Fortinet black logo

Fortinet FortiClient EMS

Fortinet FortiClient EMS v1.0.1

Copy Link
Copy Doc ID c165f1db-cc64-11ec-bb32-fa163e15d75b:276

About the connector

FortiClient Enterprise Management Server (FortiClient EMS) is a security management solution that enables scalable and centralized management of multiple endpoints (computers). FortiClient EMS provides efficient and effective administration of endpoints running FortiClient.

This document provides information about the Fortinet FortiClient EMS connector, which facilitates automated interactions, with the Fortinet FortiClient EMS server using FortiSOAR™ playbooks. Add the Fortinet FortiClient EMS connector as a step in FortiSOAR™ playbooks and perform automated operations, such as quarantining or unquarantining an endpoint ticket in Fortinet FortiClient EMS or retrieving details for events, profiles, etc. from Fortinet FortiClient EMS.

Version information

Connector Version: 1.0.1

FortiSOAR™ Version Tested on: 7.2.0-914

FortiClient EMS version Tested on: 7.0.2 build 0123

Authored By: Fortinet

Certified: Yes

Release Notes for version 1.0.1

Following enhancements have been made to the Fortinet FortiClient EMS connector in version 1.0.1:

  • Fixed a bug that cause the 'Get Events' action to fail with the 'Invalid Type' error.
  • Deprecated the 'Get Verification Rules' and 'Get Host Verification Tags' actions, since the API for these actions is not available from FortiClient EMS version 7.0.0.

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the following yum command as a root user to install connectors from an SSH session:
yum install cyops-connector-fortinet-forticlient-ems

Prerequisites to configuring the connector

  • You must have the URL of the Fortinet FortiClient EMS server to which you will connect and perform automated operations and credentials (username-password pair) to access that server.
  • The FortiSOAR™ server should have outbound connectivity to port 443 on the FortiClient EMS server.

Minimum Permissions Required

To run actions using the Fortinet FortiClient connector users must be assigned appropriate "Roles". Roles are associated with different permissions. To view the various roles that can be assigned to a user, in the Fortinet FortiClient EMS server, navigate to Administration >> Admin Roles.
For example, if you have assigned a role with only "Read" permissions to a user, then that user can run actions such as Get All Endpoints, Get Endpoint Details, etc, but not run actions such as Quarantine Endpoints, Unquarantine Endpoints, etc

Configuring the connector

You do not require to configure this connector since it looks up the freely accessible Fortinet FortiClient EMS blocklists. For the description of the Content Hub and other details, click here.

Configuration parameters

In FortiSOAR™, on the Content Hub (or Connector Store) page, click the Manage tab, and then click the Fortinet FortiClient EMS connector card. On the connector popup, click the Configurations tab to enter the required configuration details.

Parameter Description
Server URL The URL of the FortiClient EMS server to which you will connect and perform automated operations.
Username The username used to access the FortiClient EMS server to which you will connect and perform the automated operations.
Password The Password used to access the FortiClient EMS server to which you will connect and perform the automated operations.
Domain The domain name of the FortiClient EMS server to which you will connect and perform the automated operations.
Verify SSL Specifies whether the SSL certificate for the server is to be verified or not.

Actions supported by the connector

The following automated operations can be included in playbooks and you can also use the annotations to access operations from version 4.10.0 and onwards:

Function Description Annotation and Category
Quarantine Endpoints Quarantines the specified endpoints on the Fortinet FortiClient EMS server based on the endpoint IDs you have specified. quarantine_endpoints
Investigation
Unquarantine Endpoints Unquarantines the specified endpoints on the Fortinet FortiClient EMS server based on the endpoint IDs you have specified. unquarantine_endpoints
Investigation
Get All Endpoints Retrieves a list of all the endpoints connected to the specified Fortinet FortiClient EMS server. get_endpoints
Investigation
Get Endpoint Details Retrieves details for a specific endpoint from the Fortinet FortiClient EMS server based on the device ID you have specified. get_endpoints
Investigation
Get Events For Endpoint Retrieves events related to a specific endpoint from the Fortinet FortiClient EMS server based on the device ID, event type, and other input parameters you have specified. get_events_for_endpoint
Investigation
Get Verification Rules (Deprecated) Retrieves a list of all compliance verification rules from the Fortinet FortiClient EMS server. get_host_verification_rules
Investigation
Get Host Verification Tags (Deprecated) Retrieves a list of all host verification tags from the Fortinet FortiClient EMS server. get_host_verification_tags
Investigation
Get Profile Details Retrieves information for a specific profile from the Fortinet FortiClient EMS server based on the profile ID you have specified. get_profile_by_id
Investigation
Get All Profiles Retrieves information for all profiles from the Fortinet FortiClient EMS server. get_all_profiles
Investigation

operation: Quarantine Endpoints

Input parameters

Parameter Description
Endpoint IDs IDs of the endpoints to quarantine on the Fortinet FortiClient EMS server.

Output

The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": [
{
"id": "",
"name": "",
"full_host": "",
"host": "",
"ip_addr": "",
"uid": "",
"retval": "",
"message": ""
}
]
}

operation: Unquarantine Endpoints

Input parameters

Parameter Description
Endpoint IDs IDs of the endpoints to unquarantine on the Fortinet FortiClient EMS server.

Output

The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": [
{
"id": "",
"name": "",
"full_host": "",
"host": "",
"ip_addr": "",
"uid": "",
"retval": "",
"message": ""
}
]
}

operation: Get All Endpoints

Input parameters

Parameter Description
Count (Optional) The number of endpoints to be returned by this operation.
Offset (Optional) Index of the first item to be returned by this operation.

Output

The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": {
"endpoints": [
{
"device_id": "",
"name": "",
"ip_addr": "",
"os_version": "",
"group_id": "",
"group_name": "",
"group_path": "",
"orig_group_name": "",
"orig_group_id": "",
"endpoint_policy_name": "",
"domain_id": "",
"installer_name": "",
"deployment_state": "",
"last_seen": "",
"is_installed": "",
"is_managed": "",
"is_ems_registered": "",
"is_ems_online": "",
"is_ems_onnet": "",
"is_fgt_configured": "",
"is_fgt_registered": "",
"is_fgt_online": "",
"is_excluded": "",
"is_quarantined": "",
"quarantine_access_code": "",
"comparable_fct_version": "",
"username": "",
"display_name": "",
"avatar": "",
"profile_name": "",
"is_profile_synced": "",
"off_net_profile_name": "",
"is_off_net_profile_synced": "",
"ip_list_name": "",
"is_ip_list_synced": "",
"policy_sync": "",
"av_enabled": "",
"ae_enabled": "",
"cs_enabled": "",
"rm_enabled": "",
"fw_enabled": "",
"wf_enabled": "",
"vpn_enabled": "",
"vuln_enabled": "",
"ssoma_enabled": "",
"sb_enabled": "",
"av_events_count": "",
"wf_events_count": "",
"fw_events_count": "",
"sb_events_count": "",
"ae_events_count": "",
"rm_events_count": "",
"cs_events_count": "",
"vuln_events_count": "",
"sys_events_count": "",
"vuln_events_max_severity": ""
}
],
"total": ""
}
}

operation: Get Endpoint Details

Input parameters

Parameter Description
Device ID ID of the device whose details you want to retrieve from the Fortinet FortiClient EMS server.

Output

The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": {
"endpoints": [
{
"device_id": "",
"host": "",
"alias": "",
"name": "",
"ip_addr": "",
"mac_addr": "",
"os_version": "",
"os_service_pack": "",
"distinguished_name": "",
"group_tag": "",
"group_id": "",
"group_name": "",
"group_path": "",
"orig_group_name": "",
"orig_group_id": "",
"endpoint_policy_name": "",
"domain_id": "",
"installer_name": "",
"deployment_state": "",
"scheduled_install_time": "",
"installation_state": "",
"deployment_state_time": "",
"deployment_state_data": "",
"forticlient_id": "",
"uid": "",
"caps": "",
"fct_sn": "",
"fgt_sn": "",
"last_seen": "",
"deregister": "",
"run_cmd": "",
"quarantine_message": "",
"is_installed": "",
"is_managed": "",
"is_ems_registered": "",
"is_ems_online": "",
"is_ems_onnet": "",
"is_fgt_configured": "",
"is_fgt_registered": "",
"is_fgt_online": "",
"is_excluded": "",
"is_quarantined": "",
"quarantine_access_code": "",
"fct_version": "",
"comparable_fct_version": "",
"username": "",
"display_name": "",
"email": "",
"service": "",
"phone": "",
"user_domain": "",
"avatar_fingerprint": "",
"avatar": "",
"profile_name": "",
"is_profile_assigned": "",
"is_profile_synced": "",
"is_profile_imported": "",
"off_net_profile_name": "",
"is_off_net_profile_imported": "",
"is_off_net_profile_synced": "",
"ip_list_name": "",
"is_ip_list_synced": "",
"policy_sync": "",
"av_installed": "",
"av_enabled": "",
"av_hidden": "",
"ae_installed": "",
"ae_enabled": "",
"ae_hidden": "",
"cs_installed": "",
"cs_enabled": "",
"cs_hidden": "",
"rm_installed": "",
"rm_enabled": "",
"rm_hidden": "",
"fw_installed": "",
"fw_enabled": "",
"fw_hidden": "",
"wf_installed": "",
"wf_enabled": "",
"wf_hidden": "",
"vpn_installed": "",
"vpn_enabled": "",
"vpn_hidden": "",
"vuln_installed": "",
"vuln_enabled": "",
"vuln_hidden": "",
"ssoma_installed": "",
"ssoma_enabled": "",
"ssoma_hidden": "",
"sb_installed": "",
"sb_enabled": "",
"sb_hidden": "",
"av_last_scan_type": "",
"av_last_scan_date": "",
"av_last_full_scan_date": "",
"av_last_cancelled_scan_type": "",
"av_last_cancelled_scan_date": "",
"av_scan_scheduled": "",
"av_next_sch_type": "",
"av_next_scan_on": "",
"av_next_scan_hour": "",
"av_next_scan_min": "",
"av_next_scan_type": "",
"vuln_next_scheduled": "",
"vuln_next_sch_type": "",
"vuln_next_scan_on": "",
"vuln_next_start_hour": "",
"vuln_next_start_min": "",
"is_av_scanning": "",
"is_vuln_scanning": "",
"last_vuln_scan": "",
"vuln_scan_status": "",
"av_sig_version": "",
"av_eng_version": "",
"vuln_sig_version": "",
"vuln_eng_version": "",
"app_sig_version": "",
"app_eng_version": "",
"av_events_count": "",
"wf_events_count": "",
"fw_events_count": "",
"sb_events_count": "",
"ae_events_count": "",
"rm_events_count": "",
"cs_events_count": "",
"vuln_events_count": "",
"sys_events_count": "",
"vuln_events_max_severity": "",
"tags": ""
}
],
"total": ""
}
}

operation: Get Events For Endpoint

Input parameters

Parameter Description
Device ID ID of the device whose associated events you want to retrieve from the Fortinet FortiClient EMS server.
Event Type Type of event that you want to retrieve for the specified device from the Fortinet FortiClient EMS server. You can choose from the following options: Antivirus Events, System Events, Web filter Events, or Vulnerability Events.
Offset (Optional) Index of the first item to be returned by this operation.
Aggregate List If you select this checkbox, then this operation will retrieve an aggregated event list from the Fortinet FortiClient EMS server.

Output

The output contains the following populated JSON schema:
{
"events": [
{
"devicename": "",
"id": "",
"time": "",
"type": "",
"name": "",
"source": "",
"message": "",
"context0": "",
"context1": "",
"context2": "",
"context3": "",
"context4": "",
"context5": "",
"context6": "",
"context7": "",
"context8": "",
"context9": "",
"context10": "",
"checksum": "",
"count": ""
}
],
"total": ""
}

operation: Get Verification Rules

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": {
"policies": [
{
"id": "",
"name": "",
"status": "",
"comments": "",
"tag_name": "",
"tag": ""
}
],
"total": ""
}
}

operation: Get Host Verification Tags

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": [
{
"id": "",
"name": "",
"policies": [
{
"name": ""
}
]
}
]
}

operation: Get Profile Details

Input parameters

Parameter Description
Profile ID ID of profile whose details you want to retrieve from the Fortinet FortiClient EMS server.

Output

The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": {
"id": "",
"name": "",
"is_chrome": "",
"is_default": "",
"fp_id": "",
"profile": {
"id": "",
"name": "",
"fortiProductId": "",
"isChrome": "",
"isDefault": "",
"xml": "",
"advXml": "",
"parserError": "",
"syncError": "",
"malware": {
"excludedFolders": "",
"excludedFiles": "",
"antivirus": {
"enabled": "",
"sbMalware": "",
"signatureTimer": "",
"scanEmail": "",
"shellIntegration": "",
"rootkitDetection": "",
"scanOnInsertion": "",
"scanMimeFile": "",
"fortiGuardAnalytics": "",
"signatureExpiredNotification": "",
"cullMalwareAfterDays": "",
"realTimeProtection": {
"enabled": "",
"scanCompressedFiles": "",
"compressedFilesMaxSize": "",
"scanWhen": "",
"scanWhenNetwork": "",
"ignoreSystemWhen": "",
"onVirusFound": "",
"alertOnDetect": "",
"antimalwareScanInterface": "",
"scanAdware": "",
"scanRiskware": "",
"rtpAdvHeuristicsEnabled": "",
"rtpAdvHeuristicsAction": "",
"excludedExtensions": ""
},
"onDemand": {
"signatureLoadMemoryThreshold": "",
"onVirusFound": "",
"pauseOnBatteryPower": "",
"allowAdminToStop": "",
"automaticVirusSubmission": "",
"scanCompressedFiles": "",
"compressedFilesMaxSize": "",
"scanRiskware": "",
"scanAdware": "",
"malwareAdvHeuristicsEnabled": "",
"malwareAdvHeuristicsAction": ""
},
"schedule": {
"enabled": "",
"ignore3rdPartyAvConflicts": "",
"scanType": "",
"scanRemovableMedia": "",
"scanNetworkDrives": "",
"priority": "",
"scheduleType": "",
"dayOfMonth": "",
"time": ""
}
},
"antiexploit": {
"enabled": "",
"notification": "",
"exclusions": ""
},
"usb": {
"enabled": "",
"show_bubble_notifications": "",
"action": "",
"rules": {}
},
"cloudscan": {
"enabled": "",
"timeoutEnabled": "",
"timeout": "",
"submitRemovable": "",
"submitNetwork": "",
"submitWeb": "",
"submitEmail": "",
"excludeTrustedSources": "",
"excludedExtensions": "",
"action": "",
"denyOnError": ""
}
},
"sandbox": {
"enabled": "",
"fortiSandboxId": "",
"serverType": "",
"address": "",
"authStatus": "",
"loginAuthenticated": "",
"username": "",
"mode": "",
"supportedExts": [],
"customExts": [],
"timeoutEnabled": "",
"timeout": "",
"submitRemovable": "",
"submitNetwork": "",
"submitWeb": "",
"submitEmail": "",
"excludeTrustedSources": "",
"excludeCustomPaths": "",
"excludedFolders": "",
"excludedFiles": "",
"includeCustomPaths": "",
"includedFolders": "",
"includedFiles": "",
"action": "",
"denyOnError": "",
"verdictLevel": "",
"fortiCloudRegion": "",
"fortiCloudTimeOffset": ""
},
"webfilter": {
"enabled": "",
"syncWithFgtFmg": "",
"fgtFmgProfileId": "",
"blockMaliciousWebsites": "",
"useExclusionList": "",
"disableWhenManagedByFgt": "",
"logAllUrls": "",
"logUserInitiatedTraffic": "",
"safeSearch": "",
"restrictionLevel": "",
"httpsBlockMethod": "",
"httpsPluginEnabled": "",
"httpsPluginSyncMode": "",
"httpsPluginAddressbarOnly": "",
"wordFilterEnabled": "",
"wordFilterCategoryEnabled": "",
"wordFilterCustomEnabled": "",
"wordFilterCustom": [],
"categories": {
"enabled": "",
"rateIps": "",
"useHttps": "",
"allow_web": "",
"serverRegion": "",
"categories": {}
},
"urls": {
"urls": {}
},
"bannedWordCategories": {
"categories": {}
},
"fgtFmgProfiles": []
},
"firewall": {
"enabled": "",
"exploitSignaturesEnabled": "",
"showBubbleNotifications": "",
"cAndCEnabled": "",
"rules": {
"applications": {},
"applicationProperties": {},
"categories": {},
"unknownApplications": {
"action": ""
},
"filters": []
}
},
"vpn": {
"enabled": "",
"allowPersonalVpn": "",
"disableConnectDisconnect": "",
"showVpnBeforeLogon": "",
"useLegacyVpnBeforeLogon": "",
"useLocalCompCert": "",
"useCurrentUserCert": "",
"keepRunningMaxTries": "",
"minimizeWindowOnConnect": "",
"useWindowsCredentials": "",
"showNegotiationWindow": "",
"vendorId": "",
"sslEnabled": "",
"ipsecEnabled": "",
"dnsCacheServiceControl": "",
"preferSslVpnDns": "",
"disallowInvalidServerCert": "",
"beepIfError": "",
"useWindowsStoreCerts": "",
"useSmartCardCert": "",
"blockIpv6": "",
"enableUdpChecksum": "",
"disableDefaultRoute": "",
"showAuthCertOnly": "",
"checkForCertPrivateKey": "",
"enhancedKeyUsageMandatory": "",
"suppressVpnNotification": "",
"tunnels": []
},
"vulnerability": {
"enabled": "",
"scanOnFgtRegistration": "",
"scanOnSignatureUpdate": "",
"autoPatchEnabled": "",
"autoPatchLevel": "",
"osUpdates": "",
"proxyEnabled": "",
"exemptManual": "",
"exemptApplications": "",
"applicationExclusions": [],
"exemptNoAutoPatch": "",
"schedule": {
"enabled": "",
"scheduleType": "",
"scanTime": "",
"scan_on_maintenance": "",
"maintenance_period": "",
"maintenance_deadline": ""
}
},
"system": {
"ui": {
"disableBackup": "",
"hideUserInfo": "",
"hideTray": "",
"showHostTag": "",
"cultureCode": "",
"password": ""
},
"log": {
"level": "",
"events": [],
"onnet": "",
"upload": "",
"categories": "",
"server": "",
"ssl": "",
"frequency": "",
"retention": "",
"timeout": "",
"compressed": "",
"sendSoftwareInventory": "",
"sendWindowsEvent": "",
"sendWindowsEventInterval": "",
"logProtocol": "",
"netlogServer": ""
},
"proxy": {
"update": "",
"failover": "",
"online_scep": "",
"virusSubmission": "",
"protocol": "",
"server": "",
"port": "",
"username": "",
"password": ""
},
"update": {
"fmEnabled": "",
"fmServer": "",
"fmPort": "",
"fmFailoverPort": "",
"fmTimeout": "",
"fmFailover": "",
"autoPatch": "",
"updateAction": "",
"scheduled": "",
"scheduleType": "",
"updateTime": "",
"updateInterval": "",
"sendUsageStats": "",
"serverRegion": "",
"useLegacyFdn": ""
},
"fortiProxy": {
"enabled": "",
"https": "",
"timeout": "",
"pop3ClientComforting": "",
"pop3CerverComforting": "",
"smtpClientComforting": "",
"selfTestEnabled": "",
"selfTestNotification": "",
"selfTestLastPort": ""
},
"certificates": {
"ids": []
},
"userIdentity": {
"enableManuallyEntering": "",
"enableLinkedin": "",
"enableGoogle": "",
"enableSalesforce": "",
"notifyUser": ""
}
},
"endpoint": {
"display_antivirus": "",
"display_sandbox": "",
"display_webfilter": "",
"display_firewall": "",
"display_vpn": "",
"display_vulnerability_scan": "",
"bubbleNotifications": "",
"logoffNotification": "",
"disableUnregister": "",
"disableSwitch": "",
"hideComplianceWarning": "",
"sendSoftwareInventory": "",
"enableSubnets": "",
"enableMacs": "",
"subnets": [],
"macs": []
},
"singleSignOnMobilityAgent": {
"enabled": "",
"server": "",
"port": "",
"key": ""
},
"wanOptimization": {},
"apple": {
"configName": ""
},
"basicXml": ""
}
}
}

operation: Get All Profiles

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": [
{
"id": "",
"name": "",
"profiles": [
{
"id": "",
"name": "",
"is_chrome": "",
"is_default": "",
"parser_error": "",
"update_time": "",
"fp_id": "",
"sync_task": "",
"sync_error": "",
"manual_sync_time": ""
}
]
}
]
}

Included playbooks

The Sample - Fortinet FortiClient EMS - 1.0.1 playbook collection comes bundled with the Fortinet FortiClient EMS connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Fortinet FortiClient EMS connector.

  • Get All Endpoints
  • Get All Profiles
  • Get Endpoint Details
  • Get Events For Endpoint
  • Get Host Verification Tags
  • Get Profile Details
  • Get Verification Rules
  • Quarantine Endpoints
  • Unquarantine Endpoints

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.

Previous
Next

About the connector

FortiClient Enterprise Management Server (FortiClient EMS) is a security management solution that enables scalable and centralized management of multiple endpoints (computers). FortiClient EMS provides efficient and effective administration of endpoints running FortiClient.

This document provides information about the Fortinet FortiClient EMS connector, which facilitates automated interactions, with the Fortinet FortiClient EMS server using FortiSOAR™ playbooks. Add the Fortinet FortiClient EMS connector as a step in FortiSOAR™ playbooks and perform automated operations, such as quarantining or unquarantining an endpoint ticket in Fortinet FortiClient EMS or retrieving details for events, profiles, etc. from Fortinet FortiClient EMS.

Version information

Connector Version: 1.0.1

FortiSOAR™ Version Tested on: 7.2.0-914

FortiClient EMS version Tested on: 7.0.2 build 0123

Authored By: Fortinet

Certified: Yes

Release Notes for version 1.0.1

Following enhancements have been made to the Fortinet FortiClient EMS connector in version 1.0.1:

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the following yum command as a root user to install connectors from an SSH session:
yum install cyops-connector-fortinet-forticlient-ems

Prerequisites to configuring the connector

Minimum Permissions Required

To run actions using the Fortinet FortiClient connector users must be assigned appropriate "Roles". Roles are associated with different permissions. To view the various roles that can be assigned to a user, in the Fortinet FortiClient EMS server, navigate to Administration >> Admin Roles.
For example, if you have assigned a role with only "Read" permissions to a user, then that user can run actions such as Get All Endpoints, Get Endpoint Details, etc, but not run actions such as Quarantine Endpoints, Unquarantine Endpoints, etc

Configuring the connector

You do not require to configure this connector since it looks up the freely accessible Fortinet FortiClient EMS blocklists. For the description of the Content Hub and other details, click here.

Configuration parameters

In FortiSOAR™, on the Content Hub (or Connector Store) page, click the Manage tab, and then click the Fortinet FortiClient EMS connector card. On the connector popup, click the Configurations tab to enter the required configuration details.

Parameter Description
Server URL The URL of the FortiClient EMS server to which you will connect and perform automated operations.
Username The username used to access the FortiClient EMS server to which you will connect and perform the automated operations.
Password The Password used to access the FortiClient EMS server to which you will connect and perform the automated operations.
Domain The domain name of the FortiClient EMS server to which you will connect and perform the automated operations.
Verify SSL Specifies whether the SSL certificate for the server is to be verified or not.

Actions supported by the connector

The following automated operations can be included in playbooks and you can also use the annotations to access operations from version 4.10.0 and onwards:

Function Description Annotation and Category
Quarantine Endpoints Quarantines the specified endpoints on the Fortinet FortiClient EMS server based on the endpoint IDs you have specified. quarantine_endpoints
Investigation
Unquarantine Endpoints Unquarantines the specified endpoints on the Fortinet FortiClient EMS server based on the endpoint IDs you have specified. unquarantine_endpoints
Investigation
Get All Endpoints Retrieves a list of all the endpoints connected to the specified Fortinet FortiClient EMS server. get_endpoints
Investigation
Get Endpoint Details Retrieves details for a specific endpoint from the Fortinet FortiClient EMS server based on the device ID you have specified. get_endpoints
Investigation
Get Events For Endpoint Retrieves events related to a specific endpoint from the Fortinet FortiClient EMS server based on the device ID, event type, and other input parameters you have specified. get_events_for_endpoint
Investigation
Get Verification Rules (Deprecated) Retrieves a list of all compliance verification rules from the Fortinet FortiClient EMS server. get_host_verification_rules
Investigation
Get Host Verification Tags (Deprecated) Retrieves a list of all host verification tags from the Fortinet FortiClient EMS server. get_host_verification_tags
Investigation
Get Profile Details Retrieves information for a specific profile from the Fortinet FortiClient EMS server based on the profile ID you have specified. get_profile_by_id
Investigation
Get All Profiles Retrieves information for all profiles from the Fortinet FortiClient EMS server. get_all_profiles
Investigation

operation: Quarantine Endpoints

Input parameters

Parameter Description
Endpoint IDs IDs of the endpoints to quarantine on the Fortinet FortiClient EMS server.

Output

The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": [
{
"id": "",
"name": "",
"full_host": "",
"host": "",
"ip_addr": "",
"uid": "",
"retval": "",
"message": ""
}
]
}

operation: Unquarantine Endpoints

Input parameters

Parameter Description
Endpoint IDs IDs of the endpoints to unquarantine on the Fortinet FortiClient EMS server.

Output

The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": [
{
"id": "",
"name": "",
"full_host": "",
"host": "",
"ip_addr": "",
"uid": "",
"retval": "",
"message": ""
}
]
}

operation: Get All Endpoints

Input parameters

Parameter Description
Count (Optional) The number of endpoints to be returned by this operation.
Offset (Optional) Index of the first item to be returned by this operation.

Output

The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": {
"endpoints": [
{
"device_id": "",
"name": "",
"ip_addr": "",
"os_version": "",
"group_id": "",
"group_name": "",
"group_path": "",
"orig_group_name": "",
"orig_group_id": "",
"endpoint_policy_name": "",
"domain_id": "",
"installer_name": "",
"deployment_state": "",
"last_seen": "",
"is_installed": "",
"is_managed": "",
"is_ems_registered": "",
"is_ems_online": "",
"is_ems_onnet": "",
"is_fgt_configured": "",
"is_fgt_registered": "",
"is_fgt_online": "",
"is_excluded": "",
"is_quarantined": "",
"quarantine_access_code": "",
"comparable_fct_version": "",
"username": "",
"display_name": "",
"avatar": "",
"profile_name": "",
"is_profile_synced": "",
"off_net_profile_name": "",
"is_off_net_profile_synced": "",
"ip_list_name": "",
"is_ip_list_synced": "",
"policy_sync": "",
"av_enabled": "",
"ae_enabled": "",
"cs_enabled": "",
"rm_enabled": "",
"fw_enabled": "",
"wf_enabled": "",
"vpn_enabled": "",
"vuln_enabled": "",
"ssoma_enabled": "",
"sb_enabled": "",
"av_events_count": "",
"wf_events_count": "",
"fw_events_count": "",
"sb_events_count": "",
"ae_events_count": "",
"rm_events_count": "",
"cs_events_count": "",
"vuln_events_count": "",
"sys_events_count": "",
"vuln_events_max_severity": ""
}
],
"total": ""
}
}

operation: Get Endpoint Details

Input parameters

Parameter Description
Device ID ID of the device whose details you want to retrieve from the Fortinet FortiClient EMS server.

Output

The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": {
"endpoints": [
{
"device_id": "",
"host": "",
"alias": "",
"name": "",
"ip_addr": "",
"mac_addr": "",
"os_version": "",
"os_service_pack": "",
"distinguished_name": "",
"group_tag": "",
"group_id": "",
"group_name": "",
"group_path": "",
"orig_group_name": "",
"orig_group_id": "",
"endpoint_policy_name": "",
"domain_id": "",
"installer_name": "",
"deployment_state": "",
"scheduled_install_time": "",
"installation_state": "",
"deployment_state_time": "",
"deployment_state_data": "",
"forticlient_id": "",
"uid": "",
"caps": "",
"fct_sn": "",
"fgt_sn": "",
"last_seen": "",
"deregister": "",
"run_cmd": "",
"quarantine_message": "",
"is_installed": "",
"is_managed": "",
"is_ems_registered": "",
"is_ems_online": "",
"is_ems_onnet": "",
"is_fgt_configured": "",
"is_fgt_registered": "",
"is_fgt_online": "",
"is_excluded": "",
"is_quarantined": "",
"quarantine_access_code": "",
"fct_version": "",
"comparable_fct_version": "",
"username": "",
"display_name": "",
"email": "",
"service": "",
"phone": "",
"user_domain": "",
"avatar_fingerprint": "",
"avatar": "",
"profile_name": "",
"is_profile_assigned": "",
"is_profile_synced": "",
"is_profile_imported": "",
"off_net_profile_name": "",
"is_off_net_profile_imported": "",
"is_off_net_profile_synced": "",
"ip_list_name": "",
"is_ip_list_synced": "",
"policy_sync": "",
"av_installed": "",
"av_enabled": "",
"av_hidden": "",
"ae_installed": "",
"ae_enabled": "",
"ae_hidden": "",
"cs_installed": "",
"cs_enabled": "",
"cs_hidden": "",
"rm_installed": "",
"rm_enabled": "",
"rm_hidden": "",
"fw_installed": "",
"fw_enabled": "",
"fw_hidden": "",
"wf_installed": "",
"wf_enabled": "",
"wf_hidden": "",
"vpn_installed": "",
"vpn_enabled": "",
"vpn_hidden": "",
"vuln_installed": "",
"vuln_enabled": "",
"vuln_hidden": "",
"ssoma_installed": "",
"ssoma_enabled": "",
"ssoma_hidden": "",
"sb_installed": "",
"sb_enabled": "",
"sb_hidden": "",
"av_last_scan_type": "",
"av_last_scan_date": "",
"av_last_full_scan_date": "",
"av_last_cancelled_scan_type": "",
"av_last_cancelled_scan_date": "",
"av_scan_scheduled": "",
"av_next_sch_type": "",
"av_next_scan_on": "",
"av_next_scan_hour": "",
"av_next_scan_min": "",
"av_next_scan_type": "",
"vuln_next_scheduled": "",
"vuln_next_sch_type": "",
"vuln_next_scan_on": "",
"vuln_next_start_hour": "",
"vuln_next_start_min": "",
"is_av_scanning": "",
"is_vuln_scanning": "",
"last_vuln_scan": "",
"vuln_scan_status": "",
"av_sig_version": "",
"av_eng_version": "",
"vuln_sig_version": "",
"vuln_eng_version": "",
"app_sig_version": "",
"app_eng_version": "",
"av_events_count": "",
"wf_events_count": "",
"fw_events_count": "",
"sb_events_count": "",
"ae_events_count": "",
"rm_events_count": "",
"cs_events_count": "",
"vuln_events_count": "",
"sys_events_count": "",
"vuln_events_max_severity": "",
"tags": ""
}
],
"total": ""
}
}

operation: Get Events For Endpoint

Input parameters

Parameter Description
Device ID ID of the device whose associated events you want to retrieve from the Fortinet FortiClient EMS server.
Event Type Type of event that you want to retrieve for the specified device from the Fortinet FortiClient EMS server. You can choose from the following options: Antivirus Events, System Events, Web filter Events, or Vulnerability Events.
Offset (Optional) Index of the first item to be returned by this operation.
Aggregate List If you select this checkbox, then this operation will retrieve an aggregated event list from the Fortinet FortiClient EMS server.

Output

The output contains the following populated JSON schema:
{
"events": [
{
"devicename": "",
"id": "",
"time": "",
"type": "",
"name": "",
"source": "",
"message": "",
"context0": "",
"context1": "",
"context2": "",
"context3": "",
"context4": "",
"context5": "",
"context6": "",
"context7": "",
"context8": "",
"context9": "",
"context10": "",
"checksum": "",
"count": ""
}
],
"total": ""
}

operation: Get Verification Rules

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": {
"policies": [
{
"id": "",
"name": "",
"status": "",
"comments": "",
"tag_name": "",
"tag": ""
}
],
"total": ""
}
}

operation: Get Host Verification Tags

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": [
{
"id": "",
"name": "",
"policies": [
{
"name": ""
}
]
}
]
}

operation: Get Profile Details

Input parameters

Parameter Description
Profile ID ID of profile whose details you want to retrieve from the Fortinet FortiClient EMS server.

Output

The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": {
"id": "",
"name": "",
"is_chrome": "",
"is_default": "",
"fp_id": "",
"profile": {
"id": "",
"name": "",
"fortiProductId": "",
"isChrome": "",
"isDefault": "",
"xml": "",
"advXml": "",
"parserError": "",
"syncError": "",
"malware": {
"excludedFolders": "",
"excludedFiles": "",
"antivirus": {
"enabled": "",
"sbMalware": "",
"signatureTimer": "",
"scanEmail": "",
"shellIntegration": "",
"rootkitDetection": "",
"scanOnInsertion": "",
"scanMimeFile": "",
"fortiGuardAnalytics": "",
"signatureExpiredNotification": "",
"cullMalwareAfterDays": "",
"realTimeProtection": {
"enabled": "",
"scanCompressedFiles": "",
"compressedFilesMaxSize": "",
"scanWhen": "",
"scanWhenNetwork": "",
"ignoreSystemWhen": "",
"onVirusFound": "",
"alertOnDetect": "",
"antimalwareScanInterface": "",
"scanAdware": "",
"scanRiskware": "",
"rtpAdvHeuristicsEnabled": "",
"rtpAdvHeuristicsAction": "",
"excludedExtensions": ""
},
"onDemand": {
"signatureLoadMemoryThreshold": "",
"onVirusFound": "",
"pauseOnBatteryPower": "",
"allowAdminToStop": "",
"automaticVirusSubmission": "",
"scanCompressedFiles": "",
"compressedFilesMaxSize": "",
"scanRiskware": "",
"scanAdware": "",
"malwareAdvHeuristicsEnabled": "",
"malwareAdvHeuristicsAction": ""
},
"schedule": {
"enabled": "",
"ignore3rdPartyAvConflicts": "",
"scanType": "",
"scanRemovableMedia": "",
"scanNetworkDrives": "",
"priority": "",
"scheduleType": "",
"dayOfMonth": "",
"time": ""
}
},
"antiexploit": {
"enabled": "",
"notification": "",
"exclusions": ""
},
"usb": {
"enabled": "",
"show_bubble_notifications": "",
"action": "",
"rules": {}
},
"cloudscan": {
"enabled": "",
"timeoutEnabled": "",
"timeout": "",
"submitRemovable": "",
"submitNetwork": "",
"submitWeb": "",
"submitEmail": "",
"excludeTrustedSources": "",
"excludedExtensions": "",
"action": "",
"denyOnError": ""
}
},
"sandbox": {
"enabled": "",
"fortiSandboxId": "",
"serverType": "",
"address": "",
"authStatus": "",
"loginAuthenticated": "",
"username": "",
"mode": "",
"supportedExts": [],
"customExts": [],
"timeoutEnabled": "",
"timeout": "",
"submitRemovable": "",
"submitNetwork": "",
"submitWeb": "",
"submitEmail": "",
"excludeTrustedSources": "",
"excludeCustomPaths": "",
"excludedFolders": "",
"excludedFiles": "",
"includeCustomPaths": "",
"includedFolders": "",
"includedFiles": "",
"action": "",
"denyOnError": "",
"verdictLevel": "",
"fortiCloudRegion": "",
"fortiCloudTimeOffset": ""
},
"webfilter": {
"enabled": "",
"syncWithFgtFmg": "",
"fgtFmgProfileId": "",
"blockMaliciousWebsites": "",
"useExclusionList": "",
"disableWhenManagedByFgt": "",
"logAllUrls": "",
"logUserInitiatedTraffic": "",
"safeSearch": "",
"restrictionLevel": "",
"httpsBlockMethod": "",
"httpsPluginEnabled": "",
"httpsPluginSyncMode": "",
"httpsPluginAddressbarOnly": "",
"wordFilterEnabled": "",
"wordFilterCategoryEnabled": "",
"wordFilterCustomEnabled": "",
"wordFilterCustom": [],
"categories": {
"enabled": "",
"rateIps": "",
"useHttps": "",
"allow_web": "",
"serverRegion": "",
"categories": {}
},
"urls": {
"urls": {}
},
"bannedWordCategories": {
"categories": {}
},
"fgtFmgProfiles": []
},
"firewall": {
"enabled": "",
"exploitSignaturesEnabled": "",
"showBubbleNotifications": "",
"cAndCEnabled": "",
"rules": {
"applications": {},
"applicationProperties": {},
"categories": {},
"unknownApplications": {
"action": ""
},
"filters": []
}
},
"vpn": {
"enabled": "",
"allowPersonalVpn": "",
"disableConnectDisconnect": "",
"showVpnBeforeLogon": "",
"useLegacyVpnBeforeLogon": "",
"useLocalCompCert": "",
"useCurrentUserCert": "",
"keepRunningMaxTries": "",
"minimizeWindowOnConnect": "",
"useWindowsCredentials": "",
"showNegotiationWindow": "",
"vendorId": "",
"sslEnabled": "",
"ipsecEnabled": "",
"dnsCacheServiceControl": "",
"preferSslVpnDns": "",
"disallowInvalidServerCert": "",
"beepIfError": "",
"useWindowsStoreCerts": "",
"useSmartCardCert": "",
"blockIpv6": "",
"enableUdpChecksum": "",
"disableDefaultRoute": "",
"showAuthCertOnly": "",
"checkForCertPrivateKey": "",
"enhancedKeyUsageMandatory": "",
"suppressVpnNotification": "",
"tunnels": []
},
"vulnerability": {
"enabled": "",
"scanOnFgtRegistration": "",
"scanOnSignatureUpdate": "",
"autoPatchEnabled": "",
"autoPatchLevel": "",
"osUpdates": "",
"proxyEnabled": "",
"exemptManual": "",
"exemptApplications": "",
"applicationExclusions": [],
"exemptNoAutoPatch": "",
"schedule": {
"enabled": "",
"scheduleType": "",
"scanTime": "",
"scan_on_maintenance": "",
"maintenance_period": "",
"maintenance_deadline": ""
}
},
"system": {
"ui": {
"disableBackup": "",
"hideUserInfo": "",
"hideTray": "",
"showHostTag": "",
"cultureCode": "",
"password": ""
},
"log": {
"level": "",
"events": [],
"onnet": "",
"upload": "",
"categories": "",
"server": "",
"ssl": "",
"frequency": "",
"retention": "",
"timeout": "",
"compressed": "",
"sendSoftwareInventory": "",
"sendWindowsEvent": "",
"sendWindowsEventInterval": "",
"logProtocol": "",
"netlogServer": ""
},
"proxy": {
"update": "",
"failover": "",
"online_scep": "",
"virusSubmission": "",
"protocol": "",
"server": "",
"port": "",
"username": "",
"password": ""
},
"update": {
"fmEnabled": "",
"fmServer": "",
"fmPort": "",
"fmFailoverPort": "",
"fmTimeout": "",
"fmFailover": "",
"autoPatch": "",
"updateAction": "",
"scheduled": "",
"scheduleType": "",
"updateTime": "",
"updateInterval": "",
"sendUsageStats": "",
"serverRegion": "",
"useLegacyFdn": ""
},
"fortiProxy": {
"enabled": "",
"https": "",
"timeout": "",
"pop3ClientComforting": "",
"pop3CerverComforting": "",
"smtpClientComforting": "",
"selfTestEnabled": "",
"selfTestNotification": "",
"selfTestLastPort": ""
},
"certificates": {
"ids": []
},
"userIdentity": {
"enableManuallyEntering": "",
"enableLinkedin": "",
"enableGoogle": "",
"enableSalesforce": "",
"notifyUser": ""
}
},
"endpoint": {
"display_antivirus": "",
"display_sandbox": "",
"display_webfilter": "",
"display_firewall": "",
"display_vpn": "",
"display_vulnerability_scan": "",
"bubbleNotifications": "",
"logoffNotification": "",
"disableUnregister": "",
"disableSwitch": "",
"hideComplianceWarning": "",
"sendSoftwareInventory": "",
"enableSubnets": "",
"enableMacs": "",
"subnets": [],
"macs": []
},
"singleSignOnMobilityAgent": {
"enabled": "",
"server": "",
"port": "",
"key": ""
},
"wanOptimization": {},
"apple": {
"configName": ""
},
"basicXml": ""
}
}
}

operation: Get All Profiles

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
"result": {
"retval": "",
"message": ""
},
"data": [
{
"id": "",
"name": "",
"profiles": [
{
"id": "",
"name": "",
"is_chrome": "",
"is_default": "",
"parser_error": "",
"update_time": "",
"fp_id": "",
"sync_task": "",
"sync_error": "",
"manual_sync_time": ""
}
]
}
]
}

Included playbooks

The Sample - Fortinet FortiClient EMS - 1.0.1 playbook collection comes bundled with the Fortinet FortiClient EMS connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Fortinet FortiClient EMS connector.

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.

Previous
Next