
"vuln_sig_version": "",
"vuln_eng_version": "",
"app_sig_version": "",
"app_eng_version": "",
"av_events_count": "",
"wf_events_count": "",
"fw_events_count": "",
"sb_events_count": "",
"ae_events_count": "",
"rm_events_count": "",
"cs_events_count": "",
"vuln_events_count": "",
"sys_events_count": "",
"vuln_events_max_severity": "",
"tags": ""
}
],
"total": ""
}
}
Parameter | Description |
---|---|
Device ID | ID of the device whose associated events you want to retrieve from the Fortinet FortiClient EMS server. |
Event Type | Type of event that you want to retrieve for the specified device from the Fortinet FortiClient EMS server. You can choose from the following options: Antivirus Events, System Events, Web filter Events, or Vulnerability Events. |
Offset | (Optional) Index of the first item to be returned by this operation. |
Aggregate List | If you select this checkbox, then this operation will retrieve an aggregated event list from the Fortinet FortiClient EMS server. |
The output contains the following populated JSON schema:
{
"events": [
{
"devicename": "",
"id": "",
"time": "",
"type": "",
"name": "",
"source": "",
"message": "",
"context0": "",
"context1": "",
"context2": "",
"context3": "",
"context4": "",
"context5": "",
"context6": "",
"context7": "",
"context8": "",
"context9": "",
"context10": "",
"checksum": "",
"count": ""
}
],
"total": ""
}
None.
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": {
"policies": [
{
"id": "",
"name": "",
"status": "",
"comments": "",
"tag_name": "",
"tag": ""
}
],
"total": ""
}
}
None.
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": [
{
"id": "",
"name": "",
"policies": [
{
"name": ""
}
]
}
]
}
Parameter | Description |
---|---|
Profile ID | ID of profile whose details you want to retrieve from the Fortinet FortiClient EMS server. |
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": {
"id": "",
"name": "",
"is_chrome": "",
"is_default": "",
"fp_id": "",
"profile": {
"id": "",
"name": "",
"fortiProductId": "",
"isChrome": "",
"isDefault": "",
"xml": "",
"advXml": "",
"parserError": "",
"syncError": "",
"malware": {
"excludedFolders": "",
"excludedFiles": "",
"antivirus": {
"enabled": "",
"sbMalware": "",
"signatureTimer": "",
"scanEmail": "",
"shellIntegration": "",
"rootkitDetection": "",
"scanOnInsertion": "",
"scanMimeFile": "",
"fortiGuardAnalytics": "",
"signatureExpiredNotification": "",
"cullMalwareAfterDays": "",
"realTimeProtection": {
"enabled": "",
"scanCompressedFiles": "",
"compressedFilesMaxSize": "",
"scanWhen": "",
"scanWhenNetwork": "",
"ignoreSystemWhen": "",
"onVirusFound": "",
"alertOnDetect": "",
"antimalwareScanInterface": "",
"scanAdware": "",
"scanRiskware": "",
"rtpAdvHeuristicsEnabled": "",
"rtpAdvHeuristicsAction": "",
"excludedExtensions": ""
},
"onDemand": {
"signatureLoadMemoryThreshold": "",
"onVirusFound": "",
"pauseOnBatteryPower": "",
"allowAdminToStop": "",
"automaticVirusSubmission": "",
"scanCompressedFiles": "",
"compressedFilesMaxSize": "",
"scanRiskware": "",
"scanAdware": "",
"malwareAdvHeuristicsEnabled": "",
"malwareAdvHeuristicsAction": ""
},
"schedule": {
"enabled": "",
"ignore3rdPartyAvConflicts": "",
"scanType": "",
"scanRemovableMedia": "",
"scanNetworkDrives": "",
"priority": "",
"scheduleType": "",
"dayOfMonth": "",
"time": ""
}
},
"antiexploit": {
"enabled": "",
"notification": "",
"exclusions": ""
},
"usb": {
"enabled": "",
"show_bubble_notifications": "",
"action": "",
"rules": {}
},
"cloudscan": {
"enabled": "",
"timeoutEnabled": "",
"timeout": "",
"submitRemovable": "",
"submitNetwork": "",
"submitWeb": "",
"submitEmail": "",
"excludeTrustedSources": "",
"excludedExtensions": "",
"action": "",
"denyOnError": ""
}
},
"sandbox": {
"enabled": "",
"fortiSandboxId": "",
"serverType": "",
"address": "",
"authStatus": "",
"loginAuthenticated": "",
"username": "",
"mode": "",
"supportedExts": [],
"customExts": [],
"timeoutEnabled": "",
"timeout": "",
"submitRemovable": "",
"submitNetwork": "",
"submitWeb": "",
"submitEmail": "",
"excludeTrustedSources": "",
"excludeCustomPaths": "",
"excludedFolders": "",
"excludedFiles": "",
"includeCustomPaths": "",
"includedFolders": "",
"includedFiles": "",
"action": "",
"denyOnError": "",
"verdictLevel": "",
"fortiCloudRegion": "",
"fortiCloudTimeOffset": ""
},
"webfilter": {
"enabled": "",
"syncWithFgtFmg": "",
"fgtFmgProfileId": "",
"blockMaliciousWebsites": "",
"useExclusionList": "",
"disableWhenManagedByFgt": "",
"logAllUrls": "",
"logUserInitiatedTraffic": "",
"safeSearch": "",
"restrictionLevel": "",
"httpsBlockMethod": "",
"httpsPluginEnabled": "",
"httpsPluginSyncMode": "",
"httpsPluginAddressbarOnly": "",
"wordFilterEnabled": "",
"wordFilterCategoryEnabled": "",
"wordFilterCustomEnabled": "",
"wordFilterCustom": [],
"categories": {
"enabled": "",
"rateIps": "",
"useHttps": "",
"allow_web": "",
"serverRegion": "",
"categories": {}
},
"urls": {
"urls": {}
},
"bannedWordCategories": {
"categories": {}
},
"fgtFmgProfiles": []
},
"firewall": {
"enabled": "",
"exploitSignaturesEnabled": "",
"showBubbleNotifications": "",
"cAndCEnabled": "",
"rules": {
"applications": {},
"applicationProperties": {},
"categories": {},
"unknownApplications": {
"action": ""
},
"filters": []
}
},
"vpn": {
"enabled": "",
"allowPersonalVpn": "",
"disableConnectDisconnect": "",
"showVpnBeforeLogon": "",
"useLegacyVpnBeforeLogon": "",
"useLocalCompCert": "",
"useCurrentUserCert": "",
"keepRunningMaxTries": "",
"minimizeWindowOnConnect": "",
"useWindowsCredentials": "",
"showNegotiationWindow": "",
"vendorId": "",
"sslEnabled": "",
"ipsecEnabled": "",
"dnsCacheServiceControl": "",
"preferSslVpnDns": "",
"disallowInvalidServerCert": "",
"beepIfError": "",
"useWindowsStoreCerts": "",
"useSmartCardCert": "",
"blockIpv6": "",
"enableUdpChecksum": "",
"disableDefaultRoute": "",
"showAuthCertOnly": "",
"checkForCertPrivateKey": "",
"enhancedKeyUsageMandatory": "",
"suppressVpnNotification": "",
"tunnels": []
},
"vulnerability": {
"enabled": "",
"scanOnFgtRegistration": "",
"scanOnSignatureUpdate": "",
"autoPatchEnabled": "",
"autoPatchLevel": "",
"osUpdates": "",
"proxyEnabled": "",
"exemptManual": "",
"exemptApplications": "",
"applicationExclusions": [],
"exemptNoAutoPatch": "",
"schedule": {
"enabled": "",
"scheduleType": "",
"scanTime": "",
"scan_on_maintenance": "",
"maintenance_period": "",
"maintenance_deadline": ""
}
},
"system": {
"ui": {
"disableBackup": "",
"hideUserInfo": "",
"hideTray": "",
"showHostTag": "",
"cultureCode": "",
"password": ""
},
"log": {
"level": "",
"events": [],
"onnet": "",
"upload": "",
"categories": "",
"server": "",
"ssl": "",
"frequency": "",
"retention": "",
"timeout": "",
"compressed": "",
"sendSoftwareInventory": "",
"sendWindowsEvent": "",
"sendWindowsEventInterval": "",
"logProtocol": "",
"netlogServer": ""
},
"proxy": {
"update": "",
"failover": "",
"online_scep": "",
"virusSubmission": "",
"protocol": "",
"server": "",
"port": "",
"username": "",
"password": ""
},
"update": {
"fmEnabled": "",
"fmServer": "",
"fmPort": "",
"fmFailoverPort": "",
"fmTimeout": "",
"fmFailover": "",
"autoPatch": "",
"updateAction": "",
"scheduled": "",
"scheduleType": "",
"updateTime": "",
"updateInterval": "",
"sendUsageStats": "",
"serverRegion": "",
"useLegacyFdn": ""
},
"fortiProxy": {
"enabled": "",
"https": "",
"timeout": "",
"pop3ClientComforting": "",
"pop3CerverComforting": "",
"smtpClientComforting": "",
"selfTestEnabled": "",
"selfTestNotification": "",
"selfTestLastPort": ""
},
"certificates": {
"ids": []
},
"userIdentity": {
"enableManuallyEntering": "",
"enableLinkedin": "",
"enableGoogle": "",
"enableSalesforce": "",
"notifyUser": ""
}
},
"endpoint": {
"display_antivirus": "",
"display_sandbox": "",
"display_webfilter": "",
"display_firewall": "",
"display_vpn": "",
"display_vulnerability_scan": "",
"bubbleNotifications": "",
"logoffNotification": "",
"disableUnregister": "",
"disableSwitch": "",
"hideComplianceWarning": "",
"sendSoftwareInventory": "",
"enableSubnets": "",
"enableMacs": "",
"subnets": [],
"macs": []
},
"singleSignOnMobilityAgent": {
"enabled": "",
"server": "",
"port": "",
"key": ""
},
"wanOptimization": {},
"apple": {
"configName": ""
},
"basicXml": ""
}
}
}
None.
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": [
{
"id": "",
"name": "",
"profiles": [
{
"id": "",
"name": "",
"is_chrome": "",
"is_default": "",
"parser_error": "",
"update_time": "",
"fp_id": "",
"sync_task": "",
"sync_error": "",
"manual_sync_time": ""
}
]
}
]
}
The Sample - Fortinet FortiClient EMS - 1.0.1
playbook collection comes bundled with the Fortinet FortiClient EMS connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Fortinet FortiClient EMS connector.
Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.
FortiClient Enterprise Management Server (FortiClient EMS) is a security management solution that enables scalable and centralized management of multiple endpoints (computers). FortiClient EMS provides efficient and effective administration of endpoints running FortiClient.
This document provides information about the Fortinet FortiClient EMS connector, which facilitates automated interactions, with the Fortinet FortiClient EMS server using FortiSOAR™ playbooks. Add the Fortinet FortiClient EMS connector as a step in FortiSOAR™ playbooks and perform automated operations, such as quarantining or unquarantining an endpoint ticket in Fortinet FortiClient EMS or retrieving details for events, profiles, etc. from Fortinet FortiClient EMS.
Connector Version: 1.0.1
FortiSOAR™ Version Tested on: 7.2.0-914
FortiClient EMS version Tested on: 7.0.2 build 0123
Authored By: Fortinet
Certified: Yes
Following enhancements have been made to the Fortinet FortiClient EMS connector in version 1.0.1:
Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.
You can also use the following yum command as a root
user to install connectors from an SSH session:
yum install cyops-connector-fortinet-forticlient-ems
To run actions using the Fortinet FortiClient connector users must be assigned appropriate "Roles". Roles are associated with different permissions. To view the various roles that can be assigned to a user, in the Fortinet FortiClient EMS server, navigate to Administration >> Admin Roles.
For example, if you have assigned a role with only "Read" permissions to a user, then that user can run actions such as Get All Endpoints, Get Endpoint Details, etc, but not run actions such as Quarantine Endpoints, Unquarantine Endpoints, etc
You do not require to configure this connector since it looks up the freely accessible Fortinet FortiClient EMS blocklists. For the description of the Content Hub and other details, click here.
In FortiSOAR™, on the Content Hub (or Connector Store) page, click the Manage tab, and then click the Fortinet FortiClient EMS connector card. On the connector popup, click the Configurations tab to enter the required configuration details.
Parameter | Description |
---|---|
Server URL | The URL of the FortiClient EMS server to which you will connect and perform automated operations. |
Username | The username used to access the FortiClient EMS server to which you will connect and perform the automated operations. |
Password | The Password used to access the FortiClient EMS server to which you will connect and perform the automated operations. |
Domain | The domain name of the FortiClient EMS server to which you will connect and perform the automated operations. |
Verify SSL | Specifies whether the SSL certificate for the server is to be verified or not. |
The following automated operations can be included in playbooks and you can also use the annotations to access operations from version 4.10.0 and onwards:
Function | Description | Annotation and Category |
---|---|---|
Quarantine Endpoints | Quarantines the specified endpoints on the Fortinet FortiClient EMS server based on the endpoint IDs you have specified. | quarantine_endpoints Investigation |
Unquarantine Endpoints | Unquarantines the specified endpoints on the Fortinet FortiClient EMS server based on the endpoint IDs you have specified. | unquarantine_endpoints Investigation |
Get All Endpoints | Retrieves a list of all the endpoints connected to the specified Fortinet FortiClient EMS server. | get_endpoints Investigation |
Get Endpoint Details | Retrieves details for a specific endpoint from the Fortinet FortiClient EMS server based on the device ID you have specified. | get_endpoints Investigation |
Get Events For Endpoint | Retrieves events related to a specific endpoint from the Fortinet FortiClient EMS server based on the device ID, event type, and other input parameters you have specified. | get_events_for_endpoint Investigation |
Get Verification Rules | (Deprecated) Retrieves a list of all compliance verification rules from the Fortinet FortiClient EMS server. | get_host_verification_rules Investigation |
Get Host Verification Tags | (Deprecated) Retrieves a list of all host verification tags from the Fortinet FortiClient EMS server. | get_host_verification_tags Investigation |
Get Profile Details | Retrieves information for a specific profile from the Fortinet FortiClient EMS server based on the profile ID you have specified. | get_profile_by_id Investigation |
Get All Profiles | Retrieves information for all profiles from the Fortinet FortiClient EMS server. | get_all_profiles Investigation |
Parameter | Description |
---|---|
Endpoint IDs | IDs of the endpoints to quarantine on the Fortinet FortiClient EMS server. |
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": [
{
"id": "",
"name": "",
"full_host": "",
"host": "",
"ip_addr": "",
"uid": "",
"retval": "",
"message": ""
}
]
}
Parameter | Description |
---|---|
Endpoint IDs | IDs of the endpoints to unquarantine on the Fortinet FortiClient EMS server. |
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": [
{
"id": "",
"name": "",
"full_host": "",
"host": "",
"ip_addr": "",
"uid": "",
"retval": "",
"message": ""
}
]
}
Parameter | Description |
---|---|
Count | (Optional) The number of endpoints to be returned by this operation. |
Offset | (Optional) Index of the first item to be returned by this operation. |
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": {
"endpoints": [
{
"device_id": "",
"name": "",
"ip_addr": "",
"os_version": "",
"group_id": "",
"group_name": "",
"group_path": "",
"orig_group_name": "",
"orig_group_id": "",
"endpoint_policy_name": "",
"domain_id": "",
"installer_name": "",
"deployment_state": "",
"last_seen": "",
"is_installed": "",
"is_managed": "",
"is_ems_registered": "",
"is_ems_online": "",
"is_ems_onnet": "",
"is_fgt_configured": "",
"is_fgt_registered": "",
"is_fgt_online": "",
"is_excluded": "",
"is_quarantined": "",
"quarantine_access_code": "",
"comparable_fct_version": "",
"username": "",
"display_name": "",
"avatar": "",
"profile_name": "",
"is_profile_synced": "",
"off_net_profile_name": "",
"is_off_net_profile_synced": "",
"ip_list_name": "",
"is_ip_list_synced": "",
"policy_sync": "",
"av_enabled": "",
"ae_enabled": "",
"cs_enabled": "",
"rm_enabled": "",
"fw_enabled": "",
"wf_enabled": "",
"vpn_enabled": "",
"vuln_enabled": "",
"ssoma_enabled": "",
"sb_enabled": "",
"av_events_count": "",
"wf_events_count": "",
"fw_events_count": "",
"sb_events_count": "",
"ae_events_count": "",
"rm_events_count": "",
"cs_events_count": "",
"vuln_events_count": "",
"sys_events_count": "",
"vuln_events_max_severity": ""
}
],
"total": ""
}
}
Parameter | Description |
---|---|
Device ID | ID of the device whose details you want to retrieve from the Fortinet FortiClient EMS server. |
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": {
"endpoints": [
{
"device_id": "",
"host": "",
"alias": "",
"name": "",
"ip_addr": "",
"mac_addr": "",
"os_version": "",
"os_service_pack": "",
"distinguished_name": "",
"group_tag": "",
"group_id": "",
"group_name": "",
"group_path": "",
"orig_group_name": "",
"orig_group_id": "",
"endpoint_policy_name": "",
"domain_id": "",
"installer_name": "",
"deployment_state": "",
"scheduled_install_time": "",
"installation_state": "",
"deployment_state_time": "",
"deployment_state_data": "",
"forticlient_id": "",
"uid": "",
"caps": "",
"fct_sn": "",
"fgt_sn": "",
"last_seen": "",
"deregister": "",
"run_cmd": "",
"quarantine_message": "",
"is_installed": "",
"is_managed": "",
"is_ems_registered": "",
"is_ems_online": "",
"is_ems_onnet": "",
"is_fgt_configured": "",
"is_fgt_registered": "",
"is_fgt_online": "",
"is_excluded": "",
"is_quarantined": "",
"quarantine_access_code": "",
"fct_version": "",
"comparable_fct_version": "",
"username": "",
"display_name": "",
"email": "",
"service": "",
"phone": "",
"user_domain": "",
"avatar_fingerprint": "",
"avatar": "",
"profile_name": "",
"is_profile_assigned": "",
"is_profile_synced": "",
"is_profile_imported": "",
"off_net_profile_name": "",
"is_off_net_profile_imported": "",
"is_off_net_profile_synced": "",
"ip_list_name": "",
"is_ip_list_synced": "",
"policy_sync": "",
"av_installed": "",
"av_enabled": "",
"av_hidden": "",
"ae_installed": "",
"ae_enabled": "",
"ae_hidden": "",
"cs_installed": "",
"cs_enabled": "",
"cs_hidden": "",
"rm_installed": "",
"rm_enabled": "",
"rm_hidden": "",
"fw_installed": "",
"fw_enabled": "",
"fw_hidden": "",
"wf_installed": "",
"wf_enabled": "",
"wf_hidden": "",
"vpn_installed": "",
"vpn_enabled": "",
"vpn_hidden": "",
"vuln_installed": "",
"vuln_enabled": "",
"vuln_hidden": "",
"ssoma_installed": "",
"ssoma_enabled": "",
"ssoma_hidden": "",
"sb_installed": "",
"sb_enabled": "",
"sb_hidden": "",
"av_last_scan_type": "",
"av_last_scan_date": "",
"av_last_full_scan_date": "",
"av_last_cancelled_scan_type": "",
"av_last_cancelled_scan_date": "",
"av_scan_scheduled": "",
"av_next_sch_type": "",
"av_next_scan_on": "",
"av_next_scan_hour": "",
"av_next_scan_min": "",
"av_next_scan_type": "",
"vuln_next_scheduled": "",
"vuln_next_sch_type": "",
"vuln_next_scan_on": "",
"vuln_next_start_hour": "",
"vuln_next_start_min": "",
"is_av_scanning": "",
"is_vuln_scanning": "",
"last_vuln_scan": "",
"vuln_scan_status": "",
"av_sig_version": "",
"av_eng_version": "",
"vuln_sig_version": "",
"vuln_eng_version": "",
"app_sig_version": "",
"app_eng_version": "",
"av_events_count": "",
"wf_events_count": "",
"fw_events_count": "",
"sb_events_count": "",
"ae_events_count": "",
"rm_events_count": "",
"cs_events_count": "",
"vuln_events_count": "",
"sys_events_count": "",
"vuln_events_max_severity": "",
"tags": ""
}
],
"total": ""
}
}
Parameter | Description |
---|---|
Device ID | ID of the device whose associated events you want to retrieve from the Fortinet FortiClient EMS server. |
Event Type | Type of event that you want to retrieve for the specified device from the Fortinet FortiClient EMS server. You can choose from the following options: Antivirus Events, System Events, Web filter Events, or Vulnerability Events. |
Offset | (Optional) Index of the first item to be returned by this operation. |
Aggregate List | If you select this checkbox, then this operation will retrieve an aggregated event list from the Fortinet FortiClient EMS server. |
The output contains the following populated JSON schema:
{
"events": [
{
"devicename": "",
"id": "",
"time": "",
"type": "",
"name": "",
"source": "",
"message": "",
"context0": "",
"context1": "",
"context2": "",
"context3": "",
"context4": "",
"context5": "",
"context6": "",
"context7": "",
"context8": "",
"context9": "",
"context10": "",
"checksum": "",
"count": ""
}
],
"total": ""
}
None.
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": {
"policies": [
{
"id": "",
"name": "",
"status": "",
"comments": "",
"tag_name": "",
"tag": ""
}
],
"total": ""
}
}
None.
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": [
{
"id": "",
"name": "",
"policies": [
{
"name": ""
}
]
}
]
}
Parameter | Description |
---|---|
Profile ID | ID of profile whose details you want to retrieve from the Fortinet FortiClient EMS server. |
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": {
"id": "",
"name": "",
"is_chrome": "",
"is_default": "",
"fp_id": "",
"profile": {
"id": "",
"name": "",
"fortiProductId": "",
"isChrome": "",
"isDefault": "",
"xml": "",
"advXml": "",
"parserError": "",
"syncError": "",
"malware": {
"excludedFolders": "",
"excludedFiles": "",
"antivirus": {
"enabled": "",
"sbMalware": "",
"signatureTimer": "",
"scanEmail": "",
"shellIntegration": "",
"rootkitDetection": "",
"scanOnInsertion": "",
"scanMimeFile": "",
"fortiGuardAnalytics": "",
"signatureExpiredNotification": "",
"cullMalwareAfterDays": "",
"realTimeProtection": {
"enabled": "",
"scanCompressedFiles": "",
"compressedFilesMaxSize": "",
"scanWhen": "",
"scanWhenNetwork": "",
"ignoreSystemWhen": "",
"onVirusFound": "",
"alertOnDetect": "",
"antimalwareScanInterface": "",
"scanAdware": "",
"scanRiskware": "",
"rtpAdvHeuristicsEnabled": "",
"rtpAdvHeuristicsAction": "",
"excludedExtensions": ""
},
"onDemand": {
"signatureLoadMemoryThreshold": "",
"onVirusFound": "",
"pauseOnBatteryPower": "",
"allowAdminToStop": "",
"automaticVirusSubmission": "",
"scanCompressedFiles": "",
"compressedFilesMaxSize": "",
"scanRiskware": "",
"scanAdware": "",
"malwareAdvHeuristicsEnabled": "",
"malwareAdvHeuristicsAction": ""
},
"schedule": {
"enabled": "",
"ignore3rdPartyAvConflicts": "",
"scanType": "",
"scanRemovableMedia": "",
"scanNetworkDrives": "",
"priority": "",
"scheduleType": "",
"dayOfMonth": "",
"time": ""
}
},
"antiexploit": {
"enabled": "",
"notification": "",
"exclusions": ""
},
"usb": {
"enabled": "",
"show_bubble_notifications": "",
"action": "",
"rules": {}
},
"cloudscan": {
"enabled": "",
"timeoutEnabled": "",
"timeout": "",
"submitRemovable": "",
"submitNetwork": "",
"submitWeb": "",
"submitEmail": "",
"excludeTrustedSources": "",
"excludedExtensions": "",
"action": "",
"denyOnError": ""
}
},
"sandbox": {
"enabled": "",
"fortiSandboxId": "",
"serverType": "",
"address": "",
"authStatus": "",
"loginAuthenticated": "",
"username": "",
"mode": "",
"supportedExts": [],
"customExts": [],
"timeoutEnabled": "",
"timeout": "",
"submitRemovable": "",
"submitNetwork": "",
"submitWeb": "",
"submitEmail": "",
"excludeTrustedSources": "",
"excludeCustomPaths": "",
"excludedFolders": "",
"excludedFiles": "",
"includeCustomPaths": "",
"includedFolders": "",
"includedFiles": "",
"action": "",
"denyOnError": "",
"verdictLevel": "",
"fortiCloudRegion": "",
"fortiCloudTimeOffset": ""
},
"webfilter": {
"enabled": "",
"syncWithFgtFmg": "",
"fgtFmgProfileId": "",
"blockMaliciousWebsites": "",
"useExclusionList": "",
"disableWhenManagedByFgt": "",
"logAllUrls": "",
"logUserInitiatedTraffic": "",
"safeSearch": "",
"restrictionLevel": "",
"httpsBlockMethod": "",
"httpsPluginEnabled": "",
"httpsPluginSyncMode": "",
"httpsPluginAddressbarOnly": "",
"wordFilterEnabled": "",
"wordFilterCategoryEnabled": "",
"wordFilterCustomEnabled": "",
"wordFilterCustom": [],
"categories": {
"enabled": "",
"rateIps": "",
"useHttps": "",
"allow_web": "",
"serverRegion": "",
"categories": {}
},
"urls": {
"urls": {}
},
"bannedWordCategories": {
"categories": {}
},
"fgtFmgProfiles": []
},
"firewall": {
"enabled": "",
"exploitSignaturesEnabled": "",
"showBubbleNotifications": "",
"cAndCEnabled": "",
"rules": {
"applications": {},
"applicationProperties": {},
"categories": {},
"unknownApplications": {
"action": ""
},
"filters": []
}
},
"vpn": {
"enabled": "",
"allowPersonalVpn": "",
"disableConnectDisconnect": "",
"showVpnBeforeLogon": "",
"useLegacyVpnBeforeLogon": "",
"useLocalCompCert": "",
"useCurrentUserCert": "",
"keepRunningMaxTries": "",
"minimizeWindowOnConnect": "",
"useWindowsCredentials": "",
"showNegotiationWindow": "",
"vendorId": "",
"sslEnabled": "",
"ipsecEnabled": "",
"dnsCacheServiceControl": "",
"preferSslVpnDns": "",
"disallowInvalidServerCert": "",
"beepIfError": "",
"useWindowsStoreCerts": "",
"useSmartCardCert": "",
"blockIpv6": "",
"enableUdpChecksum": "",
"disableDefaultRoute": "",
"showAuthCertOnly": "",
"checkForCertPrivateKey": "",
"enhancedKeyUsageMandatory": "",
"suppressVpnNotification": "",
"tunnels": []
},
"vulnerability": {
"enabled": "",
"scanOnFgtRegistration": "",
"scanOnSignatureUpdate": "",
"autoPatchEnabled": "",
"autoPatchLevel": "",
"osUpdates": "",
"proxyEnabled": "",
"exemptManual": "",
"exemptApplications": "",
"applicationExclusions": [],
"exemptNoAutoPatch": "",
"schedule": {
"enabled": "",
"scheduleType": "",
"scanTime": "",
"scan_on_maintenance": "",
"maintenance_period": "",
"maintenance_deadline": ""
}
},
"system": {
"ui": {
"disableBackup": "",
"hideUserInfo": "",
"hideTray": "",
"showHostTag": "",
"cultureCode": "",
"password": ""
},
"log": {
"level": "",
"events": [],
"onnet": "",
"upload": "",
"categories": "",
"server": "",
"ssl": "",
"frequency": "",
"retention": "",
"timeout": "",
"compressed": "",
"sendSoftwareInventory": "",
"sendWindowsEvent": "",
"sendWindowsEventInterval": "",
"logProtocol": "",
"netlogServer": ""
},
"proxy": {
"update": "",
"failover": "",
"online_scep": "",
"virusSubmission": "",
"protocol": "",
"server": "",
"port": "",
"username": "",
"password": ""
},
"update": {
"fmEnabled": "",
"fmServer": "",
"fmPort": "",
"fmFailoverPort": "",
"fmTimeout": "",
"fmFailover": "",
"autoPatch": "",
"updateAction": "",
"scheduled": "",
"scheduleType": "",
"updateTime": "",
"updateInterval": "",
"sendUsageStats": "",
"serverRegion": "",
"useLegacyFdn": ""
},
"fortiProxy": {
"enabled": "",
"https": "",
"timeout": "",
"pop3ClientComforting": "",
"pop3CerverComforting": "",
"smtpClientComforting": "",
"selfTestEnabled": "",
"selfTestNotification": "",
"selfTestLastPort": ""
},
"certificates": {
"ids": []
},
"userIdentity": {
"enableManuallyEntering": "",
"enableLinkedin": "",
"enableGoogle": "",
"enableSalesforce": "",
"notifyUser": ""
}
},
"endpoint": {
"display_antivirus": "",
"display_sandbox": "",
"display_webfilter": "",
"display_firewall": "",
"display_vpn": "",
"display_vulnerability_scan": "",
"bubbleNotifications": "",
"logoffNotification": "",
"disableUnregister": "",
"disableSwitch": "",
"hideComplianceWarning": "",
"sendSoftwareInventory": "",
"enableSubnets": "",
"enableMacs": "",
"subnets": [],
"macs": []
},
"singleSignOnMobilityAgent": {
"enabled": "",
"server": "",
"port": "",
"key": ""
},
"wanOptimization": {},
"apple": {
"configName": ""
},
"basicXml": ""
}
}
}
None.
The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": [
{
"id": "",
"name": "",
"profiles": [
{
"id": "",
"name": "",
"is_chrome": "",
"is_default": "",
"parser_error": "",
"update_time": "",
"fp_id": "",
"sync_task": "",
"sync_error": "",
"manual_sync_time": ""
}
]
}
]
}
The Sample - Fortinet FortiClient EMS - 1.0.1
playbook collection comes bundled with the Fortinet FortiClient EMS connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Fortinet FortiClient EMS connector.
Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.